20d47fa34fb6c5841bbebea4796b7b9fcc3f6920ef9d3be0530978f0cbc6e4d7

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5df66d1d1d5343828aea45cea2b76c5c.exe
Size 2.9MB
Sample260705-alg49sa14q
SHA256 20d47fa34fb6c5841bbebea4796b7b9fcc3f6920ef9d3be0530978f0cbc6e4d7
MD5 0b88b880dccce959dd97041c5a816cf4
SHA1 8602e5159f64ce434785e369050a06b2d856e958
SHA512 4388714ea5a68a0a2666f131a148dbceb2180b3d82a7c20dbf6cffa478242469863ad7073b38986a77aec004dbb170df400f2d558f1f9a66591bdddd2318683a
SSDEEP 49152:DF8TzmgkSJLWZyBZe+LKL+ksivy2tYILItRZPVWObRUfECA8BgMhB:DFhHUZtUJpbLIRZdWObRUfW8BDhB
TLSH
T121D59D077C9005E9D4AAA33288BA41967B76BC494F3273D72E50B7782F727E08D3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 22 IoCs

description	pid	Process	procid_target
PID 6072 created 4992	6072	5df66d1d1d5343828aea45cea2b76c5c.exe	89
PID 6072 created 7028	6072	5df66d1d1d5343828aea45cea2b76c5c.exe	90
PID 6072 created 1244	6072	5df66d1d1d5343828aea45cea2b76c5c.exe	91
PID 6072 created 6040	6072	5df66d1d1d5343828aea45cea2b76c5c.exe	92
PID 6072 created 5380	6072	5df66d1d1d5343828aea45cea2b76c5c.exe	96
PID 6072 created 6148	6072	5df66d1d1d5343828aea45cea2b76c5c.exe	94
PID 6072 created 3776	6072	5df66d1d1d5343828aea45cea2b76c5c.exe	95
PID 6072 created 4992	6072	5df66d1d1d5343828aea45cea2b76c5c.exe	89
PID 6072 created 4992	6072	5df66d1d1d5343828aea45cea2b76c5c.exe	89
PID 6072 created 1244	6072	5df66d1d1d5343828aea45cea2b76c5c.exe	91
PID 6072 created 1244	6072	5df66d1d1d5343828aea45cea2b76c5c.exe	91
PID 6072 created 792	6072	5df66d1d1d5343828aea45cea2b76c5c.exe	109
PID 6072 created 2092	6072	5df66d1d1d5343828aea45cea2b76c5c.exe	110
PID 6072 created 3432	6072	5df66d1d1d5343828aea45cea2b76c5c.exe	111
PID 6072 created 2404	6072	5df66d1d1d5343828aea45cea2b76c5c.exe	112
PID 6072 created 2492	6072	5df66d1d1d5343828aea45cea2b76c5c.exe	113
PID 6072 created 4936	6072	5df66d1d1d5343828aea45cea2b76c5c.exe	114
PID 6072 created 3276	6072	5df66d1d1d5343828aea45cea2b76c5c.exe	115
PID 6072 created 792	6072	5df66d1d1d5343828aea45cea2b76c5c.exe	109
PID 6072 created 792	6072	5df66d1d1d5343828aea45cea2b76c5c.exe	109
PID 6072 created 2404	6072	5df66d1d1d5343828aea45cea2b76c5c.exe	112
PID 6072 created 2404	6072	5df66d1d1d5343828aea45cea2b76c5c.exe	112

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
6072	5df66d1d1d5343828aea45cea2b76c5c.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1244	chrome.exe
2404	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	5df66d1d1d5343828aea45cea2b76c5c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	5df66d1d1d5343828aea45cea2b76c5c.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134276843019610358"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2900715619-172032027-1873877232-1000\{C318D631-B6F2-4CB2-BA11-B7E16A7C8E26}	msedge.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
4992	chrome.exe
4992	chrome.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe
6072	5df66d1d1d5343828aea45cea2b76c5c.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
792	msedge.exe
792	msedge.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	6072	5df66d1d1d5343828aea45cea2b76c5c.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
792	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 6072 wrote to memory of 4992	6072	5df66d1d1d5343828aea45cea2b76c5c.exe	89
PID 4992 wrote to memory of 7028	4992	chrome.exe	90
PID 4992 wrote to memory of 6040	4992	chrome.exe	92
PID 4992 wrote to memory of 1244	4992	chrome.exe	91
PID 4992 wrote to memory of 6040	4992	chrome.exe	92
PID 4992 wrote to memory of 6148	4992	chrome.exe	94
PID 4992 wrote to memory of 3776	4992	chrome.exe	95
PID 4992 wrote to memory of 6148	4992	chrome.exe	94
PID 4992 wrote to memory of 3776	4992	chrome.exe	95
PID 4992 wrote to memory of 5380	4992	chrome.exe	96
PID 4992 wrote to memory of 5380	4992	chrome.exe	96
PID 4992 wrote to memory of 6540	4992	chrome.exe	97
PID 4992 wrote to memory of 4996	4992	chrome.exe	98
PID 4992 wrote to memory of 1128	4992	chrome.exe	99
PID 4992 wrote to memory of 4996	4992	chrome.exe	98
PID 4992 wrote to memory of 1128	4992	chrome.exe	99
PID 4992 wrote to memory of 2352	4992	chrome.exe	104
PID 4992 wrote to memory of 6792	4992	chrome.exe	103
PID 4992 wrote to memory of 2352	4992	chrome.exe	104
PID 4992 wrote to memory of 6792	4992	chrome.exe	103
PID 4992 wrote to memory of 2452	4992	chrome.exe	105
PID 4992 wrote to memory of 2452	4992	chrome.exe	105
PID 4992 wrote to memory of 996	4992	chrome.exe	106
PID 4992 wrote to memory of 996	4992	chrome.exe	106
PID 4992 wrote to memory of 4152	4992	chrome.exe	107
PID 4992 wrote to memory of 4152	4992	chrome.exe	107
PID 4992 wrote to memory of 4560	4992	chrome.exe	108
PID 4992 wrote to memory of 4560	4992	chrome.exe	108
PID 6072 wrote to memory of 792	6072	5df66d1d1d5343828aea45cea2b76c5c.exe	109
PID 792 wrote to memory of 2092	792	msedge.exe	110
PID 792 wrote to memory of 3432	792	msedge.exe	111
PID 792 wrote to memory of 2404	792	msedge.exe	112
PID 792 wrote to memory of 3432	792	msedge.exe	111
PID 792 wrote to memory of 3432	792	msedge.exe	111
PID 792 wrote to memory of 2492	792	msedge.exe	113
PID 792 wrote to memory of 2492	792	msedge.exe	113
PID 792 wrote to memory of 4936	792	msedge.exe	114
PID 792 wrote to memory of 4936	792	msedge.exe	114
PID 792 wrote to memory of 4936	792	msedge.exe	114
PID 792 wrote to memory of 3276	792	msedge.exe	115
PID 792 wrote to memory of 3276	792	msedge.exe	115
PID 792 wrote to memory of 3276	792	msedge.exe	115
PID 792 wrote to memory of 1828	792	msedge.exe	118
PID 792 wrote to memory of 1828	792	msedge.exe	118
PID 792 wrote to memory of 6420	792	msedge.exe	119
PID 792 wrote to memory of 6420	792	msedge.exe	119
PID 792 wrote to memory of 4316	792	msedge.exe	121

C:\Users\Admin\AppData\Local\Temp\5df66d1d1d5343828aea45cea2b76c5c.exe
"C:\Users\Admin\AppData\Local\Temp\5df66d1d1d5343828aea45cea2b76c5c.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb60e0c728,0x7ffb60e0c734,0x7ffb60e0c740
    3⤵
    PID:7028
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1944,i,1643919338906809387,4773501513211939568,524288 --field-trial-handle=1988,i,4549786111809419938,14059566263482662325,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1244
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1692,i,3302621039689156169,2293022226495117192,262144 --field-trial-handle=1988,i,4549786111809419938,14059566263482662325,262144 --variations-seed-version --mojo-platform-channel-handle=1976 /prefetch:2
    3⤵
    PID:6040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2944,i,11276693123850385665,11519929975313163267,2097152 --field-trial-handle=1988,i,4549786111809419938,14059566263482662325,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:1
    3⤵
    PID:6148
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2252,i,15015149437415237858,6931843353797832418,524288 --field-trial-handle=1988,i,4549786111809419938,14059566263482662325,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:13
    3⤵
    PID:3776
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2936,i,3120581370944405069,13325106405386856226,2097152 --field-trial-handle=1988,i,4549786111809419938,14059566263482662325,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:1
    3⤵
    PID:5380
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5352,i,8288029676109985427,4916388079266737112,524288 --field-trial-handle=1988,i,4549786111809419938,14059566263482662325,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
    3⤵
    PID:6540
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5436,i,7158803559504327859,6461865908290349116,2097152 --field-trial-handle=1988,i,4549786111809419938,14059566263482662325,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:1
    3⤵
    PID:4996
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5448,i,4956270842738606777,1896640658531504984,2097152 --field-trial-handle=1988,i,4549786111809419938,14059566263482662325,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:1
    3⤵
    PID:1128
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4732,i,1155106329049362003,5855512692573449384,2097152 --field-trial-handle=1988,i,4549786111809419938,14059566263482662325,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:1
    3⤵
    PID:6792
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5772,i,9251568325864571459,17094956373759249664,2097152 --field-trial-handle=1988,i,4549786111809419938,14059566263482662325,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:1
    3⤵
    PID:2352
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5688,i,6586652815386396441,18418040432740783541,2097152 --field-trial-handle=1988,i,4549786111809419938,14059566263482662325,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:1
    3⤵
    PID:2452
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4636,i,14527885842129143420,10282298917788439147,2097152 --field-trial-handle=1988,i,4549786111809419938,14059566263482662325,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:1
    3⤵
    PID:996
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5736,i,16775375730692934629,14901275764763440761,2097152 --field-trial-handle=1988,i,4549786111809419938,14059566263482662325,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:1
    3⤵
    PID:4152
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5780,i,5297668466098721983,15484549392207710039,2097152 --field-trial-handle=1988,i,4549786111809419938,14059566263482662325,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:1
    3⤵
    PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ffb4bf6c188,0x7ffb4bf6c194,0x7ffb4bf6c1a0
    3⤵
    PID:2092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1712,i,18269921003765517989,15508051787848610824,262144 --field-trial-handle=2256,i,17132819968289190073,8747575203461156395,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
    3⤵
    PID:3432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,4640972788994847916,8281808170133959890,524288 --field-trial-handle=2256,i,17132819968289190073,8747575203461156395,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2408,i,5037443574026108759,15075468299282453684,524288 --field-trial-handle=2256,i,17132819968289190073,8747575203461156395,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:13
    3⤵
    PID:2492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,15925211796187985588,13160022805731207656,2097152 --field-trial-handle=2256,i,17132819968289190073,8747575203461156395,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
    3⤵
    PID:4936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,561458917707439639,3108871673106712865,2097152 --field-trial-handle=2256,i,17132819968289190073,8747575203461156395,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:3276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,7147855880352930912,10930529955879254542,524288 --field-trial-handle=2256,i,17132819968289190073,8747575203461156395,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
    3⤵
    PID:1828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,9222925450433019762,11025981747299299936,524288 --field-trial-handle=2256,i,17132819968289190073,8747575203461156395,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
    3⤵
    PID:6420
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,8510647087615769557,14128493173498097582,524288 --field-trial-handle=2256,i,17132819968289190073,8747575203461156395,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
    3⤵
    PID:3744
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,8510647087615769557,14128493173498097582,524288 --field-trial-handle=2256,i,17132819968289190073,8747575203461156395,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
    3⤵
    PID:4316

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:6524

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 f05041c8f073d1687e255b6284b287cfd6e9d383ccc439bfcba57addcf79d7a6
MD5 1b772113ee1399ecaa40d5eddb0bd39c
SHA1 ea8413bc388f71b0c431a4107530ba0641996b77
SHA512 ec97dd13aed71778c037d27491cb65514c9f5b2fe26e22f9dd1ab2c6ebf103e0a84ad56f9031a07d8d458faf423742bcab0f3b90895a81e704637d0d25901eb1
SSDEEP 192:nR85p1Ov7YvAPRp2O9ZHsb+WNnjsPj4eDH3VyIsnAUgR:nR85/qs6XFLwgPJRR
TLSH
T17522971EA910653B6CCBD629F9617F63E7FA112235D41E84EBFC4A2C12E76CC2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 a6bd9a8d69a0d6364bec61078381296fd948961907ccd7bc2064c32f311255a5
MD5 59623b88331724070504a1c601a0ef2f
SHA1 d3d574681d8c4a2a4ba4d9004b2a25cbcb02d1f0
SHA512 97fb19e140eb3de9e1c169d53a8ac53556aa59f10fd87b81f65a78ccd7f99b11955d1eae7707ed52a0e6bfcc56a83bf049017ceccb2164c4d9b70e49c61dcc81
SSDEEP 192:ek74K66Y7KxkXqK4I40pUZNCgVLHrKHfFKslEcsKXzKD/d4+ErUkKN9mNEZdVvBx:B7j1Y7KxkXqKf/pUZNCgVLH2HfgslOKA
TLSH
T1E232F927A58D9A7B4FD8D50CDC126F8BADF5029372780D24A7FB9D0403E9BCA114A1B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 c1ebd3a73d2d13601ff83a143201859b9ce8ab6e53af1cddb5cf36ee5ef80ab4
MD5 7be305737c325fb67b45379d2ada3598
SHA1 891a27efa2e8608725af0a04b33e8b721ea7e52f
SHA512 2ab85857d091d5517446adb3794d71a8232827cd43a746386e5d0922f05d6f25d0e540841a27102fd297e54b42bbfb45c8b761d759b377bedee7971d07d47e32
SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2O6IpX6KqqTVumPQEPdwk0:jeuvBnhJsueMEGvIW1DcP2OR5VumP3n0
TLSH
T195D3864B3A747002EDE5CA761CE054BB5D3CB16D4F16A5D428B620688EF2863B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 b4e40ab0602a15a2d0d3a2cb0886d470bcbe6a95dd63c26d18f0fd0e07118c02
MD5 d9cb15a240167c2b184efe736917394b
SHA1 a643d6fe542334dff564bdbeb65e21c92474ecfe
SHA512 01609c9410156b05b5556cbbff512d0aaa0b9b6df20abb0cf3ba302a65e8e35bd72d3320b402512115fe58b4c69c6e76e47aae1ba90535aaab4774c321a5842a
SSDEEP 96:9C65d+ZjT58BXkvQxBBifvUM+RDotok52+sDoB6sGyvAay39vbCTv4a:9C+ijUhPBSaDUDgcEmy39vbe
TLSH
T1FFA11A32A8694C7355B7C989B5563B13CEBC21979A91AE84ECED1E0C21EB5FC1342533
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 1a5b7aae44907a6a9dc4283e79c1cc749074d55a6997dde7eb1eae5d4e7770e6
MD5 077b6dc356d8e97bb9dd386d97fef136
SHA1 53fcd4c47fe8f7db140328317e7cf830dad314c1
SHA512 a9f1bcc572f9e78dd4fe839618a6699ac5f6623d438ff6600cfc80184effaaa33663c1bbac67164cda2adda468744e267875c329ca66a1481eb927d39cd5c1b7
SSDEEP 96:NC6ytd+ZjT58BXkvQxBBifvJMpSl8h4otop52NDoB6TGyvAacXGtexwzMdv+W9rT:NC1tijUhPBSaiU2ic7mcpxB+W9rUs3
TLSH
T193C11B72A8BD9C3755F7DA45F1162A43CEB420ABDA40AF50EDDA0F1C02D74EC1386423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da3763f60ede3fa709aa0345487a9c5f026859c06ed1a1549de777571c438d2d
MD5 2ebd0330bb082497ebc47348c4ecee38
SHA1 f164cfe0a87fae91d8a0b0b31f0178ebf3aadd02
SHA512 294595e3213375937c97fffd24323394a2b90fd0b46d24771fcf9359e2edbe425b26aefe714432eaccd7516ab0d793eaa33eb35fa55b9df13c535af5d9da8f67
TLSH
T1FFD080F0B7197582D5653471B521971171B1409D391BD5D19090850C4C778D55745187
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b363f693690aa479b03b10f13d837c7277e1cd8d6c10d7150235a6d4eee0f34
MD5 ddf8b13fdf9db751ce6cc3328e266fa7
SHA1 1cd0cf7ab6698157c24338d81d076859d18cfba7
SHA512 e7b35b46a0f47d516568817a1f6db4f2445e353959197912eea8a7ab8f6a257b9bc5ba855ad99faa8b859e7ac8c3141a43c223c051fe9bd656f75b6384e18fc8
TLSH
T1E8D08CF0BB297982D26534B2B5229711B2B140AA3A2BD6D1A4A0C50C8C3B8D9A786183
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 e9c577eaa9c62e431db97ed50d5601abf29a75fc7e6ed021aa0177cabe74d0b7
MD5 78f46f88ca5b42591e9c922dd44ec2fa
SHA1 ba1a63fdad99c19075909a9330833ee2479ffe5f
SHA512 458c61a211feefaa39efdf76168cc93b7f5452769574a828c495136a6d8830c39c794bd91cd294022dbfd728f2a744001164ecc17c320be47367f528862f0031
SSDEEP 192:sxR3kRjyMqZjK1Ml8wca/fiskKIpZsGJlsJGzoA8pw/g6+WNIYmsvG4IgjBJ:sxRUQCa/fiskbnsGr47w/5IyjL
TLSH
T19762E91A6A38593BCCDBD219FA457F53C6F81573A2904E44AAFC8A0C01E76DD221783F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 9c12bf3390143568203db73438c5756c6c535dcbc32849153848c2f236ac0d8e
MD5 fe78af4f5494cc202c1083f5fe069fc6
SHA1 c3545aed20d99b2a2f1feb89b702745d683f3be4
SHA512 15192a3e54e975df7ee8459f884fa246efb24c8762a1095d915e7fdb3c70354b024155438617d77e73733f2120c7096484f9b6576eb3a8b10b549af48311e4cb
SSDEEP 768:RGqO3j7pLuL7yrWgzvfiX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVGu7z9wQroPw0f:RGqO3VE7yrWgzvfiXu1jalu7pw7Pw0f
TLSH
T194E2FC3B680CCB7E4F804E9CEC29BE9A6DA802CF56D8895447EE844C03C76FB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 98404e33f3d2996a708b788b34ba4dd93bde57a642293fb6e9452b5d822c948e
MD5 e973cb76cc996a8c3a26ef87c1ec8930
SHA1 6b3b14fe4961773ab56a5c9a3c703bce15bb0ddd
SHA512 c9bcc5ccbb5242925fec7ee140264cd8fb98a34c94b49b0d50ccd2ebf54ed8c72617f32814703cdc27d923af88623f3ffe25962d696a9674ec91d01066ed15e7
SSDEEP 384:9TqfDxl5UVY3bXp3ZUzD4BzSc7eCUG2XatW6AE3k18UFa20TWaseefCFeSo83Mt8:aR55IlHnOLRXxxinZ9k
TLSH
T10BB2AB4170BB2B00387D290D9379D42F1A4630A270DEA86B3B6835E56F67E005FFDAD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 f7e9ac064ecee7c9df50913610b22f6c0f175462e2275e5d70527bdb8f1a995f
MD5 aa1d24e823941bfcd6699175c2c4edf3
SHA1 d8aac1bbc5fc974945334f7dac3bb3d1c2d662f4
SHA512 d53142f5664420067672a1d97fb35c2ca22c63175defb0149358691959dfff1784454d6d6811554e9c3a7df87695562ec2c36a9dfeb4081777b3fe5cab2fe64f
SSDEEP 384:DNrRZyCSDnxTICXMEhIKyll7svbFKfk7:xFZJSDni9yI1l7svbF9
TLSH
T11744740A7B747001EDE6D9725CB080771E3CB16E8F22A6916DA254694DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 78687752aeaf3bde6f045c0e290e908522f7c6ab0f0ed4bdbfc12ee58128d352
MD5 d33a1d65c006bbbbc0db897959008f31
SHA1 696beef643cc93dcc04da1428eb73e1debf9781a
SHA512 7f1c3088d6863fcb085bcb102afe28b3665b137d5f47402fa685c3950995766816a49cdb37d8bec66c88fe5ca8a6530f01198cb6d75862cac297f6c4976af221
SSDEEP 384:nbiF1tNn/s3n9SsD8Nq8TUNTUlIRYAznNeB9X+fo1oj5H8dnTgnU2OObjI9G6w7l:2F1j+9RbwgqzodeUU229Ml
TLSH
T155D23936DC90CAA7DDE78FD9B70A7A4AEEE012A785885DD4EAC95E0C01C31ED0347C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 15c4fcd22df597007c241cf183cf1a106ef178b6a60d5841239e88301f5227e0
MD5 972a3d14332232932be8658df3777907
SHA1 634f8d4dcf8e60bcbb77ff51c5ad0439bb2b35eb
SHA512 4c95c2b59c2d4cf5838c9de9b2b76854ae5818c8ffb9038940857d5d64ef50269182dc1b04cbbca46f9ebd9190cca75188f3a16eacdaa0efb93927b8ff0e973b
SSDEEP 384:ndiF1tNn/s3n9SsD8NA8TUNTUlIRYsznNVZHX+fo1oj5H8UUMmn15wbAjEJW8L+/:UF1j+9RZwgrtodjUMmn12bfJA
TLSH
T172C22836DCA4CA6BEDF78FC9B709764AAEE011A781D85AD8DAD84D4D01D32DD0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

02964231

Path C:\Users\Admin\AppData\Local\Temp\4a8b95db\02964231
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6072-136-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-178-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-61-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-58-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-60-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-63-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-64-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-69-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-67-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-70-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-74-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-77-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-79-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-82-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-89-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-93-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-90-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-99-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-105-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-108-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-117-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-123-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-116-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-47-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-142-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-144-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-150-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-166-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-162-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-173-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-180-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-181-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-179-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-53-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-171-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-170-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-169-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-154-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-153-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-151-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-141-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-113-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-112-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-102-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-100-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-84-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-83-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-72-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-44-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-43-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-17-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-16-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-15-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-14-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-12-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-10-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-8-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-6-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-5-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-4-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-3-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-2-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-1-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-0-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-66-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-62-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/6072-2186-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download