5d980a6b2ab38ad5d1e23f8592077d93305e4fcbaf82e2e325977ef48b98cb75

Analysis

max time kernel
157s
max time network
162s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/06/2026, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup-1.5.exe
Size 788.0MB
Sample260625-mt2vvsaz6v
SHA256 5d980a6b2ab38ad5d1e23f8592077d93305e4fcbaf82e2e325977ef48b98cb75
MD5 29f64d98f72834f4b73d681ecccb864d
SHA1 5408d72ca41e3342cc8e61edf96b83650e955dbf
SHA512 bc9c59a9b189d5e0e417a0a01cea126d5ebd0a0706c3907309ff6cb13dca66e540e9713076c2b9da570b9e49509883882ddc4c2046a28cd20f7b4fccb401f4de
SSDEEP 24576:02W3Vs3m4e+xeJDIEWiX9TMt9Q9j+otBclY3ilEEsWy3+SXtxzBele5rK2mM48Fl:02Wls24e9JsENBM+zqpa35436
TLSH
T13A89AE1B7C9048F9D8AA573998B661857B78BC050B7613CB2E94B3782F723D0BD79B04
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 23 IoCs

description	pid	Process	procid_target
PID 4464 created 4916	4464	setup-1.5.exe	88
PID 4464 created 3736	4464	setup-1.5.exe	89
PID 4464 created 2968	4464	setup-1.5.exe	90
PID 4464 created 2240	4464	setup-1.5.exe	91
PID 4464 created 1288	4464	setup-1.5.exe	92
PID 4464 created 3236	4464	setup-1.5.exe	94
PID 4464 created 5092	4464	setup-1.5.exe	95
PID 4464 created 4916	4464	setup-1.5.exe	88
PID 4464 created 4916	4464	setup-1.5.exe	88
PID 4464 created 2240	4464	setup-1.5.exe	91
PID 4464 created 2240	4464	setup-1.5.exe	91
PID 4464 created 5004	4464	setup-1.5.exe	113
PID 4464 created 5888	4464	setup-1.5.exe	114
PID 4464 created 5740	4464	setup-1.5.exe	115
PID 4464 created 4892	4464	setup-1.5.exe	116
PID 4464 created 3796	4464	setup-1.5.exe	117
PID 4464 created 3224	4464	setup-1.5.exe	120
PID 4464 created 5432	4464	setup-1.5.exe	121
PID 4464 created 4212	4464	setup-1.5.exe	122
PID 4464 created 5004	4464	setup-1.5.exe	113
PID 4464 created 5004	4464	setup-1.5.exe	113
PID 4464 created 4892	4464	setup-1.5.exe	116
PID 4464 created 4892	4464	setup-1.5.exe	116

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4464	setup-1.5.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2240	chrome.exe
4892	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	setup-1.5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	setup-1.5.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134268580761175579"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-537605601-1362463912-856654178-1000\{8C19DB06-5AEE-429E-B5D1-1D6BFF8243C7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
4464	setup-1.5.exe
4464	setup-1.5.exe
4464	setup-1.5.exe
4464	setup-1.5.exe
4464	setup-1.5.exe
4464	setup-1.5.exe
4464	setup-1.5.exe
4464	setup-1.5.exe
4464	setup-1.5.exe
4464	setup-1.5.exe
4464	setup-1.5.exe
4916	chrome.exe
4916	chrome.exe
4464	setup-1.5.exe
4464	setup-1.5.exe
4464	setup-1.5.exe
4464	setup-1.5.exe
4464	setup-1.5.exe
4464	setup-1.5.exe
4464	setup-1.5.exe
4464	setup-1.5.exe
4464	setup-1.5.exe
4464	setup-1.5.exe
4464	setup-1.5.exe
4464	setup-1.5.exe
4464	setup-1.5.exe
4464	setup-1.5.exe
4464	setup-1.5.exe
4464	setup-1.5.exe
4464	setup-1.5.exe
4464	setup-1.5.exe
4464	setup-1.5.exe
4464	setup-1.5.exe
4464	setup-1.5.exe
4464	setup-1.5.exe
4464	setup-1.5.exe
4464	setup-1.5.exe
4464	setup-1.5.exe
4464	setup-1.5.exe
4464	setup-1.5.exe
4464	setup-1.5.exe
4464	setup-1.5.exe
4464	setup-1.5.exe
4464	setup-1.5.exe
4464	setup-1.5.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	4464	setup-1.5.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
5004	msedge.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 4916	4464	setup-1.5.exe	88
PID 4916 wrote to memory of 3736	4916	chrome.exe	89
PID 4916 wrote to memory of 2968	4916	chrome.exe	90
PID 4916 wrote to memory of 2968	4916	chrome.exe	90
PID 4916 wrote to memory of 2240	4916	chrome.exe	91
PID 4916 wrote to memory of 1288	4916	chrome.exe	92
PID 4916 wrote to memory of 1288	4916	chrome.exe	92
PID 4916 wrote to memory of 3236	4916	chrome.exe	94
PID 4916 wrote to memory of 3236	4916	chrome.exe	94
PID 4916 wrote to memory of 5092	4916	chrome.exe	95
PID 4916 wrote to memory of 5092	4916	chrome.exe	95
PID 4916 wrote to memory of 1296	4916	chrome.exe	98
PID 4916 wrote to memory of 1296	4916	chrome.exe	98
PID 4916 wrote to memory of 1296	4916	chrome.exe	98
PID 4916 wrote to memory of 3088	4916	chrome.exe	99
PID 4916 wrote to memory of 3088	4916	chrome.exe	99
PID 4916 wrote to memory of 4404	4916	chrome.exe	100
PID 4916 wrote to memory of 4404	4916	chrome.exe	100
PID 4916 wrote to memory of 3780	4916	chrome.exe	104
PID 4916 wrote to memory of 4980	4916	chrome.exe	105
PID 4916 wrote to memory of 3780	4916	chrome.exe	104
PID 4916 wrote to memory of 1976	4916	chrome.exe	106
PID 4916 wrote to memory of 4980	4916	chrome.exe	105
PID 4916 wrote to memory of 1976	4916	chrome.exe	106
PID 4916 wrote to memory of 5368	4916	chrome.exe	107
PID 4916 wrote to memory of 5368	4916	chrome.exe	107
PID 4916 wrote to memory of 3084	4916	chrome.exe	108
PID 4916 wrote to memory of 5632	4916	chrome.exe	109
PID 4916 wrote to memory of 3084	4916	chrome.exe	108
PID 4916 wrote to memory of 5632	4916	chrome.exe	109
PID 4916 wrote to memory of 4712	4916	chrome.exe	111
PID 4916 wrote to memory of 3368	4916	chrome.exe	110
PID 4916 wrote to memory of 728	4916	chrome.exe	112
PID 4916 wrote to memory of 4712	4916	chrome.exe	111
PID 4916 wrote to memory of 3368	4916	chrome.exe	110
PID 4916 wrote to memory of 728	4916	chrome.exe	112
PID 4464 wrote to memory of 5004	4464	setup-1.5.exe	113
PID 5004 wrote to memory of 5888	5004	msedge.exe	114
PID 5004 wrote to memory of 5740	5004	msedge.exe	115
PID 5004 wrote to memory of 4892	5004	msedge.exe	116
PID 5004 wrote to memory of 5740	5004	msedge.exe	115
PID 5004 wrote to memory of 5740	5004	msedge.exe	115
PID 5004 wrote to memory of 3796	5004	msedge.exe	117
PID 5004 wrote to memory of 3796	5004	msedge.exe	117
PID 5004 wrote to memory of 920	5004	msedge.exe	119
PID 5004 wrote to memory of 3224	5004	msedge.exe	120
PID 5004 wrote to memory of 920	5004	msedge.exe	119
PID 5004 wrote to memory of 920	5004	msedge.exe	119
PID 5004 wrote to memory of 3224	5004	msedge.exe	120
PID 5004 wrote to memory of 3224	5004	msedge.exe	120
PID 5004 wrote to memory of 5432	5004	msedge.exe	121
PID 5004 wrote to memory of 4212	5004	msedge.exe	122
PID 5004 wrote to memory of 5432	5004	msedge.exe	121
PID 5004 wrote to memory of 5432	5004	msedge.exe	121
PID 5004 wrote to memory of 4212	5004	msedge.exe	122
PID 5004 wrote to memory of 4212	5004	msedge.exe	122
PID 5004 wrote to memory of 604	5004	msedge.exe	123
PID 5004 wrote to memory of 604	5004	msedge.exe	123
PID 5004 wrote to memory of 436	5004	msedge.exe	124
PID 5004 wrote to memory of 436	5004	msedge.exe	124
PID 5004 wrote to memory of 3356	5004	msedge.exe	126
PID 5004 wrote to memory of 4112	5004	msedge.exe	127
PID 5004 wrote to memory of 4112	5004	msedge.exe	127

C:\Users\Admin\AppData\Local\Temp\setup-1.5.exe
"C:\Users\Admin\AppData\Local\Temp\setup-1.5.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x12c,0x130,0xc0,0x134,0x7ffd76d8c728,0x7ffd76d8c734,0x7ffd76d8c740
    3⤵
    PID:3736
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1692,i,17588259458524357164,7402425922754864593,262144 --field-trial-handle=1904,i,13675031884136700881,505610636252147751,262144 --variations-seed-version --mojo-platform-channel-handle=1900 /prefetch:2
    3⤵
    PID:2968
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1500,i,6762406802520400363,4265429063853193764,524288 --field-trial-handle=1904,i,13675031884136700881,505610636252147751,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2240
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2244,i,1954468340095098695,18087902056586749671,524288 --field-trial-handle=1904,i,13675031884136700881,505610636252147751,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:13
    3⤵
    PID:1288
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3080,i,1274462243227117570,2005129889830388089,2097152 --field-trial-handle=1904,i,13675031884136700881,505610636252147751,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:1
    3⤵
    PID:3236
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3100,i,8313490717182758177,10034120117662393237,2097152 --field-trial-handle=1904,i,13675031884136700881,505610636252147751,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:1
    3⤵
    PID:5092
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4584,i,3216260218884401571,7218633578428961026,524288 --field-trial-handle=1904,i,13675031884136700881,505610636252147751,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:14
    3⤵
    PID:1296
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5368,i,11567052859605261359,2232586938267928625,524288 --field-trial-handle=1904,i,13675031884136700881,505610636252147751,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
    3⤵
    PID:1296
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5424,i,3527186121517871802,16237098732226031796,2097152 --field-trial-handle=1904,i,13675031884136700881,505610636252147751,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
    3⤵
    PID:3088
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5432,i,3279094910497591879,14663962989705933293,2097152 --field-trial-handle=1904,i,13675031884136700881,505610636252147751,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
    3⤵
    PID:4404
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5744,i,5239305453382916637,12448739041221500786,2097152 --field-trial-handle=1904,i,13675031884136700881,505610636252147751,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:1
    3⤵
    PID:3780
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5788,i,9972144347727047409,17709552767521414487,524288 --field-trial-handle=1904,i,13675031884136700881,505610636252147751,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
    3⤵
    PID:4980
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5712,i,5705848402359798435,715812123948007154,2097152 --field-trial-handle=1904,i,13675031884136700881,505610636252147751,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:1
    3⤵
    PID:1976
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5432,i,6379524865036082096,17601088142866376150,2097152 --field-trial-handle=1904,i,13675031884136700881,505610636252147751,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:1
    3⤵
    PID:5368
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5580,i,13408438551633265868,13060229618271617810,2097152 --field-trial-handle=1904,i,13675031884136700881,505610636252147751,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:1
    3⤵
    PID:3084
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,14025257764934183273,17511756623366989931,524288 --field-trial-handle=1904,i,13675031884136700881,505610636252147751,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
    3⤵
    PID:5632
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5456,i,5886879335090962166,15417118822372772193,524288 --field-trial-handle=1904,i,13675031884136700881,505610636252147751,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
    3⤵
    PID:3368
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5936,i,8066136536286885626,6634348347976569698,2097152 --field-trial-handle=1904,i,13675031884136700881,505610636252147751,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:1
    3⤵
    PID:4712
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5392,i,2666317212209611556,6757961525299553781,2097152 --field-trial-handle=1904,i,13675031884136700881,505610636252147751,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:1
    3⤵
    PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ffd6751c188,0x7ffd6751c194,0x7ffd6751c1a0
    3⤵
    PID:5888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1704,i,5726804431347624079,2313267492911944360,262144 --field-trial-handle=2284,i,11662363957892633323,14689333976581504236,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
    3⤵
    PID:5740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,6106643236162540978,14438124130457234321,524288 --field-trial-handle=2284,i,11662363957892633323,14689333976581504236,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2640,i,1431079793435621933,13686533065282103519,524288 --field-trial-handle=2284,i,11662363957892633323,14689333976581504236,262144 --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:13
    3⤵
    PID:3796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,9718561878271770294,8652574261606537327,2097152 --field-trial-handle=2284,i,11662363957892633323,14689333976581504236,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3524,i,650554443834751062,5655221513700746422,2097152 --field-trial-handle=2284,i,11662363957892633323,14689333976581504236,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:3224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,10057931823168867077,9921955826899295862,2097152 --field-trial-handle=2284,i,11662363957892633323,14689333976581504236,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
    3⤵
    PID:5432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,13179530071667109664,16426202647541503209,2097152 --field-trial-handle=2284,i,11662363957892633323,14689333976581504236,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:9
    3⤵
    PID:4212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,16226335007976452215,3843568441946858169,524288 --field-trial-handle=2284,i,11662363957892633323,14689333976581504236,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
    3⤵
    PID:604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,16778779831306717789,8093727230915144420,524288 --field-trial-handle=2284,i,11662363957892633323,14689333976581504236,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
    3⤵
    PID:436
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,7029895515904540543,3499251296341399379,524288 --field-trial-handle=2284,i,11662363957892633323,14689333976581504236,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
    3⤵
    PID:252
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,7029895515904540543,3499251296341399379,524288 --field-trial-handle=2284,i,11662363957892633323,14689333976581504236,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
    3⤵
    PID:3356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,2598756395287557331,1841352562742069313,524288 --field-trial-handle=2284,i,11662363957892633323,14689333976581504236,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
    3⤵
    PID:4112

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4264

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6877fb14-c642-4797-9da5-1c7c7ca7839b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\6877fb14-c642-4797-9da5-1c7c7ca7839b.tmp
Size 5KB
SHA256 dc2151e99eb22407eea442be70018c467c5bd39321767e265097086de08a6089
MD5 3692d349e58a5ec99dbaa25b85953d7b
SHA1 81c0ccee4c3bcec51160f6f12af257ce05e6942b
SHA512 db15f84b825820559d2c8d967a523de6c83072dff0a86547d914e93b22f4de32022882acb3cf0a08d1e6a4e83bb6fc710957ecd6780acdca4c6723637c68189b
SSDEEP 96:aC6Hd+kaO2Zqk3kfITREO1Sl8h4otop5L/DbB6E0Gyv0mEcArMlQIN0j9IpqoToB:aC2PGZqk3fTiWiU2flBJmEcAYlQINUOy
TLSH
T1E4C13B7168BDEC7365F2E682B4032B13CDA4606BD545AF94E9EA0F0C11E74EC1387627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 4f9cee4bf7dc1466d72e0a7a72bbb6330f67a5806116ff2e9531132acaf07bd8
MD5 96d91b411910ee44ef29d2a562d34da6
SHA1 eb85b1e7af3901a494e3fd1ac059ee5849b48fad
SHA512 6374d8382d206fc6a388fe3e45169a130ca1c6576b66dc17f7862d1824211c164a25cca6698c388f6d3111c6bb01fdd90274b6445c0013d69571c21e31c69901
SSDEEP 192:7Rr6LPUxCyVv7+vAPRp2O9mHsb+WNnPHPaJe72VvGZVyIsnAUgR:7Rr6ob66XFQwvPH2oR
TLSH
T17932952EAA24683B5CCBD61AFA617753D6F5102171D52E84F7FC8A2C15E7ACC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 b383db5218c2e414ff813ff67dd84e69eb8929b8b00815aea6db890f0691349b
MD5 e1d4916f25452601da52b1cc5dd8ad18
SHA1 557682da20bd811ae7cafd64bd102a780cbd9356
SHA512 458cacff3ae71418497beac0eb3f5189b6b7e8041bd8002a911c389046351fb848008c285a0e29424f775f0c1a6c70ca3824a08e7e365665dcba9464356c101d
SSDEEP 192:e8z4K66Q7KxkXqK4I40pUZNCgVLHrKHfFKslEx0kSXzKD/tQ+ErUkKN98o8CUX7H:ZzjlQ7KxkXqKf/pUZNCgVLH2HfgslcPm
TLSH
T16D32E827958D9A7B0FD8E90DDC426F8B6CB5019776680C24A2FB9D0803A5BCA110E5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 00899b72d84665a692b263a47e382da28aa8c7106512d93c09d2260148abf1bd
MD5 172a7827bf66478805a64994f0ffce33
SHA1 155869230902fe8adba9da0a3131012390468a54
SHA512 c0f5c82415a7d25b840c8ac5899555259a547d9d09f644421dbe24820cb3ab06ae034a2ad7cfc3ebba9f59a8c730ccddb15313b56b5b8e44598a6a93c5eb4b78
SSDEEP 96:4C0d+kaO2Zqk3kfIbEOERDotok5LvDbB6iGyv0mEEshImbx4+v4a:4C0PGZqk3fYNDUDHlWmErhImbx4g
TLSH
T130A10A7264BEDD779471E686B5422B03CE686167E5529F84F9DD0F0C20A70EC1386627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5f46172781024fe58b7a7d87a406b81679d17de445e9e90110d33f5747ecc226
MD5 08a5ef0e8eb4590a7f0e6f821698071e
SHA1 1b756aceae48cf2649d310d7ab4883595c2e5bde
SHA512 95c72989df00c3caf1230ca41b6dcbc24f8a592c45202f7b16044b8d574fe569d4db8614652b0d1695d3fe1d795b07ea334de5b4fa9dcbb9d27de40a55592586
TLSH
T155D080757B467A11D58F0476D424E271A737455125D296057170C10E55602D1FFC90A7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ff19e848916f9346514f95113e3d80cd569935b36d785719b19d90f9f740fbd6
MD5 5ab41182d14eb22e7143c63d2e18b77b
SHA1 ca8c747e1a5e38b0f0a08b492fcea6d3a75865c2
SHA512 bbecb67f89826ee2bd219f14bbc8ca87fb260f8a22bd2d52b6ccdb72d47a4b58eeb897a42a6e591bd4e75fe870419162172353d5d3ec7f1fb0fbc7b5dc6adcf1
TLSH
T1AED080757B467B11D58F0472D424E271A737455135D296057170C10E55602D1FFCA0B7
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 49acfec6cac84e6892b653fa4282b5b3623341995e381e26bf7a8be2ea3bb3b9
MD5 6cf5aa591b3352d6c815ed7f1e4112a9
SHA1 3141a4ad740f8bc93a5c8b079b038b601f64cd24
SHA512 60c873bd7e90a43777926358923898326816979eaad0e3aa40bc2c261a7cff7189099987979eb35c2790a2e36db31be81a3791efea3883996e6dc225d973ad79
SSDEEP 24:KKsfcc+IZK8hU1SSRCFyXkRb4Tu2LhfbnEDbq+IP3nKuwh2Zn1QV3SCJo8YuGpO6:KgZIZKKUkryZyIfKzCAXvI1KEEYPy8
TLSH
T1A3910801307A1681387D660881E1992FD6837163705AE93BBBFA75E61E67E040FFCADD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 7dcfd9fdfaa9d157420f0ec9fc27ebf6cd5c1c315aa385c9d8bf4d260bc964f0
MD5 844f02fc75be7f10479e9423c76db026
SHA1 527508491a4c2f56d00f47e8f6a9339fa78c0d93
SHA512 58946ee47c8af026a09811b15fbfe9b823b6299f3b9f7c41edef36ee4011a0c7a8a9099ad960ce42b4ed801d05067e2e529ce9d0aec5c3ca271bd0813bfabcaa
SSDEEP 768:3jaeqD4MlshiLdMmf3ZjfyifylA7NpespIRM0UmkTziwjgzGWnApXLPQTU:3qcjhIdMo3ZfNfZQsZ0UmYOnKXD
TLSH
T15603CF7698205EB78CB6EA8A264376476FB00253D2C43FC8DCDE5E0D42936DC530B96B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4916_1177635171\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4464-115-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-98-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-17-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-15-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-14-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-13-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-44-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-52-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-69-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-87-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-89-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-99-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-124-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-136-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-135-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-134-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-133-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-123-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-122-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-121-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-120-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-119-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-118-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-117-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-116-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-0-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-106-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-105-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-104-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-103-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-102-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-101-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-100-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-16-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-95-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-94-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-88-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-86-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-85-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-84-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-83-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-82-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-73-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-72-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-71-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-70-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-66-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-65-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-64-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-68-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-67-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-51-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-50-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-49-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-12-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-11-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-10-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-9-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-8-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-7-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-6-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-5-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-4-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-3-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-2-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-1-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4464-2326-0x0000000490000000-0x000000049021B000-memory.dmp

Download