sentinel_stealer | hxxps://github[.]com/Anonimusersr/Sentinel-Stealer/raw/refs/heads/main/Stealer[.]rar

Analysis

user interaction
yes
max time kernel
56s
max time network
56s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/06/2026, 12:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/Anonimusersr/Sentinel-Stealer/raw/refs/heads/main/Stealer.rar
Sample260622-p7ectscv5t

Score

10^/10

collection credential_access discovery sentinel_stealer persistence ransomware spyware stealer

Malware Config

Signatures

Family: SentinelStealer
SentinelStealer is an information stealer written in C#.
stealer sentinel_stealer

Detects SentinelStealer in memory 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000000438-247.dat	family_sentinelstealer
behavioral1/memory/4940-248-0x0000028F2EB30000-0x0000028F2EBF0000-memory.dmp	family_sentinelstealer

Executes dropped EXE 12 IoCs

pid	Process
2072	BuilderSentinel.EXE
800	SentinelStealerBuilder.exe
4940	SentinelStealer.exe
5008	BuilderSentinel.EXE
1516	SentinelStealerBuilder.exe
1992	SentinelStealer.exe
3652	BuilderSentinel.EXE
3100	SentinelStealerBuilder.exe
3920	SentinelStealer.exe
2252	BuilderSentinel.EXE
2736	SentinelStealerBuilder.exe
2320	SentinelStealer.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 12 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SentinelStealer.exe
Key opened	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SentinelStealer.exe
Key opened	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SentinelStealer.exe
Key opened	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SentinelStealer.exe
Key opened	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SentinelStealer.exe
Key opened	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SentinelStealer.exe
Key opened	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SentinelStealer.exe
Key opened	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SentinelStealer.exe
Key opened	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SentinelStealer.exe
Key opened	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SentinelStealer.exe
Key opened	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SentinelStealer.exe
Key opened	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SentinelStealer.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	BuilderSentinel.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	BuilderSentinel.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	BuilderSentinel.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	BuilderSentinel.EXE

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
23	raw.githubusercontent.com
24	raw.githubusercontent.com
26	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
45	ip-api.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3452	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134266066857892432"	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2409539145-3342400454-2096821238-1000\{DD77E306-C86B-4E88-B95D-BC20D1827862}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Stealer.rar:Zone.Identifier	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3800	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe
4940	SentinelStealer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1768	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	1768	7zFM.exe
Token: 35	1768	7zFM.exe
Token: SeSecurityPrivilege	1768	7zFM.exe
Token: SeDebugPrivilege	4940	SentinelStealer.exe
Token: SeDebugPrivilege	4940	SentinelStealer.exe
Token: SeDebugPrivilege	4940	SentinelStealer.exe
Token: SeDebugPrivilege	4940	SentinelStealer.exe
Token: SeDebugPrivilege	4940	SentinelStealer.exe
Token: SeDebugPrivilege	4940	SentinelStealer.exe
Token: SeDebugPrivilege	4940	SentinelStealer.exe
Token: SeDebugPrivilege	4940	SentinelStealer.exe
Token: SeDebugPrivilege	4940	SentinelStealer.exe
Token: SeDebugPrivilege	4940	SentinelStealer.exe
Token: SeDebugPrivilege	4940	SentinelStealer.exe
Token: SeDebugPrivilege	4940	SentinelStealer.exe
Token: SeDebugPrivilege	4940	SentinelStealer.exe
Token: SeDebugPrivilege	4940	SentinelStealer.exe
Token: SeDebugPrivilege	4940	SentinelStealer.exe
Token: SeDebugPrivilege	4940	SentinelStealer.exe
Token: SeDebugPrivilege	4940	SentinelStealer.exe
Token: SeDebugPrivilege	4940	SentinelStealer.exe
Token: SeDebugPrivilege	4940	SentinelStealer.exe
Token: SeDebugPrivilege	4940	SentinelStealer.exe
Token: SeDebugPrivilege	4940	SentinelStealer.exe
Token: SeDebugPrivilege	4940	SentinelStealer.exe
Token: SeDebugPrivilege	4940	SentinelStealer.exe
Token: SeDebugPrivilege	4940	SentinelStealer.exe
Token: SeBackupPrivilege	4940	SentinelStealer.exe
Token: SeRestorePrivilege	4940	SentinelStealer.exe
Token: SeDebugPrivilege	1992	SentinelStealer.exe
Token: SeDebugPrivilege	1992	SentinelStealer.exe
Token: SeDebugPrivilege	1992	SentinelStealer.exe
Token: SeDebugPrivilege	1992	SentinelStealer.exe
Token: SeDebugPrivilege	1992	SentinelStealer.exe
Token: SeDebugPrivilege	1992	SentinelStealer.exe
Token: SeDebugPrivilege	1992	SentinelStealer.exe
Token: SeDebugPrivilege	1992	SentinelStealer.exe
Token: SeDebugPrivilege	1992	SentinelStealer.exe
Token: SeDebugPrivilege	1992	SentinelStealer.exe
Token: SeDebugPrivilege	1992	SentinelStealer.exe
Token: SeDebugPrivilege	1992	SentinelStealer.exe
Token: SeDebugPrivilege	1992	SentinelStealer.exe
Token: SeDebugPrivilege	1992	SentinelStealer.exe
Token: SeDebugPrivilege	1992	SentinelStealer.exe
Token: SeDebugPrivilege	1992	SentinelStealer.exe
Token: SeDebugPrivilege	1992	SentinelStealer.exe
Token: SeDebugPrivilege	1992	SentinelStealer.exe
Token: SeDebugPrivilege	1992	SentinelStealer.exe
Token: SeDebugPrivilege	1992	SentinelStealer.exe
Token: SeBackupPrivilege	1992	SentinelStealer.exe
Token: SeRestorePrivilege	1992	SentinelStealer.exe
Token: SeDebugPrivilege	3920	SentinelStealer.exe
Token: SeDebugPrivilege	3920	SentinelStealer.exe
Token: SeDebugPrivilege	3920	SentinelStealer.exe
Token: SeDebugPrivilege	3920	SentinelStealer.exe
Token: SeDebugPrivilege	3920	SentinelStealer.exe
Token: SeDebugPrivilege	3920	SentinelStealer.exe
Token: SeDebugPrivilege	3920	SentinelStealer.exe
Token: SeDebugPrivilege	3920	SentinelStealer.exe
Token: SeDebugPrivilege	3920	SentinelStealer.exe
Token: SeDebugPrivilege	3920	SentinelStealer.exe
Token: SeDebugPrivilege	3920	SentinelStealer.exe
Token: SeDebugPrivilege	3920	SentinelStealer.exe
Token: SeDebugPrivilege	3920	SentinelStealer.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
1768	7zFM.exe
1768	7zFM.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4296	OpenWith.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 4224	4228	msedge.exe	80
PID 4228 wrote to memory of 3452	4228	msedge.exe	81
PID 4228 wrote to memory of 3132	4228	msedge.exe	82
PID 4228 wrote to memory of 3132	4228	msedge.exe	82
PID 4228 wrote to memory of 3132	4228	msedge.exe	82
PID 4228 wrote to memory of 1752	4228	msedge.exe	84
PID 4228 wrote to memory of 1752	4228	msedge.exe	84
PID 4228 wrote to memory of 5064	4228	msedge.exe	85
PID 4228 wrote to memory of 5064	4228	msedge.exe	85
PID 4228 wrote to memory of 5064	4228	msedge.exe	85
PID 4228 wrote to memory of 4948	4228	msedge.exe	86
PID 4228 wrote to memory of 4948	4228	msedge.exe	86
PID 4228 wrote to memory of 4948	4228	msedge.exe	86
PID 4228 wrote to memory of 3972	4228	msedge.exe	88
PID 4228 wrote to memory of 4420	4228	msedge.exe	89
PID 4228 wrote to memory of 4116	4228	msedge.exe	90
PID 4228 wrote to memory of 3972	4228	msedge.exe	88
PID 4228 wrote to memory of 3972	4228	msedge.exe	88
PID 4228 wrote to memory of 4420	4228	msedge.exe	89
PID 4228 wrote to memory of 4420	4228	msedge.exe	89
PID 4228 wrote to memory of 5044	4228	msedge.exe	91
PID 4228 wrote to memory of 5044	4228	msedge.exe	91
PID 4228 wrote to memory of 5044	4228	msedge.exe	91
PID 4228 wrote to memory of 4116	4228	msedge.exe	90
PID 4228 wrote to memory of 4116	4228	msedge.exe	90
PID 4228 wrote to memory of 3220	4228	msedge.exe	93
PID 4228 wrote to memory of 4320	4228	msedge.exe	94
PID 4228 wrote to memory of 3220	4228	msedge.exe	93
PID 4228 wrote to memory of 4320	4228	msedge.exe	94
PID 4228 wrote to memory of 5000	4228	msedge.exe	95
PID 4228 wrote to memory of 5000	4228	msedge.exe	95
PID 4228 wrote to memory of 2076	4228	msedge.exe	96
PID 4228 wrote to memory of 2076	4228	msedge.exe	96
PID 4228 wrote to memory of 2076	4228	msedge.exe	96
PID 4228 wrote to memory of 1432	4228	msedge.exe	97
PID 4228 wrote to memory of 580	4228	msedge.exe	99
PID 4228 wrote to memory of 4900	4228	msedge.exe	100
PID 4900 wrote to memory of 992	4900	msedge.exe	101
PID 4228 wrote to memory of 2540	4228	msedge.exe	107
PID 4228 wrote to memory of 2092	4228	msedge.exe	108
PID 4228 wrote to memory of 1868	4228	msedge.exe	109
PID 2072 wrote to memory of 4140	2072	BuilderSentinel.EXE	111
PID 4140 wrote to memory of 800	4140	cmd.exe	113
PID 4140 wrote to memory of 4940	4140	cmd.exe	114
PID 5008 wrote to memory of 2172	5008	BuilderSentinel.EXE	117
PID 2172 wrote to memory of 1516	2172	cmd.exe	120
PID 2172 wrote to memory of 1992	2172	cmd.exe	121
PID 3652 wrote to memory of 2140	3652	BuilderSentinel.EXE	123
PID 2140 wrote to memory of 3100	2140	cmd.exe	125
PID 2140 wrote to memory of 3920	2140	cmd.exe	126
PID 2252 wrote to memory of 3972	2252	BuilderSentinel.EXE	128
PID 3972 wrote to memory of 2736	3972	cmd.exe	131
PID 3972 wrote to memory of 2320	3972	cmd.exe	132

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SentinelStealer.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SentinelStealer.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Anonimusersr/Sentinel-Stealer/raw/refs/heads/main/Stealer.rar
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x288,0x7ffee486c188,0x7ffee486c194,0x7ffee486c1a0
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,17152897403232931993,2784113446851693116,524288 --field-trial-handle=2300,i,11892536885479780559,15012250510163682893,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,8802918924240569802,17019011639441457160,262144 --field-trial-handle=2300,i,11892536885479780559,15012250510163682893,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,10734647811705545844,5811759793751145392,524288 --field-trial-handle=2300,i,11892536885479780559,15012250510163682893,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:13
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,9538131348177484979,13118339953139459636,2097152 --field-trial-handle=2300,i,11892536885479780559,15012250510163682893,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,6470309590507347982,2088406915309950293,2097152 --field-trial-handle=2300,i,11892536885479780559,15012250510163682893,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=1720,i,16406607326038464181,6909274372017945676,2097152 --field-trial-handle=2300,i,11892536885479780559,15012250510163682893,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,3846819635586349949,726911868808051309,2097152 --field-trial-handle=2300,i,11892536885479780559,15012250510163682893,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:9
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4228,i,9517007344206309983,17910040125606899160,2097152 --field-trial-handle=2300,i,11892536885479780559,15012250510163682893,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4200,i,2373486339247222180,15661676900348021942,2097152 --field-trial-handle=2300,i,11892536885479780559,15012250510163682893,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:9
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,6097329831893588186,9100399350134189011,524288 --field-trial-handle=2300,i,11892536885479780559,15012250510163682893,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:14
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,14166294475383560113,15392991141995167521,524288 --field-trial-handle=2300,i,11892536885479780559,15012250510163682893,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,10701830378133232630,6719369647088779336,524288 --field-trial-handle=2300,i,11892536885479780559,15012250510163682893,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5860,i,122226914768390520,14010827607085675739,2097152 --field-trial-handle=2300,i,11892536885479780559,15012250510163682893,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,348005687957026685,1158855683723540640,524288 --field-trial-handle=2300,i,11892536885479780559,15012250510163682893,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:14
  2⤵
  - NTFS ADS
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,17048025609171327015,11865832417159022016,524288 --field-trial-handle=2300,i,11892536885479780559,15012250510163682893,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,17048025609171327015,11865832417159022016,524288 --field-trial-handle=2300,i,11892536885479780559,15012250510163682893,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
  2⤵
  PID:580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6772,i,9805600779632759290,7931750400920938994,524288 --field-trial-handle=2300,i,11892536885479780559,15012250510163682893,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,16034411389851021897,16075112682933486940,524288 --field-trial-handle=2300,i,11892536885479780559,15012250510163682893,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,1787645761324138323,1880680085748624441,524288 --field-trial-handle=2300,i,11892536885479780559,15012250510163682893,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,2819087931577895922,18348480540131933086,524288 --field-trial-handle=2300,i,11892536885479780559,15012250510163682893,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
  2⤵
  PID:1868

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4744

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4296

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4388

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Stealer.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1768

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Stealer\Readme.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3800

C:\Users\Admin\Downloads\Stealer\BuilderSentinel.EXE
"C:\Users\Admin\Downloads\Stealer\BuilderSentinel.EXE"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c SentinelStealerBuilder.exe & SentinelStealer.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4140
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SentinelStealerBuilder.exe
    SentinelStealerBuilder.exe
    3⤵
    - Executes dropped EXE
    PID:800
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SentinelStealer.exe
    SentinelStealer.exe
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4940

C:\Users\Admin\Downloads\Stealer\BuilderSentinel.EXE
"C:\Users\Admin\Downloads\Stealer\BuilderSentinel.EXE"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c SentinelStealerBuilder.exe & SentinelStealer.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\SentinelStealerBuilder.exe
    SentinelStealerBuilder.exe
    3⤵
    - Executes dropped EXE
    PID:1516
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\SentinelStealer.exe
    SentinelStealer.exe
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    PID:1992

C:\Users\Admin\Downloads\Stealer\BuilderSentinel.EXE
"C:\Users\Admin\Downloads\Stealer\BuilderSentinel.EXE"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c SentinelStealerBuilder.exe & SentinelStealer.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SentinelStealerBuilder.exe
    SentinelStealerBuilder.exe
    3⤵
    - Executes dropped EXE
    PID:3100
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SentinelStealer.exe
    SentinelStealer.exe
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    PID:3920

C:\Users\Admin\Downloads\Stealer\BuilderSentinel.EXE
"C:\Users\Admin\Downloads\Stealer\BuilderSentinel.EXE"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c SentinelStealerBuilder.exe & SentinelStealer.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3972
- - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\SentinelStealerBuilder.exe
    SentinelStealerBuilder.exe
    3⤵
    - Executes dropped EXE
    PID:2736
- - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\SentinelStealer.exe
    SentinelStealer.exe
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - outlook_office_path
    - outlook_win_path
    PID:2320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SentinelStealer.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SentinelStealer.exe.log
Size 1KB
SHA256 6401db02f45fca33f76936b85ec8a9a1e9dfbe61cb382765bbc64e3a7dbb5986
MD5 64ac2ac21dbefd3b0957f0825fc4b844
SHA1 0780b009a8d885b50703821d1ace72ee884ffc59
SHA512 ed0cf2560b392fdfb4d2272382dce26336a9bf044d622118e4fd1cd9aed5eeb1a624bb36fef212298444e4b9ab1581b61eb641e2e183a5799d2cc56e3ae1167d
TLSH
T158419C313376A1D449162F470C2C668467FF4329B590DE4CB698725EDD2744B5F212F3
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 1c02e2feba3b2af3c045d1ed01f8a67e0923f7e357b32c434e567eef6aac4138
MD5 f05b0294ae4949feed0706bc80fa6418
SHA1 346bb7d2d99251c193652ad4ae7ef2964565b98d
SHA512 348366e162f3a037e74d0e9ff422ba7ca3e14c2b170f50bab2a4b88b29a572028e56965c332bc63cbe89de1a3467c215893ecf3cac514d786ec7ea30c08bcc05
SSDEEP 12:bHiUXhV0xosfxCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:blRqxosfxWMk8xVZ4YWI30otWn
TLSH
T139257D85B34494FFC8C35A7189BD17903774F6DE5F42835B6A377A0E2E671D44B48220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0b5dc1bf65a27f8ea20844919d7db192caf7a54fd791434a1304a7df2e9b496f
MD5 5de7bfd3f869f48e7255b6bdc532c4bc
SHA1 c26027eb70bc9887bf69c2b22be60226b685dbae
SHA512 0e6af8c455f57dc816a2c01366f46a0d069e8f41cccb1f7565e2afd873b71ffd5f135649fb4bf44d1a15a9efd68dc59696dc74a971b3483ec9d87a4323b2b4f2
TLSH
T112D08032FB5D6052E7455230D893DF10276644A12C974B41E325C84CD5B80D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e3c932e879f8a7071362a654b47cd73c05f90d7fe66be785d811b84b86743e1b
MD5 8c92d931ed33c3d779a020ae7e111fb4
SHA1 de123f6d92bf24747affe820aaa8be3785388fae
SHA512 5be895d6a61eacf4f3117293636fb4890abbe186ddcbfbb3c8d3aa0fd1aa59519bbdd86e552732d2ded27aae5be1ffb0d6d9f6ccaac824d1b13ed03a12a438dc
TLSH
T13BD08032BB9D6452E7455230D893DF10276644A12C978B42E325C84CD5B90D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

87a4f571-6fb1-43d0-a08c-bb76034d8e08.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\87a4f571-6fb1-43d0-a08c-bb76034d8e08.tmp
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 81eb619c1dd148a0d938e55442b1391a7314cc6ce21a362dba2bf2a3abf6365b
MD5 d62a8a43c0e89c82b13663cc122f78cd
SHA1 10009b656c97a13315b91a004336c80390775280
SHA512 ce2318eb0e99511ba91cb5d0d8412f099f2680aa2499e2661199ea64c39576895a11ca9681b620f15c4b3357708cf1bb7a0857f5a04f8d82cd8846cbcee76334
SSDEEP 384:YcfIkheEBsTHZ4CCCv7Qzct2Vql4zZ5tzHTiTJ0y:HUEBst4DCv7SccVql4FPQ0
TLSH
T1FA1391BE720ACC17DBE200BD196B5A35A77DE064F1D30B1B737274501F6EB122A1E889
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 78d3a99875b9238b1df0ee1d4df5d81cee43da0295b08da944bc19b3953c2bd4
MD5 0c525f9453c538b626bd4956e46eda0a
SHA1 3332c023823269579c579b78997037174b47b956
SHA512 327077b2c371de2a55a7326f0ddc4d62496c80b482b16d69cd91880b276c45c70df2504c81f12aa8cf2c80593860638c3f093e01bc41d985894dc08cd1439652
SSDEEP 1536:0kZ7iUAxNVL//YiL/9o8s2BX0QCibL/aL/r55XmKyhNwdXDAuHrWQ:CFL/RL/lJB6QL/aL/15lycJUa
TLSH
T1F9442EF70941A01BCFA852F5E2133A3DD17B055D7CE1E9E9E2784CD12C29B2276BDA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 97983e42d9cdcd006d935770142a6b95f5a8e2bd7fdb2a40bba12698b302d84b
MD5 b95e785378931fa46077792ae925a79f
SHA1 c10b02ca085d7a09bc2f08de9aa978b1279e2bf1
SHA512 96d79e26e87d7d8037f6e9c229aacea75f982ccd2d0ec6d3f2dd1100a4aceb8e3757c5624877d3e47b6723cb481ca8e7f0bc06d4a2514f79dd6fc20b8ec07929
SSDEEP 49152:4cYymST7BhQSeiiGKa3Gs3oBf/LBbDfm:4cj7ULhVgoBXl
TLSH
T167867DEDCA6898C3CD639970B0F0E9477C7413C3F5A5C1D68898C684026B7C5BBAB769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 aea9aeca421a6e2fc13bb12f812019d0553de13c5854421afef5cd39d70324b7
MD5 46d9a5d4d46b9a456740727fd345c5ba
SHA1 aff5080fa3d23d55a9b2d244923119fd8f378094
SHA512 525ff787e8c048fd27e75044cfd61bb3fd82593939cf84aabc484ec447427207c11b1fe0504be38def123b0a6e70b16c1226026d7c1a20b5101b74a285797721
TLSH
T1A4715F19D972C487EF66E1F0D0E81BD838B48059D96F2F1D4194B57E6C0B792CBE8A08
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5874be.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5874be.TMP
Size 3KB
SHA256 cb1708aa6ace79382c08d7add99dd3db2d6e99c9f6d8e80dcfba7cb8b1fb81a0
MD5 940d9c577479ffa77b552d81dd39928a
SHA1 ff843e836691a3959953ff9e8364115046bb9568
SHA512 aab229532b9c9d282e1e3f710fac10e684217668082de9f5f06231eae85edfd3084569d059412aa28824a2c692240cb8fd5a13820b7ecbc4f93d5b0b78169d1f
TLSH
T16F715F19D972C487EF66F1F0D0E82BD838B48059D96F2F1D4194747E6C0B792CBE8A08
MD5 SHA1 SHA512 TLSH

Submit Download

collectionsSQLite

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Collections\collectionsSQLite
Size 72KB
SHA256 846d4b3ed5153cb6d5176d30d84ce9f5fb9918365d6cbfb5d519a1070ac26094
MD5 24d04a6ce2b8e31dca9aa73c610683d9
SHA1 bdc346b650eb755e2d3833a538f5e0a7c2b16fe5
SHA512 b298abfd55ac38690cad81ab44576fd89d3fb6dfdca3e0316e083ed3296e3bb7bd859081ce7fd3f3b73edbb5356a9fec04723139e5c67d94ae744dd7916567e9
SSDEEP 96:RR94jweGq2L4H7pgNPdQyoDbel9myJrDVb4:/94ZBS4FgNPdPl9myRDVb4
TLSH
T1CA739D5A29143731C5BEB339CD93A0E21D3DA16ECF90E51178A8D9148DB0AF3A0A795A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DIPS-wal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DIPS-wal
Size 76KB
SHA256 a5e8ffcb15ebd4c83da46df59752388c73d254fd0df154af482838bf1e7b5dc2
MD5 c73af7bd56403e62d62c7047338fe202
SHA1 b7900b409b5ae45a45d575e4a1ed5e65ff30405f
SHA512 6fae3248c09ca9f06203bcc3d7a743c5b8b1eb2e8c8ea9fa0564d06781faaf6542e643c141a947e15743986d546ffa4d823c1e009124323264659b76d9a824bb
SSDEEP 96:zCEmrm43b/LuaLNW9WjWbflbxySUmbPNdvj:zMW9WqbfFVjvj
TLSH
T1CE733447CF2D6C31F0C7C17EB98257E90A3806C8BE5B9D90356834634C9560443BB4ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 ab71c6b10fc7709e7e89f4fdb581b36d1b5159bd2d74d9fe7bd4f9376263f4d3
MD5 24f91a54974d1eb589de4a10a7fe7690
SHA1 376025c20cacbf36e72e809e124518dbeee63cd8
SHA512 33c5f4036505f6848d48546f63d1f47e386acaeda2fa851108d415195aeea1c552ed16d7cc792608127cd1835051ce989e7c15cce8c9f17ae3a054a5afd52709
TLSH
T144E0D8A4E5DAC2BD6A1438C74138B708E1803446E7DA7D0F17448CC47683112B69A58A
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 dcc60435b73b2d0b36d900f6a3b714734868bcc0dbe16b1f671fbfd66c04766e
MD5 02e0794ced052210bea5e998e84f02a8
SHA1 fbf60e7015b771645fdcaf2c4fc95ca377e2ed48
SHA512 a12cd92f58ae28452f29a79c8b0bce7d7548a0629f450a300bc52e15c9ecdab084d4812596cfac9923601f4190dc22b89e112eac62be04d2bd2af64baaa8f2c2
SSDEEP 48:Tyi+7f+UZD4jJ/BdIK23CzyPtv0Wx1KWxSCICE+/yQ+Vpyp:GLnD4jJ/L23CjrvB+/1+Vpy
TLSH
T1ECE2C344E232FBAFCFED1D3DA7C8B2F5C5E8202C91EC1A50137D79EA04A96E8654901D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log
Size 266B
SHA256 c7db8e6b956909c549e1a01710917898d7f403724f1e25aa83e2bb7175684f8d
MD5 23545cd766bfa59b0da06fdcf3a429a5
SHA1 9220aa9d16de417210e4c45bc1fc44c0e15b352c
SHA512 436e7434c8d9529a853df7d470e53979e41257508829e50eba39090ab7ac511cbc11602ccaf710fedc43b3266d04b5f5e3aa9f9bb27e01bdb865443ce3548e82
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG
Size 322B
SHA256 59bb7880b9a7bfeaafe4c9229df187c140be2d1a3e3262efa8b5004cc54371f6
MD5 229417c6f382381ad72c5660924fe7ce
SHA1 7bd1f627e96ee45ebf935ed8761bafc9770e0df0
SHA512 34844d32e1e42410ee0f9cf0531cc90f81dec0dfaf52b2cc8a373a5f5f6c1cc069e175fda1cc5e4605bcb317cefbd808a787c21975893dfc86ff132300c0b339
TLSH
T1EFE026B664C8C3697916B88BC2ACEB08C392F45EE3C8394E1B8CCC857041305B3C7285
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG
Size 323B
SHA256 cda81c51fb7d2c4303bbfcac222d50e03265d475fe3065bde6ab931a9a41cedd
MD5 74aa5d789d56934d9903af26f6c89d41
SHA1 52e54a2e63f20f567a62f3ddb6c98434badf1b9a
SHA512 c170795936e8ff00c59dd9f0fd76d5d59328e360d2a362d3d7c22a3d211d03cab6935b3595ae6961a05f69708ebde26e11b8ee57d92d7e40edbabf3cec712ab3
TLSH
T1B3E0866C58E9E26D5515AC97827DE30CC3E1B44BA7C9790E5788CCD56145345B2E36C0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 798B
SHA256 a2f4765271e0a5f8bec5e07531a57e188e857beba530a95151277a5ef7ae0e51
MD5 c6bda62773da4630dda4c9a8d59c7eaf
SHA1 3a052395933147b638f3fc0065bb3091dbe04870
SHA512 a7c65d02572b4c418043e605978386e87ed62546b4ee5189ad32e2687932945e5b28c4c3346cc4f0190c60a5e2064ee36a0d2727f15fbf81611556abc2465567
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 6d50ecfc0acd7089681e976e499c15e2f1f65ff4791a30d9c3653c4816ead448
MD5 61feccc25c1f7e8f50c1bc8babe5470d
SHA1 55d8c35042ef055869132eb13f39b78de7ff17c3
SHA512 e60795e6da0dcc6c7edb37d4816b99f5e202dc6bcf9d14436d992b77ad54a6c7486595208c650e9b78c119ab5a2cb9874b3793692a18991cc5df7a3ac9abdf3f
TLSH
T1DBE026E494CCC26AD62AACE7C27CA30CC2D0340AF3CCB90E57888884A141762B287782
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 05ff5e29d2187406f1bb2f3d0105e6a9ad9882f0ab34b03f5465c82474e120d4
MD5 310bd15dba695d0b1820dae1ae4be83a
SHA1 9b5e8878de637d8d08febcc381b88387fed2405a
SHA512 431e3866d1200b61da8d6fbd351efab3418711bc7fb8f162bbfaf00f95465559ef2c442c14deb890ea774526ee9a14f1af0adcc7388e3f3095dd8fdbad580e2b
SSDEEP 192:x6+Td0+G83uxXBBK31GkSJgVGEJH7DNspU8:x6Wa83uFBBQ1GkS+R7DNspU8
TLSH
T11314534F5F302311CE7D813669EB45A35DADF03F8B536A8978601475CEE3A52A42C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 42439a470b308e40c1448384b48cf074f7f89b26032d4aed185842db0e965949
MD5 21e7dfdc53c6a7579dee7b6465b14e74
SHA1 ca32a7f71bf765c7a8d60ff39db9c58fb3608972
SHA512 42c2363f7dd835625f4af02f7030a00e2e5964d6ab2c925d996220a6cb8c4bcd34c1156ebc1ba11b083336eb8ba06e31bfd51d4310a2658761cea547a8dee0cb
SSDEEP 24:TLJLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfBMokmwO+jKN4fB+AwH:TtLopFMatSaw/auUOt8BMokmwN5fIAwH
TLSH
T10C924F4D5F346221D0F05B36E9D0C5672F7C101D93B77699EE1420F28DA259FF8060AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 fb0ccd3f343bbfef141d539b291ac76261146d6c5f8dcd9cfab1f97a01b76189
MD5 36d4940e5b5c73ea6658f0532370ba1a
SHA1 0c32808d8abf5183c9a5d1ee4ffb0710369272c4
SHA512 e7faee162ce1f3990c4a861169081b9a45fabc2ae937dc80a24ea1437f4498180d979ee448837e1dc43c4cf5be463b2b33af6061797e802453457ae78ef5b044
SSDEEP 192:sxZLRTyM/jK1Ml8MoI/fNsKENgIdpM/W6+WNGY0oqtMJ4IgrJ:sxZLDQI/fNs3NhM/bG579
TLSH
T1FB42E7126B346977CCCBD209FA55BF53D6F91572A2900E44A9FCCA0C05E6EED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 a4d1167226b998dc69ae822073029f85cf7e81775716106c6e402284d3526bc8
MD5 93eb1fa5584baa7ebbe0455adf7a6e81
SHA1 cc6a6571f5fb8eac25dbcb306fda525af8e87c07
SHA512 d05e151f6c0c0c5e0f183702eb1c2f49205053c44e4541a61d142be212acac9657d98e6248e38435e8185e677a58c73237dfaa6226918a1d9e582fc754a647b6
SSDEEP 768:eSc0s8Ww2YfWRm/JQg18F1+UoAYDCx9Tuqh0VfUC9xbog/OV3BOLl/TB0Oipro6G:eSc0s8Ww2YfWRm/JQg1u1jaKBOLpTuOt
TLSH
T135E20A3B284CC77E4F840EADEC26AF966ED801CB66584D5447FE494C03C77EA521A49F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 8d44f9bd9db6cb1595c0f636bb5e1cd3f90526cca607a5f161a1897933f678d9
MD5 8b7208e8cd81e3e93f9afe5307b5ef4a
SHA1 ebb2c81412f4be15e6c7d325b8d516770e6d9251
SHA512 bccffb8be909b0e7e22110f6194360627a0d24de2bdbc2d22a4eda5a0b32cb19f5b9ca85c6882c97293e00ba19a92da4decc905772aa856de939e09e99eafefa
TLSH
T178E0262095E8D2BD6157A447022CD308D3F5F54BD3C83D8E6FC4C9C96183705B2A31C0
MD5 SHA1 SHA512 TLSH

Submit Download

Session_13426606685094985

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13426606685094985
Size 399B
SHA256 31b4d2b650c6fa881fbb80abc0cacc215ef9c1ab59ab77dab41fea7401cc9e9b
MD5 5e9e31e2bb0fef1209d1480cfb0bc539
SHA1 dd8a3770eb4349ecc34b4338a28d8c64594764b9
SHA512 92b732d8ef8f64ccb19b2c20b66dce8d4ba8558538dbf3b4d6de9590d17fac4806a54b58d48634f2635a2246b4c24eebd1d64bb385bf0704f7bab77cb6dd1e3c
TLSH
T1D5E086475FC43EECCF59263B94CC6BCE82F045C1C1488DA7B4A1007502E64D18B42558
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 332e3415936efb1933027505304d0f4856abcbe959c9904f5191e44032a9499b
MD5 7a2b27944bf4e34cc1204ec789144b11
SHA1 d90f75145adcacffdcf822dd8d3f20b9aae1df21
SHA512 1368c78cdf4868f37785963fd653bc6fac41fe4de3aa0cb95c763f5a13513c9cb2bed71d5d635443c50be6a1085a3f4cc35d8c42d9df3b6b4dbd312f3d8914bb
TLSH
T1C8E0D83465DDC7BA764624CB421CF308C2A3F446D7CA791D2B48D4CC624A7497243240
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 e427d4bdf3b622cfdeddf01622ca15c61dc580cded355f320942d8c22dae9581
MD5 d2afebd3d561d0883aeb9ff46768838e
SHA1 1fd44f23a9eb2a14409cbf717dab938702886874
SHA512 c9cdb1b7280591f3e8d6c35bf3b5c354924bd8884e1e32592b8472fbb3a00a9ba6263b1e2b398e05c0bdbf731ef1b4f745a4a904b3fc01993e3a3cfbe824e417
TLSH
T110E0267496D9C3795500E49B426CE70DC2F1F80B93C97A0E574884CAA541302B2A75C0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1ffd8704b2e690872e9cad4905761cba9a5a73d44ea0a379b937ddb097aeabfa
MD5 b694b80e3eee9a33a56970382dd129c0
SHA1 8d4fd045ce9d05ad11dc41e9827b854466c0542d
SHA512 b2add8838c13a9cc08fb06cb3b1d8f5e553db282c33b887f8dbaeeec39cb55dc87438a21aaa82c2d7a715073054a10f97bc21c919501433f3390d2100d019315
SSDEEP 96:KPz0NBDx1nI9++upnKGmuHnqrz2NlsmJCKCshykK/KeKz:Uz0NBDx1I9+Rp7muHqrz2NlsptzS
TLSH
T149911742B1B622113C3E6808A3A4AA1B5642B593706AB47B3BE850F1DF67F101DFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 8b928667fecd0a0a1578e671bfa3bc0cb131453145dd9e2ef2516bff3b306bc6
MD5 05d25897b2a603f3411edafd485d624d
SHA1 97520e29a7bd9ea6836de740673a48a1aec89fec
SHA512 2bba41c56ad3aaa63d3ff1a72b1c3d3f21caf3c8e34b1170c6773c31492230cb1fe201396f077552c18718baeef2f70e05e17f6ef190afab16378610c626b09c
SSDEEP 192:FvoWFr3fT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:a6zfQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T10424640A7B747001DDE7E9725CB080771A3CB16ECF22A6915DA254698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db-wal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal
Size 3.9MB
SHA256 ee16c7a62cbebfce4407800e95f62d42346d9a10a882e2cda60a8193890a69d5
MD5 72ec1823f15751ff501fa895d51b4341
SHA1 3f609715622acec1fd662ff9d251a4172bbf1a68
SHA512 d1cf5d1a195198e825547ac81c39b16eef054af9f1a55e054c8afb1964d90d328ceeaefac0e263f47ce02684e237eeabe99233d9358d6c397d2d2f4e4250f8c4
SSDEEP 49152:KnJFVF0qWs3kPBPOSkyYpLMC8iLavRnDQ4/TLQpcFGSdHYtW6fdtmtZV2:eqK
TLSH
T19416CAF37D1981AEC9CEC574D92BEE4850B34661CA24C5E5A93C08C37F78902FEB5989
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 15KB
SHA256 7c3a165792eaa1b78631a539d9e4d9c0a2d321eecf9d380c28b9e21fd053d1cc
MD5 a0aaed17d7a14a45c1f01100bacaa383
SHA1 08d750469fd3f770e834835b9a69772a5bd5dc39
SHA512 434d82eccb53f8254c84f4c1bb8b94401e37522df648ce1043319a37fef6fc6c04486ff85e2c02c01068f719e952489cc999075b5c30af499375c2e63d958045
SSDEEP 192:qQXIIImbGMIMslYcYCbO+sAsUlrNHssD1wul:qQXIIImbGMIMuBe+Vs+CsWul
TLSH
T15A62A67A5B611B7BC26E2FB709B5CA9446D48C414DE16A2C31A0284F8DF7F6742F12F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 86c04d4fdaca5f36cb3789f572661b031ed9f881e4694cdb2a544b12c5f0a2a0
MD5 04dc53e7e4795ec3195acb9ef0cfa8ef
SHA1 396d5c69f3e20a86621f927bb99ae22ee746a1b0
SHA512 12a319c4f8dde1e3dd79eb05d57f3ca66c6752e88e892246e2d13624e1238bf74e80f903a56e96bca0aa957937997c07ce7355b62901cd1d3a68d12073f969d2
TLSH
T1F0E020E0F4D7C29E651564AB02589308C3C03407EBC4794D5F44C8C8E44130172D72C1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 e2f6e1691530b7e14a4074e35059294371762c37523fdd8fa515cc8b60d11123
MD5 2b6be77572156e9e4c9545a42ab6d9a6
SHA1 d3d01344b37c37f38ca6e537bf0528b4bc6fb8dc
SHA512 1e0fcb2c6a46a6d77ef2c0072d9d75dcf1f44a6694ed9527146ba0fe37bd5e6594e5f30be992a6a1faabf54e0d63c1ccbfb3e9588dfbfc4730920d8fd9626099
TLSH
T1B1119C96F330C104D1854B3A202EAB041338D4028FF8ED1F147A20642FB7A160D4B6D9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 4036da4f9b8c83e6879303505eec406463e2db0aa33d773f08b74cf5282da35e
MD5 a0d97838a53a5332bd8aa0fe60b30926
SHA1 119b254572d9b1825419a3264756987e472cdecb
SHA512 9e7d9e0aef3591d5e930189269cbfbd32f658f1f9de9b8d782f5757dbaaed5165fa2ac4c5a62f95faae91508f710bb21cc7a41a11ef38eaf3722b15021b0dd13
TLSH
T1BCE048A0B4D6D29F551564A706A8D348D2D17847EBC57E4D5F44CC8895413467297281
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ad7dfacd4a3dccee7e7fa44b832974981aa623530088f4a78ca506a20084a975
MD5 d0945e74e1129be8957a3495bb3c4434
SHA1 47f87700bdcc3520896e7f5da36690c7c6a3855a
SHA512 7e281515f2a3ccb61dd8618462ee2c9998f825ba5c0449017fdd6fa42717cbb2a3cfb67c00cc3d89a95aea65a36f63ceada4b8cdf2106b8684f07f00ec974868
SSDEEP 384:8tNn/s3n9Sn8NvZDC6wBFUu8YZusVuMAC82MbdbJOx9b:8j+9M1DiCZ1V9ACixEvb
TLSH
T15B928C725825BC2B5DA39299FA0A36074FB8A027A6C53F44D5EC7F0D05DB6EC6347C0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 eedb0d757c3f8aad1b84cb4d4e154f106a3056cd49d1f26761c6df47e8d03628
MD5 d1e705b9ae9ac80d33a99fd6e2e1bd6e
SHA1 f5ebb71a52ca2b2f2aea869217202fde80fce543
SHA512 cf4f2d3de2a75d1e40bef19739f5533b25d9ea0551faf13c24d984f9ee08cb696136c606cc15dab311943f45458689d58f3855324d51037a1a71db1f0090c7d6
SSDEEP 384:ttNn/s3n9Sn8NvVDC6wBFUu8YZusVuMAC82MbdbJOx9b:tj+9MJDiCZ1V9ACixEvb
TLSH
T134927B725865BC2B5DA39299F60A36074FB8A027A6C52F44D5EC7F0D05CA6EC6347C0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b3a6a7fcba0804247d4ea3af3c44e8420b22b7d1aff11b64580e947534b90c43
MD5 26e3ecf300795053ac6fb3ea7ecb4336
SHA1 8e6cc15cebb0281ec78198faeff5ef7a5d98dbd4
SHA512 de530c5c70d714ec1589d42045fdb251c88434753a24e33965a01b5878a11e14039cfad4e6eb8b121f2ccd1ea98a70a91d1386c4d74ef9575521a28a7da281df
SSDEEP 192:XGNy6jCQmiUyqIVf4SufoPxzYuSus6cImcSn2HxU6:XGNy6qRufju8YZus/IxU6
TLSH
T10902EB756C6C786B9EB36E49F98737135FA5212BEA852F44CAE81F1C00D769C2306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 517d7f19195a75e931c4fe7f5630e316c593e0669fed4e59a851d1b18c865fea
MD5 edf0e1e854f6e95f9c69c770d5311b34
SHA1 c8f501da27a329566188180c9d61d6350e6cb5e8
SHA512 b1ce9d5120f6184af7a67813b3072557982b8effbb4ab250970e98a402e1241b78dd5e21980cf11cd41db4ddac4e43622f515f62f2735435fc1e2172972f3b86
SSDEEP 384:AtNn/s3n9Sn8NvKDC6wBFUu8YZusVuMAC82MbdbJOx9b:Aj+9MgDiCZ1V9ACixEvb
TLSH
T1BC927B725865BC2B5DA39299F60A36074FB8A027A6C62F44D5EC7F0D05CB7EC6347C0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d208f70300be812c692d47ad0754229b5adefda6058351b057844a49330311f5
MD5 c93f2d2750da3a4bc61bf89eef2f7428
SHA1 7d8dc65a3bd09a6b90ba16da980166febcd3f787
SHA512 4611d46428c97bd3d2d7dd534654c11f09311b7321eb2cf07653953d12b0b11c94b1c3fad101c12c135f35f760c02c52e9d02d9a8a1475189206b69f375bfb59
SSDEEP 192:3GNK6juQmiUyZV34SufoPxzYuSus6cImISuMFOMkqYU6:3GNK6+23ju8YZusVuMpCU6
TLSH
T14012F9719C68B82B6DA36698F54736034FB56127EE893F44D6EC2E0C01EF69C6306C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 48KB
SHA256 b07a988f6371a745e8902eabb027907ef58b8e4f90f50ccbbb3b413e20a07100
MD5 20f74edb3210914de8e7de8330aef7a2
SHA1 b2188c8a3a086af06e7c62ba627d2146c15cf1ea
SHA512 4ea6a42c4cda88ba5d87e52462fb8660f6d2ff4afa38fd9e8d89d9ff7a9bd76789d50db0b87fc47118ab77b663be2d11d468dc5e5280ed167aa886896d9c288c
SSDEEP 24:TLr4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6Uwr0KfLe:TI/IHRH34kWqB1kQnjhHmr6ITmU0Le
TLSH
T11423896EDA2CBAA2FEE40B3DD7D1D4127B35AA0EC2E4D9F1099B406746C540405EB63E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SentinelStealer.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SentinelStealer.exe
Size 754KB
SHA256 444e528d261c51fb26ff6092807f39f7e269c5d1214dc5970a9c15d314267a6a
MD5 a992765c47e8b70ee4d2accbc72f3bf6
SHA1 9bdfc309ce53f9944e131b4e1101f8afa95098f5
SHA512 27ebdda5181e199a4391a44e78cf9f08d09b3617f8fc536e4e966a9f6529e32bb4f024d8f1a4ce5bf7dbc96cacb0975a841922b5831cb4a7ef2f576b4483d60f
SSDEEP 12288:QK+dBuieGV2SEnZUighdqxrxM6bASjDrbJg9wyEHORfsiNHx0JVDe/L1iWQYOaZd:idkiFYfZaqxrxM
TLSH
T1E0F4DC9C766072DFC857C876DEA81C64FB6074BB931B9203A42715ED9A4D89BCF180F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SentinelStealerBuilder.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SentinelStealerBuilder.exe
Size 158KB
SHA256 3ed3f50c46e3a2b5000747c42aefa7b35100312045e6c850b6ec2ab5bb5be19d
MD5 b5ff11ce0fbcc22ae1fc9365efca2179
SHA1 76a3bdd79260f8cb7fb5139b5fd3d70d6bd0e0fc
SHA512 c6db5db10ff559eb56d2833c5c15f863e6d72f499cbbb6ace64f4ed72f2a05198a74763951abb196d262484d78dd0bb3bf342547affa5853fca1184549cb7a8b
SSDEEP 3072:7XwANETcQt1OvbRxHrfqDQXF+duPYse8wm082jT6gbq:7lxvtxLfyQXAXDrF
TLSH
T18EF33B13A6AC51FEE1B3D678C9924941FB7278594B71A6CF03504EBA0F76BD09E39302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Stealer.rar

Path C:\Users\Admin\Downloads\Stealer.rar
Size 1.1MB
SHA256 88016648659104341ca072a114fdf25c12804655d4749ba5735fb1006467ce7c
MD5 7c773048576cae389f1c0941403c83de
SHA1 5d6c41f10a47ec04032a7ab84e5529a43ae24bde
SHA512 c0fd9da297685e5f4d0dcc34d641c7919c163dc8fab71205beaa77b41b6a57d174d3d0eda45e74295a6cf9a9ec06da421f86e186a6a065ed6af5c55c002e0e4c
SSDEEP 24576:U0poUDguRiZtTCKzOs/6pJuI6PElr3YdwwuOeDjM6ljXBovfpoLTQ:U02uY/TXOBpAI6PEB3YHA3j+2w
TLSH
T173453312CDBACB26C7028CC37764C5BECC17296DCD562963C29D8A1E83835B0ADB5D76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Stealer.rar:Zone.Identifier

Path C:\Users\Admin\Downloads\Stealer.rar:Zone.Identifier
Size 127B
SHA256 290478f7e9abe5b4952a305953fb3e72d29f27f015922233c326bf4e40e17678
MD5 24eb26d96dd7f7a842005a467733724a
SHA1 6843efb78ee5cc0ea6b1bf0256fecb012367df65
SHA512 26555381a502c73fc1ab681bdb84b785f564795f219cd3ac12fcc95a4ddc31c151c389d47644c8a1068cfbcfb164cdff09cc07d8ad0d24cfbd4fbb9e4f490b97
TLSH
T142B02B1705100E08071431F299B458CC904C6410CC47FE00D5D0808FD9C825F10F0436
MD5 SHA1 SHA512 TLSH

Submit Download

BuilderSentinel.EXE

Path C:\Users\Admin\Downloads\Stealer\BuilderSentinel.EXE
Size 524KB
SHA256 feb3169d98459fab8a7f9ebf8e326e253561e50ff09543898c7463178b3a73ed
MD5 830e7b365f4986402ddc23a863996fca
SHA1 ff5b108b779fe7323774be1f3876e4dae3c83edd
SHA512 f7ddf997d55ed8698f58c1f417aef703cedda5fa493ea05c723ccd4d3c0a9dca3eefcf6a594437d9778eb98c1c32b15b72faaa85a8761510c8b366d7b97de630
SSDEEP 12288:ZDK+6KrV2cvwG7nhvjHRHlME6Hde3CORog/kFGCs1oaLsb/gD:eSYcIG51lMEYmag/tZLg/gD
TLSH
T1EFB4021F97EC54B6E06593784AE247A3A1307DA0376507DF22CEC6FA4A122E47335B4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Readme.txt

Path C:\Users\Admin\Downloads\Stealer\Readme.txt
Size 50B
SHA256 875a916e5a217cc73b345ae5def667d76a291f8ee207bdd8e2979293ed42a4fa
MD5 226f4306275650b2ccfa52eae0eebe35
SHA1 ce0664df40de92f9bdcbadbc7b2f043f361fd21f
SHA512 ee84e297d0facbd01850d9abc793379bf8ea4019d287607da2d0f597fca32709415b37625e5b87132495d6570442e2427b3c338e88fa1f646a6052abe943aba6
TLSH
T1F19002AB11AD098162B685929609B459F07691ADACE14008900155500555931555242C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4940-250-0x0000028F2F070000-0x0000028F2F082000-memory.dmp

Download

memory/4940-249-0x0000028F2F000000-0x0000028F2F052000-memory.dmp

Download

memory/4940-248-0x0000028F2EB30000-0x0000028F2EBF0000-memory.dmp

Download

memory/4940-251-0x0000028F30A00000-0x0000028F30A50000-memory.dmp

Download