42fa6071fd7cf7ac8ff6740d6c297f5b8527a93116f84146a515449070abf488

Analysis

max time kernel
150s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 09:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
QuickFetch.exe
Size 928KB
Sample260705-lwchbae17q
SHA256 42fa6071fd7cf7ac8ff6740d6c297f5b8527a93116f84146a515449070abf488
MD5 db5566d48b5cf91abdd36ec1c3a07612
SHA1 88980bcea3addd53f4a55369b7eff4a274dc2987
SHA512 53ad1f8c4090d6d8107682823f414e1c4488c96017ed9c6b24ffbe5713c590757efadc3a3f4781285c5d97e55cf0b411969253253d3a11d925c74e4dfbe92c97
SSDEEP 24576:4VF1hYzvZ8DG4IEP8A3a6S+PW41uAyLfCuiBYtaw:ihsOGJQp3ahR4wAeCuZ
TLSH
T19215C0CE94959491E4D8B27919327F1AD23DFCC92DF0A6CF236B7124A33CAC1152E768
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 6096 created 3816	6096	QuickFetch.exe	58
PID 6096 created 3816	6096	QuickFetch.exe	58

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
6096	QuickFetch.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QuickFetch.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6944	chrome.exe
6772	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	QuickFetch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	QuickFetch.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
2844	chrome.exe
2844	chrome.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe
6096	QuickFetch.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
6096	QuickFetch.exe
6096	QuickFetch.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2968	msedge.exe
2968	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2968	msedge.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 6096 wrote to memory of 2844	6096	QuickFetch.exe	89
PID 2844 wrote to memory of 3844	2844	chrome.exe	90
PID 2844 wrote to memory of 4948	2844	chrome.exe	91
PID 2844 wrote to memory of 4948	2844	chrome.exe	91
PID 2844 wrote to memory of 6944	2844	chrome.exe	92
PID 2844 wrote to memory of 6896	2844	chrome.exe	93
PID 2844 wrote to memory of 6896	2844	chrome.exe	93
PID 2844 wrote to memory of 6380	2844	chrome.exe	94
PID 2844 wrote to memory of 6380	2844	chrome.exe	94
PID 2844 wrote to memory of 5300	2844	chrome.exe	95
PID 2844 wrote to memory of 5300	2844	chrome.exe	95
PID 2844 wrote to memory of 5672	2844	chrome.exe	97
PID 2844 wrote to memory of 5672	2844	chrome.exe	97
PID 2844 wrote to memory of 5248	2844	chrome.exe	98
PID 2844 wrote to memory of 5248	2844	chrome.exe	98
PID 2844 wrote to memory of 784	2844	chrome.exe	99
PID 2844 wrote to memory of 784	2844	chrome.exe	99
PID 6096 wrote to memory of 2968	6096	QuickFetch.exe	100
PID 2968 wrote to memory of 1324	2968	msedge.exe	101
PID 2968 wrote to memory of 4128	2968	msedge.exe	102
PID 2968 wrote to memory of 6772	2968	msedge.exe	104
PID 2968 wrote to memory of 4128	2968	msedge.exe	102
PID 2968 wrote to memory of 4128	2968	msedge.exe	102
PID 2968 wrote to memory of 1232	2968	msedge.exe	105
PID 2968 wrote to memory of 1232	2968	msedge.exe	105
PID 2968 wrote to memory of 5800	2968	msedge.exe	106
PID 2968 wrote to memory of 5800	2968	msedge.exe	106
PID 2968 wrote to memory of 5800	2968	msedge.exe	106
PID 2968 wrote to memory of 5960	2968	msedge.exe	107
PID 2968 wrote to memory of 5960	2968	msedge.exe	107
PID 2968 wrote to memory of 5960	2968	msedge.exe	107

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3816
- C:\Users\Admin\AppData\Local\Temp\QuickFetch.exe
  "C:\Users\Admin\AppData\Local\Temp\QuickFetch.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:6096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-fre --no-default-browser-check --disable-background-networking --disable-sync --disable-gpu --mute-audio --new-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffaa889c728,0x7ffaa889c734,0x7ffaa889c740
    3⤵
    PID:3844
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1640,i,12005693413737252109,14055977813180286092,262144 --field-trial-handle=1888,i,3622210417653860921,1760059656807622019,262144 --variations-seed-version --mojo-platform-channel-handle=1884 /prefetch:2
    3⤵
    PID:4948
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=1488,i,12322450015334251291,17165970082642158388,524288 --field-trial-handle=1888,i,3622210417653860921,1760059656807622019,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:11
    3⤵
    - System Time Discovery
    PID:6944
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=2220,i,5742954652618515637,11671906310878804961,524288 --field-trial-handle=1888,i,3622210417653860921,1760059656807622019,262144 --variations-seed-version --mojo-platform-channel-handle=1804 /prefetch:13
    3⤵
    PID:6896
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3132,i,16999028101029942856,7683593667662968126,2097152 --field-trial-handle=1888,i,3622210417653860921,1760059656807622019,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:1
    3⤵
    PID:6380
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3156,i,17569244758611433736,10214331952121998534,2097152 --field-trial-handle=1888,i,3622210417653860921,1760059656807622019,262144 --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:1
    3⤵
    PID:5300
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4388,i,13082821324631271620,11933704351944986341,2097152 --field-trial-handle=1888,i,3622210417653860921,1760059656807622019,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:1
    3⤵
    PID:5672
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4740,i,14136241403667380441,8033310538281905789,524288 --field-trial-handle=1888,i,3622210417653860921,1760059656807622019,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:14
    3⤵
    PID:5248
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4888,i,6641153526458787621,4892559662862575014,524288 --field-trial-handle=1888,i,3622210417653860921,1760059656807622019,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
    3⤵
    PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-fre --no-default-browser-check --disable-background-networking --disable-sync --disable-gpu --mute-audio --new-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2ac,0x7ffa8ae1c188,0x7ffa8ae1c194,0x7ffa8ae1c1a0
    3⤵
    PID:1324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1580,i,12015951366209923461,16443652192379825108,262144 --field-trial-handle=2320,i,5255789980497283144,11809802913849188722,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
    3⤵
    PID:4128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1716,i,4874971194767704591,11683060506891078795,524288 --field-trial-handle=2320,i,5255789980497283144,11809802913849188722,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:11
    3⤵
    - System Time Discovery
    PID:6772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,3203464926643793046,4988300808401761023,524288 --field-trial-handle=2320,i,5255789980497283144,11809802913849188722,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:13
    3⤵
    PID:1232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,8962312463009866268,15334483248005476994,2097152 --field-trial-handle=2320,i,5255789980497283144,11809802913849188722,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:5800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,13755633695343650614,4763996911321606530,2097152 --field-trial-handle=2320,i,5255789980497283144,11809802913849188722,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
    3⤵
    PID:5960

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6188

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 43854ac67be75471cea0431c772c985330a8dd32601170f577bc6e76ca3b5916
MD5 6fcd1b9bafdff25483c8cd0128d919b6
SHA1 304bd8379d650801123c73b0cfde3ec086c2eaa4
SHA512 8935e2a9b2e4746ae0184216cae69c97e1d552f0764229b1842e0d0c809ece9ffbf654930e0b014201e9d34781c1ddf9ec2da17953168dbb4de2a94268f04612
SSDEEP 96:1OlC6Fd+iT7Z+HXQ5U6fqlY6GCuXoRDotok5/5DlB6AGyv8aMahbubv4a:1ACy93OQ32DUDxbkeMahbu/
TLSH
T118A1EA32A47D9D77A47AE885B6163B4BCE78212BE661AE84EDDC1B0C15E70F90341733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9ac04be28534ffc90f065c5357ca3a80ca723726cde5efb88f8a7e1a6b44baca
MD5 b73ee45352458e50358c0ccfe08f6cf9
SHA1 c9670f21ef5a19258323e88f363ca274d9b861a3
SHA512 a0988cd4a43f2f8fe9ab537054ce760518819b4a5b241855d7dd15687bd71afc74fa5b853542182d12a3a9aebcf68ff8590341f7237f1283b2b611b7b5610238
TLSH
T11DD012143718648BCD1A2571D8318381A666846125598F4560A1924D9D69493539A396
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7207f4c246d3ac882ff42358926e52b8316dd22bb03c5644ebc6f2dbc1168a28
MD5 b7329a74f1fa351c02d17b8e2692e575
SHA1 ef3d4b0eaaee583b5233cc6fc44fd331077feaf2
SHA512 650d63f3a2e065e3c2e4933483e10d79ab609f116a4e0bf7e107adff2025a85d1c77c68f86e7604724ab7da540f31911cd91f5e49bbae26354b6446fe249827e
TLSH
T146D012143718648BC91A2571D4318381A6668421215A8F4564A1D24D9D69493A39A392
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 769a3eb5e4f91baf54eacfea3aa594d2de7b961d6407012165522c65e4984319
MD5 7905b6971cf61198bbe95dc79cdd5c3c
SHA1 acf6558e10d0cbd5dc41618b784e1aabd29124e8
SHA512 5398f7e446fdc9a685d78a63f9361275c394ac62f781a691c95472931813b62944b8ccd5e47542cfa3f5a783ea346681b06c6b115ca5235e0053866cbf9bde6c
SSDEEP 384:DNrRZyCSDnxTICYMEhIKyll7svbFKfk7:xFZJSDniwyI1l7svbF9
TLSH
T1EC44640A7B747001EDE2D9725CB080771E3CA16E8F22E6815DB654694EB3853A63D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 befd28638f8d9606fc3d240b8b833007a17941110c5083cc46574d9d18b39cbb
MD5 43864980d50dc91bcd301effef61689b
SHA1 0f3d4d8551ef2e441f68df34b1d18798e334e6e6
SHA512 324c281edf9b2c8f64f035390063ed69f57c5aaf19c832620a499ed16f8f563adb516b5e86e8285ffc69e669de33232c87c8320f3e1e94dd2ec12efe5d8aef1d
SSDEEP 768:6F1j+9KVwgd6Pevn9NG4N1IYxeCmn12bfJXM:f9KEOYYcC0yJXM
TLSH
T165C24A36D8A4CA77EDE78FC9B709764AEEE4026781DC5AD8DAD80D4D01D329D1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 cba57a7f47cdf1b3d3340b3eb47eceab9986bf74be4e417cf38650efb0a5234e
MD5 ad931327cb07283fc0aad07143ab5249
SHA1 5781ab8bbf27ffafc09e3c62bf05b990c8c87604
SHA512 0d3e5f213edb893f130a13edcc1731963be50831cad30bcbd7f16036449bf9fa0892dd8a4829c8e4a63f4efc245dc1c9666d988f505cb692553c63ab53f665c1
SSDEEP 768:6F1j+9KZwgd6Jxvn9NG4N1I8fxrepGGANmn12bfJXM:f9K4LY8f5KyN0yJXM
TLSH
T1B0C24B36D864CE67EDE38FC5A70A7657EEE4126781CC5AD8DAD80D4D01D329E130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6096-7-0x0000000001480000-0x0000000001524000-memory.dmp

Download

memory/6096-355-0x0000000001480000-0x0000000001524000-memory.dmp

Download

memory/6096-88-0x0000000001480000-0x0000000001524000-memory.dmp

Download

memory/6096-111-0x0000000001480000-0x0000000001524000-memory.dmp

Download

memory/6096-140-0x0000000001480000-0x0000000001524000-memory.dmp

Download

memory/6096-171-0x0000000001480000-0x0000000001524000-memory.dmp

Download

memory/6096-351-0x0000000001480000-0x0000000001524000-memory.dmp

Download

memory/6096-0-0x0000000001190000-0x0000000001191000-memory.dmp

Download

memory/6096-8-0x0000000001480000-0x0000000001524000-memory.dmp

Download

memory/6096-352-0x0000000001480000-0x0000000001524000-memory.dmp

Download

memory/6096-353-0x0000000001480000-0x0000000001524000-memory.dmp

Download

memory/6096-354-0x0000000001480000-0x0000000001524000-memory.dmp

Download

memory/6096-1-0x0000000001480000-0x0000000001524000-memory.dmp

Download

memory/6096-356-0x0000000001480000-0x0000000001524000-memory.dmp

Download