16f52468e62956791e6bfee78ecd848342dae9f1cd3535ececd2a9b027794d26

Analysis

max time kernel
148s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/07/2026, 12:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmp0vhj9xr8.exe
Size 3.6MB
Sample260702-pcjn3ahx21
SHA256 16f52468e62956791e6bfee78ecd848342dae9f1cd3535ececd2a9b027794d26
MD5 3863cdf738a2c75693181fc136e69ca3
SHA1 2fa1732089852d4a0ecccae622df90a5e35a28d1
SHA512 d2f3541b32e3789fa3c463111fedfdfe087e4acd23d2f01479bf977efac9d13596f0ecd0118b7084f7507a981d4d6f9c4a45a340739242614a1807d975d84c51
SSDEEP 49152:bAh+DtFnP80Ttl6Bj3ORjhf6T5OjF79RnIF1m2YfmkIyTtiiYhbls:bFsefjFI6IywiuC
TLSH
T103064847BD9248EAC09AB331CCA6515A7B69BC4C0B3227D72E90FA783E727D05C35B54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 25 IoCs

description	pid	Process	procid_target
PID 5212 created 3292	5212	tmp0vhj9xr8.exe	80
PID 5212 created 1380	5212	tmp0vhj9xr8.exe	81
PID 5212 created 3208	5212	tmp0vhj9xr8.exe	82
PID 5212 created 2736	5212	tmp0vhj9xr8.exe	83
PID 5212 created 1256	5212	tmp0vhj9xr8.exe	84
PID 5212 created 3228	5212	tmp0vhj9xr8.exe	85
PID 5212 created 2220	5212	tmp0vhj9xr8.exe	86
PID 5212 created 1472	5212	tmp0vhj9xr8.exe	87
PID 5212 created 3292	5212	tmp0vhj9xr8.exe	80
PID 5212 created 3292	5212	tmp0vhj9xr8.exe	80
PID 5212 created 2736	5212	tmp0vhj9xr8.exe	83
PID 5212 created 2736	5212	tmp0vhj9xr8.exe	83
PID 5212 created 4896	5212	tmp0vhj9xr8.exe	92
PID 5212 created 1616	5212	tmp0vhj9xr8.exe	93
PID 5212 created 2440	5212	tmp0vhj9xr8.exe	94
PID 5212 created 1660	5212	tmp0vhj9xr8.exe	95
PID 5212 created 660	5212	tmp0vhj9xr8.exe	96
PID 5212 created 1032	5212	tmp0vhj9xr8.exe	98
PID 5212 created 5788	5212	tmp0vhj9xr8.exe	101
PID 5212 created 5776	5212	tmp0vhj9xr8.exe	102
PID 5212 created 5836	5212	tmp0vhj9xr8.exe	103
PID 5212 created 4896	5212	tmp0vhj9xr8.exe	92
PID 5212 created 4896	5212	tmp0vhj9xr8.exe	92
PID 5212 created 1660	5212	tmp0vhj9xr8.exe	95
PID 5212 created 1660	5212	tmp0vhj9xr8.exe	95

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5212	tmp0vhj9xr8.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2736	chrome.exe
1660	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	tmp0vhj9xr8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	tmp0vhj9xr8.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274678822943739"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2043432456-1617298091-2772621413-1000\{0AE850B7-F4EB-4C53-A2B8-EEF5BF0AEE79}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
3292	chrome.exe
3292	chrome.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe
5212	tmp0vhj9xr8.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	5212	tmp0vhj9xr8.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
4896	msedge.exe
4896	msedge.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 5212 wrote to memory of 3292	5212	tmp0vhj9xr8.exe	80
PID 3292 wrote to memory of 1380	3292	chrome.exe	81
PID 3292 wrote to memory of 3208	3292	chrome.exe	82
PID 3292 wrote to memory of 2736	3292	chrome.exe	83
PID 3292 wrote to memory of 3208	3292	chrome.exe	82
PID 3292 wrote to memory of 1256	3292	chrome.exe	84
PID 3292 wrote to memory of 1256	3292	chrome.exe	84
PID 3292 wrote to memory of 2220	3292	chrome.exe	86
PID 3292 wrote to memory of 2220	3292	chrome.exe	86
PID 3292 wrote to memory of 3228	3292	chrome.exe	85
PID 3292 wrote to memory of 3228	3292	chrome.exe	85
PID 3292 wrote to memory of 1472	3292	chrome.exe	87
PID 3292 wrote to memory of 1472	3292	chrome.exe	87
PID 3292 wrote to memory of 2232	3292	chrome.exe	90
PID 5212 wrote to memory of 4896	5212	tmp0vhj9xr8.exe	92
PID 4896 wrote to memory of 1616	4896	msedge.exe	93
PID 4896 wrote to memory of 2440	4896	msedge.exe	94
PID 4896 wrote to memory of 1660	4896	msedge.exe	95
PID 4896 wrote to memory of 2440	4896	msedge.exe	94
PID 4896 wrote to memory of 2440	4896	msedge.exe	94
PID 4896 wrote to memory of 660	4896	msedge.exe	96
PID 4896 wrote to memory of 660	4896	msedge.exe	96
PID 4896 wrote to memory of 1692	4896	msedge.exe	97
PID 4896 wrote to memory of 1692	4896	msedge.exe	97
PID 4896 wrote to memory of 1692	4896	msedge.exe	97
PID 4896 wrote to memory of 1032	4896	msedge.exe	98
PID 4896 wrote to memory of 1032	4896	msedge.exe	98
PID 4896 wrote to memory of 1032	4896	msedge.exe	98
PID 4896 wrote to memory of 5660	4896	msedge.exe	100
PID 4896 wrote to memory of 5660	4896	msedge.exe	100
PID 4896 wrote to memory of 5660	4896	msedge.exe	100
PID 4896 wrote to memory of 5836	4896	msedge.exe	103
PID 4896 wrote to memory of 5836	4896	msedge.exe	103
PID 4896 wrote to memory of 5836	4896	msedge.exe	103
PID 4896 wrote to memory of 5776	4896	msedge.exe	102
PID 4896 wrote to memory of 5776	4896	msedge.exe	102
PID 4896 wrote to memory of 5776	4896	msedge.exe	102
PID 4896 wrote to memory of 5788	4896	msedge.exe	101
PID 4896 wrote to memory of 5788	4896	msedge.exe	101
PID 4896 wrote to memory of 5788	4896	msedge.exe	101
PID 4896 wrote to memory of 3424	4896	msedge.exe	104
PID 4896 wrote to memory of 3424	4896	msedge.exe	104
PID 4896 wrote to memory of 4320	4896	msedge.exe	105
PID 4896 wrote to memory of 4320	4896	msedge.exe	105
PID 4896 wrote to memory of 5408	4896	msedge.exe	106
PID 4896 wrote to memory of 5408	4896	msedge.exe	106
PID 4896 wrote to memory of 5328	4896	msedge.exe	107
PID 4896 wrote to memory of 5328	4896	msedge.exe	107
PID 4896 wrote to memory of 2852	4896	msedge.exe	109
PID 4896 wrote to memory of 4160	4896	msedge.exe	110
PID 2852 wrote to memory of 4572	2852	msedge.exe	111
PID 4896 wrote to memory of 5560	4896	msedge.exe	112
PID 5560 wrote to memory of 2244	5560	msedge.exe	113
PID 4896 wrote to memory of 5576	4896	msedge.exe	114
PID 4896 wrote to memory of 5576	4896	msedge.exe	114
PID 4896 wrote to memory of 4156	4896	msedge.exe	115
PID 4896 wrote to memory of 4156	4896	msedge.exe	115
PID 4896 wrote to memory of 5360	4896	msedge.exe	116
PID 4896 wrote to memory of 5360	4896	msedge.exe	116
PID 4896 wrote to memory of 2724	4896	msedge.exe	117
PID 4896 wrote to memory of 2724	4896	msedge.exe	117
PID 4896 wrote to memory of 5412	4896	msedge.exe	118
PID 4896 wrote to memory of 5412	4896	msedge.exe	118

C:\Users\Admin\AppData\Local\Temp\tmp0vhj9xr8.exe
"C:\Users\Admin\AppData\Local\Temp\tmp0vhj9xr8.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3292
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb920cc728,0x7ffb920cc734,0x7ffb920cc740
    3⤵
    PID:1380
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1668,i,11101575913448624917,11093652068681398747,262144 --field-trial-handle=1972,i,12256734969525696868,17387965755442878334,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1956 /prefetch:2
    3⤵
    PID:3208
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2032,i,109572333159355786,11282550844685360638,524288 --field-trial-handle=1972,i,12256734969525696868,17387965755442878334,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2092 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2736
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2304,i,12552015169132817528,15513860517407636839,524288 --field-trial-handle=1972,i,12256734969525696868,17387965755442878334,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2464 /prefetch:13
    3⤵
    PID:1256
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3032,i,11702190854003862194,18433192890713386142,2097152 --field-trial-handle=1972,i,12256734969525696868,17387965755442878334,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3192 /prefetch:1
    3⤵
    PID:3228
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3040,i,6655848682343686774,6751653552799557135,2097152 --field-trial-handle=1972,i,12256734969525696868,17387965755442878334,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3212 /prefetch:1
    3⤵
    PID:2220
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4180,i,5193244649739526205,6668897536529674130,2097152 --field-trial-handle=1972,i,12256734969525696868,17387965755442878334,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4196 /prefetch:9
    3⤵
    PID:1472
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5288,i,5549629945492655568,4435890921296513536,524288 --field-trial-handle=1972,i,12256734969525696868,17387965755442878334,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5292 /prefetch:14
    3⤵
    PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffb8d64c188,0x7ffb8d64c194,0x7ffb8d64c1a0
    3⤵
    PID:1616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1772,i,14147000240500497483,12399861073123409203,262144 --field-trial-handle=1976,i,16193965457042758213,17232285465212531922,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:2
    3⤵
    PID:2440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,1432244875855096830,5376183131050068531,524288 --field-trial-handle=1976,i,16193965457042758213,17232285465212531922,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2364,i,540954172349926178,11841073385871313010,524288 --field-trial-handle=1976,i,16193965457042758213,17232285465212531922,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:13
    3⤵
    PID:660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3384,i,3025406178763950123,18353168780782389385,2097152 --field-trial-handle=1976,i,16193965457042758213,17232285465212531922,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
    3⤵
    PID:1692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3388,i,11051216837240268231,14481545648123444731,2097152 --field-trial-handle=1976,i,16193965457042758213,17232285465212531922,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
    3⤵
    PID:1032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3992,i,1801542370789474485,18214850678404092585,2097152 --field-trial-handle=1976,i,16193965457042758213,17232285465212531922,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:1
    3⤵
    PID:5660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4004,i,5953224322729963666,5127018002513615098,2097152 --field-trial-handle=1976,i,16193965457042758213,17232285465212531922,262144 --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:9
    3⤵
    PID:5788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4012,i,10997590962668021748,3101961669123665011,2097152 --field-trial-handle=1976,i,16193965457042758213,17232285465212531922,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
    3⤵
    PID:5776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4036,i,12483477916440927413,941017109672097131,2097152 --field-trial-handle=1976,i,16193965457042758213,17232285465212531922,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:9
    3⤵
    PID:5836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3996,i,2941286091558677506,317642620541887984,524288 --field-trial-handle=1976,i,16193965457042758213,17232285465212531922,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:14
    3⤵
    PID:3424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3472,i,11790964655797479793,2923576646631449965,524288 --field-trial-handle=1976,i,16193965457042758213,17232285465212531922,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:14
    3⤵
    PID:4320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,818053582593127740,13409874692031893970,524288 --field-trial-handle=1976,i,16193965457042758213,17232285465212531922,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
    3⤵
    PID:5408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,4082800864196961967,7147022915687937293,524288 --field-trial-handle=1976,i,16193965457042758213,17232285465212531922,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
    3⤵
    PID:5328
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,7166128946486012017,2070876883922673366,524288 --field-trial-handle=1976,i,16193965457042758213,17232285465212531922,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
    3⤵
    PID:2164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,12995423961690230611,2120345703131147903,524288 --field-trial-handle=1976,i,16193965457042758213,17232285465212531922,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1132
      4⤵
      PID:4572
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,7166128946486012017,2070876883922673366,524288 --field-trial-handle=1976,i,16193965457042758213,17232285465212531922,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
    3⤵
    PID:4160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,17011880229272428639,6655845841338030308,524288 --field-trial-handle=1976,i,16193965457042758213,17232285465212531922,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=592
      4⤵
      PID:2244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,6424816468132631422,11310124715697355618,524288 --field-trial-handle=1976,i,16193965457042758213,17232285465212531922,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:14
    3⤵
    PID:5576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6864,i,12343628341063658781,6223237011809039252,524288 --field-trial-handle=1976,i,16193965457042758213,17232285465212531922,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:14
    3⤵
    PID:4156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,15963119422593293271,9540031703248216422,524288 --field-trial-handle=1976,i,16193965457042758213,17232285465212531922,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
    3⤵
    PID:5360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,2182187116528056371,18228742759118062601,524288 --field-trial-handle=1976,i,16193965457042758213,17232285465212531922,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
    3⤵
    PID:2724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,15023096740186582380,9806001122087064256,524288 --field-trial-handle=1976,i,16193965457042758213,17232285465212531922,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:14
    3⤵
    PID:5412

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5608

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 79f6c4816180159f710fcc11c5145b124466aa8fe5c3a91684ca6df4e2327ce6
MD5 f5bdc278cf30be6a482137e510832730
SHA1 b438975bbd0cbb76e93f0a7847a5a4733f4bae12
SHA512 5e31a78caf0797e16a856272423822c338a0fd4a183f8e540993dc5e50037d83c4ec444aa7a20e079398886980c71c7bf43fa1ebbbac98f8ecbcdef71fbbf84d
TLSH
T17BE02BAAC935D9270CF9575E61548F42E744170B1F50885F3B3D514DCFB2136464582C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6a1e6b7d4ae180a4e261b8dc54169a25a179ea8a232034549c0d6b5cfd282f01
MD5 e880a09547658354e5c862169588727f
SHA1 c5ba705e8ef331e4c4f169e75ba003b97a48ed61
SHA512 918ae33ea61d23cee44db5dc8c5593393f44259286cc060522d1129957095f13f41c0959f796c467f5c9a2c080bdd374dd0145fdf92d4d041fbdf017b3d4c7ec
SSDEEP 192:CRH9Dj23/EQ7v7mpAPRp2n9EHsb+WNn9iPQkYkkEkwwaMVyIsnAUgtaJ:CRH9X2FDaUXAawsPpYuQao8
TLSH
T1F742E62EFD14653B5CCBD62AF9657753D3FA102222942E84EBFC9A2C15E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 78f2b9e9ebc08798880cb4679beee8aef2e584a4e9691c5edb1c0165ca1273af
MD5 f3fb909317ed06709bfdddf6e293f823
SHA1 f9840b19b75e8120807aa0784c1bde6154aba029
SHA512 4bd189ef0e2f72445f5af07954ee4d6ebdcc450090a92b283a2c281a3cf530c9eff525dfd48ea12519fb7f49e455434598bbe11f388dcada8c12c9ada348e50c
SSDEEP 384:7NjnO7KxkXqKf/pUZNCgVLH2HfgslOv7pLuLcSjZkXODnq+ErU3BHHGu/n0To:7NnO7KxkXqKf/pUZNCgVLH2Hfgs8v7pU
TLSH
T18172E9A76C4C9E370F94CACCDC1A7B4FADB6024B65E9886443FA582503D5ACF114A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 09e3a3b8b218d112f9059489cad34b1b7ad2aacf1b266a472d5c4dead4ff2016
MD5 abb4d014d8691bc9c8c76571e058a20f
SHA1 c3700764f4f69c2ffb273aa3d6be662f1d6d2a33
SHA512 127df452fd5b74d48b9d9ba0061db95b96795876d56b034206d3ffe4b5aa673562ce9265232beb8606b8b897e3441275c6dcb79a67cd4ba3c5d8d261fc68c095
SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2O8zpX6TqpjVum0wkP:jeuvBnhJsueMEGvIW1DcP2OAjVum0nP
TLSH
T1E3D3864B3A747002EDE59A721CE051BF5E3C716D8F55A5D428B620688EF2853B23E4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 1acedbcdf9e2f90fe3ddb4c74bbbd91268d7f00eea486af18b62afc4dfe01264
MD5 04b962fc6b0b624743f3e878567cb91c
SHA1 63fea8c978ec8598e36749676a90b39488b96213
SHA512 a5fe9fcb3091a924850d7209303bdf096b11854d3b310c9cef4114cf7cb013f94b0533a004ae3b352e9b57b72768ccec40dcd1d93f82977bbda221057240cdfd
SSDEEP 3072:3KGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:3Nm7Rkm1tYpBeh2BAoi
TLSH
T1ADC3123B5E64E9375875BB4EB08E0B1F2EF149A6C920DA82C8D85B0477FA7CC1A05D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 3c8f834dc73d7653a881f840510999702556e3d7dcbecf6da63846e3f2d06c51
MD5 b3c69afc41bfd75815d4cae1e2e47e7d
SHA1 819bd8dcc04576adb420753af56c6696fe7c84f7
SHA512 2416a79b083fd824b04232069cb4653cfea82899ad09a836eeb5482882e0978362456c7d4931ebe93bc3d193b31a9ac21e72cdd711061c0276e52cff9865b314
SSDEEP 6144:4Xmg1kQfATCFbzQACjcm7Rkm1tYpBeh2BAoE:4LneA69oBGcAoE
TLSH
T11D34232B8EB0997E1B151B66708A0E6E3AF24F7BCE215ED4C1D91B4437DAECA1745C30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 89ab71a3a4e732da8cbbe2e13ba149e13c94226b7119c8a0598106b99907544f
MD5 ca938be236bc251b79a4ee9dbf06dd19
SHA1 2ed95a78846a95a90b8d9b70e9cdc6188f0ce608
SHA512 caf4662a529a373a26b513e285938286f3af46a8729fb4c0be324b084fdba1e10dacca4b8f67585c4a5c6683f45dc7e259548eaf3ffb985905aeefbb7225e0e7
TLSH
T124D0C073050D0000EE0D41312073C7050313BB210E017D03B855F8380D708C9438F1C0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dcfc4c476f41db2d6042449b7b855b9751140e2127be8e8208aafd46a5893b7d
MD5 08e448ed3ad1512fa216c2eea50fff9a
SHA1 2d684e6af180cff0b8adea283dbb0c009102fc3e
SHA512 f9ebe4d980c84e665fbd9643a31fbc7a6b08028d289cd54ea7400acc1d6a7d231dd7952c9c49775207225efebf00cdaaf6a2b295dbeac8f234ed7bdfa52c4693
TLSH
T122D0C073050D0000EA0D41312073C7050313BB210E013C03B855F8381D708C9438F1C0
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a456b30d3bb6f612ac062423c6399caf1e87d8da094dac9664a09af5c694f685
MD5 dbc02fcd3232726e3306e6627ab7ae5d
SHA1 aa1055be66886547618fce5444ba1c1886612a81
SHA512 9f86cc23e2022517dccfccf2548cda9771bfcbf7e7c1d59ab0f889ce4c86c5d98733d2d5f3fb3f415622c19a3c147427f2650ea153bb6945c70dbf1604f02f89
SSDEEP 96:KMkwKF6hpotZjvbkrvyPNxkK1BN7kh5ZSj55+1GKWcmafG6MsMaW0xpgqaK4p:SMpotZjvbGvy1xVBN7W5ZSj55BtafG6A
TLSH
T1EA914583717F02C53E7E7908A3658B16564276633038A92B7BA904B51E6FE204EFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 be01bac43d64b6233bbf9f711aa291d6f3274fb008ae209b847eaaedde02a158
MD5 a926dcf532c0d05a7edc6356ba9b6224
SHA1 eb32e085f4c2a9e0b00c7a2ecc9f759d03f27cae
SHA512 405239285369c2f0bafee352d716a7f94910ade221eda56a88616f4a2cc9a584d8a10ac378d7336916e171d334aac30e451a66c734bc6355afae0e18b8ee666c
SSDEEP 192:FvoWQHqfT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:aTKfQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T16C24630A6B747001DDE7E9725CB080771A3CB16ECF22A6D15DB254698DB3853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0b29409c428781c43e9aa3553b35d44afea0963ca034370f885db5dc3da45acd
MD5 2cc6ee8e73d0dda19f9d5e11f0cbfcf1
SHA1 44083aa65308ec5dad5c05cb7d1267cfbb5215e9
SHA512 85b15657095de0d057ad921d92754b66e84c789c0bcaa3f6bc27d7d8db49638775e54c59b8a8e9aecd9d678e58cc7ca522bea584969d495c1f6dd8c3ec95d1d6
SSDEEP 192:nRGNf6yMQmiUyXJmZ1Y3b+jcEjzorr9PdmxMnM1U6:RGNf6xou1Y3b+AU8ppwU6
TLSH
T1F302F935A8786C7B9FF3AD45B58727138FE4103BD9952F84DAE82B1C00D765C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1337938b3f696a06990b6ce203d367586ef2db5369502854fd03cc4b03fe2c9b
MD5 e2ad1e139c3d5b4943bd1838816d5975
SHA1 5beb69879c48f9bea981dea507dcb1ba1ce1caf5
SHA512 bc0b7a49f918f2c68d626fad532bfb56e7ddee657c773227e697c7ca7798de0ef13618c6c97d5661de56d6326845a1a4d2c8bc4469c66bd26821e9944d7a6149
SSDEEP 192:9kGNV6yVlQmiUyfm0Z0cY3b+jcEjzorr9PdmcXe+zN4MIq9U6:9kGNV62DsL0cY3b+AU8pHXJzzbU6
TLSH
T12612E832A8787C775FE3AD45B58736139FE5112BDA852FC4DAE82B1C04C765C130AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f3b7d4ab

Path C:\Users\Admin\AppData\Local\Temp\4d08c4a8\f3b7d4ab
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9a984da1-82cb-4ed3-a406-e6c289dd14a7.tmp

Path C:\Users\Admin\AppData\Local\Temp\9a984da1-82cb-4ed3-a406-e6c289dd14a7.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccbfca03-1577-4ea9-939e-fdb7fc66680f.tmp

Path C:\Users\Admin\AppData\Local\Temp\ccbfca03-1577-4ea9-939e-fdb7fc66680f.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4896_454453233\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

17563f77-a6a5-4f1f-975b-196fc44fc99b.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4896_969247665\17563f77-a6a5-4f1f-975b-196fc44fc99b.tmp
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5212-117-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-84-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-132-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-156-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-155-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-154-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-153-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-152-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-131-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-130-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-129-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-128-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-127-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-126-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-124-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-123-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-121-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-120-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-119-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-118-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-83-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-116-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-125-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-122-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-92-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-97-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-96-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-94-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-93-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-91-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-88-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-86-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-85-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-115-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-82-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-81-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-79-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-78-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-77-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-76-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-75-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-74-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-95-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-90-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-89-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-80-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-47-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-44-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-15-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-14-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-13-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-12-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-11-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-10-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-9-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-8-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-7-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-6-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-5-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-4-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-3-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-2-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-1-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-0-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-87-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-73-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5212-2782-0x0000000490000000-0x000000049021B000-memory.dmp

Download