b435de3e50714d774f42cfdefd710519915e7f987f69da8d5fc1963961519844

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 16:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
acr-m2_patched.exe
Size 5.5MB
Sample260628-th4nmsh15s
SHA256 b435de3e50714d774f42cfdefd710519915e7f987f69da8d5fc1963961519844
MD5 0184f5f0b05f0bfb33f2657836f00dd5
SHA1 0a5b8f09e60b8c9598e16e1ffb37d877da4d069d
SHA512 f2d329616f619e63a404dad70403a4300ceb4ee2e8ead45fa56408fc156a5aaca9a3f5489103b3c1a171323b8341d1ece798b6de165caed372e8bb9d00c7b37d
SSDEEP 49152:Ms9FsIhQBKJR7u4vFYsfBszb6TbsJvJoRmMC:frsIhQBKJRT5Bsn6cJgm
TLSH
T1EA464A41FEC704F6E503163294A762AF23346D054F3A9B97EB043ABDEA772D5582334A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 4352 created 3792	4352	acr-m2_patched.exe	58
PID 4352 created 3792	4352	acr-m2_patched.exe	58

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4352	acr-m2_patched.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	acr-m2_patched.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5200	chrome.exe
3844	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	acr-m2_patched.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	acr-m2_patched.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
5352	chrome.exe
5352	chrome.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4352	acr-m2_patched.exe
4352	acr-m2_patched.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5352	chrome.exe
5352	chrome.exe
6788	msedge.exe
6788	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
6788	msedge.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 5352	4352	acr-m2_patched.exe	90
PID 5352 wrote to memory of 2728	5352	chrome.exe	91
PID 5352 wrote to memory of 5568	5352	chrome.exe	92
PID 5352 wrote to memory of 5568	5352	chrome.exe	92
PID 5352 wrote to memory of 5200	5352	chrome.exe	93
PID 5352 wrote to memory of 5792	5352	chrome.exe	94
PID 5352 wrote to memory of 5792	5352	chrome.exe	94
PID 5352 wrote to memory of 1464	5352	chrome.exe	96
PID 5352 wrote to memory of 5936	5352	chrome.exe	97
PID 5352 wrote to memory of 1464	5352	chrome.exe	96
PID 5352 wrote to memory of 5936	5352	chrome.exe	97
PID 4352 wrote to memory of 6788	4352	acr-m2_patched.exe	98
PID 6788 wrote to memory of 4700	6788	msedge.exe	99
PID 6788 wrote to memory of 4104	6788	msedge.exe	100
PID 6788 wrote to memory of 3844	6788	msedge.exe	101
PID 6788 wrote to memory of 4104	6788	msedge.exe	100
PID 6788 wrote to memory of 4104	6788	msedge.exe	100
PID 6788 wrote to memory of 2268	6788	msedge.exe	103
PID 6788 wrote to memory of 2268	6788	msedge.exe	103
PID 6788 wrote to memory of 1512	6788	msedge.exe	104
PID 6788 wrote to memory of 1512	6788	msedge.exe	104
PID 6788 wrote to memory of 1516	6788	msedge.exe	105
PID 6788 wrote to memory of 1512	6788	msedge.exe	104
PID 6788 wrote to memory of 1516	6788	msedge.exe	105
PID 6788 wrote to memory of 1516	6788	msedge.exe	105

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3792
- C:\Users\Admin\AppData\Local\Temp\acr-m2_patched.exe
  "C:\Users\Admin\AppData\Local\Temp\acr-m2_patched.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-fre --no-default-browser-check --disable-background-networking --disable-sync --disable-gpu --mute-audio --new-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5352
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8357dc728,0x7ff8357dc734,0x7ff8357dc740
    3⤵
    PID:2728
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1644,i,9966571130437243183,6513703769714827648,262144 --field-trial-handle=1896,i,3257548243106896024,17999107841547432107,262144 --variations-seed-version --mojo-platform-channel-handle=1892 /prefetch:2
    3⤵
    PID:5568
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=1320,i,866732281514993531,10480691019873930018,524288 --field-trial-handle=1896,i,3257548243106896024,17999107841547432107,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5200
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=2216,i,6342437649126829874,16766926056246406308,524288 --field-trial-handle=1896,i,3257548243106896024,17999107841547432107,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:13
    3⤵
    PID:5792
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3140,i,9947811111434871028,16020407389417477462,2097152 --field-trial-handle=1896,i,3257548243106896024,17999107841547432107,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:1
    3⤵
    PID:1464
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3148,i,5815068460826960968,16186504212725849284,2097152 --field-trial-handle=1896,i,3257548243106896024,17999107841547432107,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:1
    3⤵
    PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-fre --no-default-browser-check --disable-background-networking --disable-sync --disable-gpu --mute-audio --new-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x25c,0x7ff82060c188,0x7ff82060c194,0x7ff82060c1a0
    3⤵
    PID:4700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1852,i,6306065820288461409,16465493986717565582,262144 --field-trial-handle=2404,i,10045357034452904344,13637681272117249240,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
    3⤵
    PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2044,i,13291233356183111549,14669664815537224758,524288 --field-trial-handle=2404,i,10045357034452904344,13637681272117249240,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2684,i,1932720449937212445,15357598399915821415,524288 --field-trial-handle=2404,i,10045357034452904344,13637681272117249240,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:13
    3⤵
    PID:2268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,8605055711933534566,9080163772265563063,2097152 --field-trial-handle=2404,i,10045357034452904344,13637681272117249240,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
    3⤵
    PID:1512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,16535234976390455392,2852709569187474510,2097152 --field-trial-handle=2404,i,10045357034452904344,13637681272117249240,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
    3⤵
    PID:1516

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6044

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 9a120068e31a240d91857110c6e166b013369260a35b4dfd096ffe5875e091a4
MD5 272c71f74aadb4aa2ba695399014d194
SHA1 07bd44023784d2c516777f7ca521a888114c697d
SHA512 3a3bf4a404cc50bd3477eadcbcc3abec6581783344525d5fd58e7f39f3c007194cd2bf2bf6f314876fbfbffe1dddb557fbee0e358638bd53667fe8a657361581
SSDEEP 96:EC0d+9r+md8aPtfnSC4m2SsRDotok5XJDiB6MGyv2jnmj/Fsborv4a:EC0OrDdz1SC4QqDUDJiA1mjObov
TLSH
T1ADA11973A0B88D77A97ADAC6B4522A07CEF46017A501BB94D4CC0F0C15EB8ED1352A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f955c8d6f1a1a3190d5e321035e28ca582fcb76ec2f60d653e90465ff9d1ea00
MD5 0213e77255f07e9c3fc2c451f7a980eb
SHA1 a625e805f5575150fe89058ebdc7b3356ff294ad
SHA512 94f5a80a660d01988274953f2dc96b3f630595c4d1011e0137458475b3b6bda55410996e5d95fff27f7dfa7d3bf4ad111036266eb70344bc4183986e8f524b78
TLSH
T1BBD080277919E851C05611315C39C7795619414B3EE5C20F75D5E04ED8D645063D7547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 83748c5f59c12f467f96b0d21c3c9653419dfd0271c8efbdeebbd6ba4bd7548e
MD5 96bfca4318642edfa521d002be0f096d
SHA1 447f1b34ddedc860a8f0bd0c6dc12c229624acab
SHA512 b49889400d8441bd0f61eebe0a2489d48e83671a4d77bfdef519545878aebce5aa04d5e498b1e16dc02fc2a5990edce5232840f2805bd3cf047ef33c92fa70f4
TLSH
T112D080277919E851C0561171583DC779561941473EE6C20F79D5F04ED8D645073D7543
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 769a3eb5e4f91baf54eacfea3aa594d2de7b961d6407012165522c65e4984319
MD5 7905b6971cf61198bbe95dc79cdd5c3c
SHA1 acf6558e10d0cbd5dc41618b784e1aabd29124e8
SHA512 5398f7e446fdc9a685d78a63f9361275c394ac62f781a691c95472931813b62944b8ccd5e47542cfa3f5a783ea346681b06c6b115ca5235e0053866cbf9bde6c
SSDEEP 384:DNrRZyCSDnxTICYMEhIKyll7svbFKfk7:xFZJSDniwyI1l7svbF9
TLSH
T1EC44640A7B747001EDE2D9725CB080771E3CA16E8F22E6815DB654694EB3853A63D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 cd3bd2e7956512bec6c16573ed10451e246d95cc8da8982cc83c5f72914a1160
MD5 4b7eeca5303db45011279f84d2f5b249
SHA1 5bda543a6d4b4d5e8ba0ff11a02df7d5c34b821e
SHA512 3911cb10d14afdc02bfc00d64e1e93fe7fb0cf5226fb598c791091f61d7c005d654ed7e1130bd70cb8017be43d6949277e62caa47d4745fb4c3f0a87f919c9e9
SSDEEP 384:nTiF1tNn/s3n9SM8N98TUNTUlIRshESurLxTCfxVELkbF1GbITGT0IkuM8Lk1Iz5:+F1j+9lcwgIEfqVnqbi+0wvvt
TLSH
T16EC23A32D8A4CA7BEDF64FD9B74A764BAEF0026785D85AD8DAC91D4D00872DC1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d62fa211640869cd22f2b488a4c78857896927cf9231a8745b29f9e4868e7b73
MD5 099f8a6a28567a7134ca1845fa1d5221
SHA1 19fbf9ca2f1afba77332f8c5ee0a59ef5b17af12
SHA512 40e3e78f7221453aa626e4c927004aba3e1304047129a99e7d56068a03586f7ba4a976cc8fccf0f30834b5c90401831ade48c3056aa0eb8726a894bfc9f9fa86
SSDEEP 384:nTiF1tNn/s3n9SM8Nw8TUNTUlIRshESuA0BfTCfxVELkbF17ObpITGT0IkuM8Lku:+F1j+9l1wgIEY0sVn8pi+0wvvt
TLSH
T106C23A32D864DABBADF64ED5B74A764B9EE0126385C85AD8DAC91D4C00C72DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4352-493-0x0000000021540000-0x00000000215E8000-memory.dmp

Download

memory/4352-2-0x0000000021540000-0x00000000215E8000-memory.dmp

Download

memory/4352-321-0x0000000021540000-0x00000000215E8000-memory.dmp

Download

memory/4352-344-0x0000000021540000-0x00000000215E8000-memory.dmp

Download

memory/4352-0-0x0000000021540000-0x00000000215E8000-memory.dmp

Download

memory/4352-591-0x0000000021540000-0x00000000215E8000-memory.dmp

Download

memory/4352-1-0x0000000021540000-0x00000000215E8000-memory.dmp

Download

memory/4352-83-0x0000000021540000-0x00000000215E8000-memory.dmp

Download

memory/4352-608-0x0000000021540000-0x00000000215E8000-memory.dmp

Download

memory/4352-609-0x0000000021540000-0x00000000215E8000-memory.dmp

Download

memory/4352-610-0x0000000021540000-0x00000000215E8000-memory.dmp

Download

memory/4352-611-0x0000000021540000-0x00000000215E8000-memory.dmp

Download

memory/4352-612-0x0000000021540000-0x00000000215E8000-memory.dmp

Download

memory/4352-613-0x0000000021540000-0x00000000215E8000-memory.dmp

Download

memory/4352-614-0x0000000021540000-0x00000000215E8000-memory.dmp

Download

memory/4352-615-0x0000000021540000-0x00000000215E8000-memory.dmp

Download