d85d164e46fabb085609f2586e8fec364539a6ec81f74659f0cb28ac76e7880b

Analysis

user interaction
yes
max time kernel
65s
max time network
50s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fix_lib_path.exe
Size 2.8MB
Sample260707-2faa1sfs4t
SHA256 d85d164e46fabb085609f2586e8fec364539a6ec81f74659f0cb28ac76e7880b
MD5 4db8e85743a1ae8b1d26a3bccbffb6d1
SHA1 57659b0847aef1d3f7539a4d31697de8c94f782e
SHA512 b8ebee81e1dd89e2122fffea636af5a024fdf3242b6e917becff9a89f6916de68d688896bacea4ac87b0179358af154244c670c24507cdf92d66d5294ff1eed1
SSDEEP 49152:DDGvk+nJmHrQm++AOtV4djxbD9bsow5zmwC4vHsrX2:DDkmHAEadjx3q7hlBsG
TLSH
T13ED59D0B7CD488EAC4AA973689B652417771FC1A4F3127D72E90B2782F72BE19C76740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 23 IoCs

description	pid	Process	procid_target
PID 2976 created 5700	2976	fix_lib_path.exe	88
PID 2976 created 1152	2976	fix_lib_path.exe	89
PID 2976 created 3324	2976	fix_lib_path.exe	90
PID 2976 created 2876	2976	fix_lib_path.exe	91
PID 2976 created 6076	2976	fix_lib_path.exe	92
PID 2976 created 2736	2976	fix_lib_path.exe	94
PID 2976 created 1480	2976	fix_lib_path.exe	95
PID 2976 created 5700	2976	fix_lib_path.exe	88
PID 2976 created 5700	2976	fix_lib_path.exe	88
PID 2976 created 2876	2976	fix_lib_path.exe	91
PID 2976 created 2876	2976	fix_lib_path.exe	91
PID 2976 created 5908	2976	fix_lib_path.exe	109
PID 2976 created 4380	2976	fix_lib_path.exe	110
PID 2976 created 360	2976	fix_lib_path.exe	111
PID 2976 created 4788	2976	fix_lib_path.exe	112
PID 2976 created 1180	2976	fix_lib_path.exe	113
PID 2976 created 1256	2976	fix_lib_path.exe	116
PID 2976 created 3396	2976	fix_lib_path.exe	117
PID 2976 created 2144	2976	fix_lib_path.exe	118
PID 2976 created 5908	2976	fix_lib_path.exe	109
PID 2976 created 5908	2976	fix_lib_path.exe	109
PID 2976 created 360	2976	fix_lib_path.exe	111
PID 2976 created 360	2976	fix_lib_path.exe	111

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2976	fix_lib_path.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2876	chrome.exe
360	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	fix_lib_path.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	fix_lib_path.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134279371039973396"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{8145D15F-39B4-4469-976F-1962980C1CF9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
2976	fix_lib_path.exe
2976	fix_lib_path.exe
2976	fix_lib_path.exe
2976	fix_lib_path.exe
2976	fix_lib_path.exe
2976	fix_lib_path.exe
2976	fix_lib_path.exe
2976	fix_lib_path.exe
2976	fix_lib_path.exe
2976	fix_lib_path.exe
2976	fix_lib_path.exe
5700	chrome.exe
5700	chrome.exe
2976	fix_lib_path.exe
2976	fix_lib_path.exe
2976	fix_lib_path.exe
2976	fix_lib_path.exe
2976	fix_lib_path.exe
2976	fix_lib_path.exe
2976	fix_lib_path.exe
2976	fix_lib_path.exe
2976	fix_lib_path.exe
2976	fix_lib_path.exe
2976	fix_lib_path.exe
2976	fix_lib_path.exe
2976	fix_lib_path.exe
2976	fix_lib_path.exe
2976	fix_lib_path.exe
2976	fix_lib_path.exe
2976	fix_lib_path.exe
2976	fix_lib_path.exe
2976	fix_lib_path.exe
2976	fix_lib_path.exe
2976	fix_lib_path.exe
2976	fix_lib_path.exe
2976	fix_lib_path.exe
2976	fix_lib_path.exe
2976	fix_lib_path.exe
2976	fix_lib_path.exe
2976	fix_lib_path.exe
2976	fix_lib_path.exe
2976	fix_lib_path.exe
2976	fix_lib_path.exe
2976	fix_lib_path.exe
2976	fix_lib_path.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
5700	chrome.exe
5700	chrome.exe
5700	chrome.exe
5700	chrome.exe
5700	chrome.exe
5700	chrome.exe
5700	chrome.exe
5700	chrome.exe
5700	chrome.exe
5700	chrome.exe
5908	msedge.exe
5908	msedge.exe
5908	msedge.exe
5908	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2976	fix_lib_path.exe
Token: SeShutdownPrivilege	5700	chrome.exe
Token: SeCreatePagefilePrivilege	5700	chrome.exe
Token: SeShutdownPrivilege	5700	chrome.exe
Token: SeCreatePagefilePrivilege	5700	chrome.exe
Token: SeShutdownPrivilege	5700	chrome.exe
Token: SeCreatePagefilePrivilege	5700	chrome.exe
Token: SeShutdownPrivilege	5700	chrome.exe
Token: SeCreatePagefilePrivilege	5700	chrome.exe
Token: SeShutdownPrivilege	5700	chrome.exe
Token: SeCreatePagefilePrivilege	5700	chrome.exe
Token: SeShutdownPrivilege	5700	chrome.exe
Token: SeCreatePagefilePrivilege	5700	chrome.exe
Token: SeShutdownPrivilege	5700	chrome.exe
Token: SeCreatePagefilePrivilege	5700	chrome.exe
Token: SeShutdownPrivilege	5700	chrome.exe
Token: SeCreatePagefilePrivilege	5700	chrome.exe
Token: SeShutdownPrivilege	5700	chrome.exe
Token: SeCreatePagefilePrivilege	5700	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
5700	chrome.exe
5700	chrome.exe
5700	chrome.exe
5700	chrome.exe
5700	chrome.exe
5700	chrome.exe
5700	chrome.exe
5700	chrome.exe
5700	chrome.exe
5700	chrome.exe
5700	chrome.exe
5700	chrome.exe
5700	chrome.exe
5700	chrome.exe
5700	chrome.exe
5700	chrome.exe
5700	chrome.exe
5700	chrome.exe
5700	chrome.exe
5700	chrome.exe
5700	chrome.exe
5700	chrome.exe
5700	chrome.exe
5700	chrome.exe
5700	chrome.exe
5700	chrome.exe
5700	chrome.exe
5700	chrome.exe
5700	chrome.exe
5700	chrome.exe
5700	chrome.exe
5700	chrome.exe
5700	chrome.exe
5700	chrome.exe
5908	msedge.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 5700	2976	fix_lib_path.exe	88
PID 5700 wrote to memory of 1152	5700	chrome.exe	89
PID 5700 wrote to memory of 3324	5700	chrome.exe	90
PID 5700 wrote to memory of 2876	5700	chrome.exe	91
PID 5700 wrote to memory of 3324	5700	chrome.exe	90
PID 5700 wrote to memory of 6076	5700	chrome.exe	92
PID 5700 wrote to memory of 6076	5700	chrome.exe	92
PID 5700 wrote to memory of 2736	5700	chrome.exe	94
PID 5700 wrote to memory of 1480	5700	chrome.exe	95
PID 5700 wrote to memory of 2736	5700	chrome.exe	94
PID 5700 wrote to memory of 1480	5700	chrome.exe	95
PID 5700 wrote to memory of 4200	5700	chrome.exe	96
PID 5700 wrote to memory of 4200	5700	chrome.exe	96
PID 5700 wrote to memory of 596	5700	chrome.exe	97
PID 5700 wrote to memory of 1044	5700	chrome.exe	98
PID 5700 wrote to memory of 1816	5700	chrome.exe	99
PID 5700 wrote to memory of 1044	5700	chrome.exe	98
PID 5700 wrote to memory of 1816	5700	chrome.exe	99
PID 5700 wrote to memory of 2568	5700	chrome.exe	101
PID 5700 wrote to memory of 2568	5700	chrome.exe	101
PID 5700 wrote to memory of 3212	5700	chrome.exe	104
PID 5700 wrote to memory of 3212	5700	chrome.exe	104
PID 5700 wrote to memory of 1052	5700	chrome.exe	105
PID 5700 wrote to memory of 1052	5700	chrome.exe	105
PID 5700 wrote to memory of 3936	5700	chrome.exe	106
PID 5700 wrote to memory of 3936	5700	chrome.exe	106
PID 5700 wrote to memory of 1164	5700	chrome.exe	107
PID 5700 wrote to memory of 1164	5700	chrome.exe	107
PID 5700 wrote to memory of 3000	5700	chrome.exe	108
PID 5700 wrote to memory of 3000	5700	chrome.exe	108
PID 2976 wrote to memory of 5908	2976	fix_lib_path.exe	109
PID 5908 wrote to memory of 4380	5908	msedge.exe	110
PID 5908 wrote to memory of 360	5908	msedge.exe	111
PID 5908 wrote to memory of 4788	5908	msedge.exe	112
PID 5908 wrote to memory of 4788	5908	msedge.exe	112
PID 5908 wrote to memory of 4788	5908	msedge.exe	112
PID 5908 wrote to memory of 1180	5908	msedge.exe	113
PID 5908 wrote to memory of 1180	5908	msedge.exe	113
PID 5908 wrote to memory of 548	5908	msedge.exe	115
PID 5908 wrote to memory of 548	5908	msedge.exe	115
PID 5908 wrote to memory of 548	5908	msedge.exe	115
PID 5908 wrote to memory of 1256	5908	msedge.exe	116
PID 5908 wrote to memory of 1256	5908	msedge.exe	116
PID 5908 wrote to memory of 1256	5908	msedge.exe	116
PID 5908 wrote to memory of 3396	5908	msedge.exe	117
PID 5908 wrote to memory of 3396	5908	msedge.exe	117
PID 5908 wrote to memory of 3396	5908	msedge.exe	117
PID 5908 wrote to memory of 2144	5908	msedge.exe	118
PID 5908 wrote to memory of 2144	5908	msedge.exe	118
PID 5908 wrote to memory of 2144	5908	msedge.exe	118
PID 5908 wrote to memory of 2180	5908	msedge.exe	119
PID 5908 wrote to memory of 2180	5908	msedge.exe	119
PID 5908 wrote to memory of 2808	5908	msedge.exe	121
PID 5908 wrote to memory of 2328	5908	msedge.exe	122
PID 5908 wrote to memory of 2808	5908	msedge.exe	121
PID 5908 wrote to memory of 2328	5908	msedge.exe	122
PID 5908 wrote to memory of 4116	5908	msedge.exe	124
PID 5908 wrote to memory of 2488	5908	msedge.exe	125
PID 5908 wrote to memory of 2488	5908	msedge.exe	125
PID 5908 wrote to memory of 1916	5908	msedge.exe	128
PID 5908 wrote to memory of 1916	5908	msedge.exe	128

C:\Users\Admin\AppData\Local\Temp\fix_lib_path.exe
"C:\Users\Admin\AppData\Local\Temp\fix_lib_path.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5700
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffab415c728,0x7ffab415c734,0x7ffab415c740
    3⤵
    PID:1152
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1636,i,9915904905119097018,12038460684365624927,262144 --field-trial-handle=1916,i,12211101707598586006,4879036093967845003,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
    3⤵
    PID:3324
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1956,i,3181758015096036550,8439504917906748403,524288 --field-trial-handle=1916,i,12211101707598586006,4879036093967845003,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2876
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2252,i,3996896248654050725,6537144474782333308,524288 --field-trial-handle=1916,i,12211101707598586006,4879036093967845003,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:13
    3⤵
    PID:6076
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3024,i,108087427748951296,14808604624893880394,2097152 --field-trial-handle=1916,i,12211101707598586006,4879036093967845003,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:1
    3⤵
    PID:2736
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3032,i,17948647581918148993,6398650107840198663,2097152 --field-trial-handle=1916,i,12211101707598586006,4879036093967845003,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:1
    3⤵
    PID:1480
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4584,i,1984736566385409917,8663715778768456169,524288 --field-trial-handle=1916,i,12211101707598586006,4879036093967845003,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:14
    3⤵
    PID:4200
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5328,i,9405651503567072540,10776270116317651830,524288 --field-trial-handle=1916,i,12211101707598586006,4879036093967845003,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
    3⤵
    PID:596
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5440,i,2836695931961864060,12295519574021217837,2097152 --field-trial-handle=1916,i,12211101707598586006,4879036093967845003,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
    3⤵
    PID:1044
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5428,i,16630550102561367709,15473330080322170224,2097152 --field-trial-handle=1916,i,12211101707598586006,4879036093967845003,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
    3⤵
    PID:1816
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5520,i,4051035607388101380,5682536990135420566,2097152 --field-trial-handle=1916,i,12211101707598586006,4879036093967845003,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:1
    3⤵
    PID:2568
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5432,i,17777708408989958394,2817448396102872921,2097152 --field-trial-handle=1916,i,12211101707598586006,4879036093967845003,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
    3⤵
    PID:3212
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5740,i,7740386518020926251,15580987324291956040,2097152 --field-trial-handle=1916,i,12211101707598586006,4879036093967845003,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
    3⤵
    PID:1052
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6024,i,5335950679609759066,4777140688624933825,2097152 --field-trial-handle=1916,i,12211101707598586006,4879036093967845003,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:1
    3⤵
    PID:3936
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5408,i,14576020450192052723,2080921909925595934,2097152 --field-trial-handle=1916,i,12211101707598586006,4879036093967845003,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:1
    3⤵
    PID:1164
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5612,i,136187817710951297,5009747942878931236,2097152 --field-trial-handle=1916,i,12211101707598586006,4879036093967845003,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:1
    3⤵
    PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x264,0x268,0x234,0x2ac,0x7ffaaf0ec188,0x7ffaaf0ec194,0x7ffaaf0ec1a0
    3⤵
    PID:4380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,15131871696494172557,12965104888232768100,524288 --field-trial-handle=2560,i,5726770309230828784,8890162097933639387,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:11
    3⤵
    - System Time Discovery
    PID:360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1580,i,17058600312527822418,1622953120916975091,262144 --field-trial-handle=2560,i,5726770309230828784,8890162097933639387,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:2
    3⤵
    PID:4788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,16790544962178930417,2339134714237686977,524288 --field-trial-handle=2560,i,5726770309230828784,8890162097933639387,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:13
    3⤵
    PID:1180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,15913757838214966769,17160463642979171299,2097152 --field-trial-handle=2560,i,5726770309230828784,8890162097933639387,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
    3⤵
    PID:548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,5183245059888620005,4995535323271895562,2097152 --field-trial-handle=2560,i,5726770309230828784,8890162097933639387,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
    3⤵
    PID:1256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,1017422755408798629,2206849434536427968,2097152 --field-trial-handle=2560,i,5726770309230828784,8890162097933639387,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:9
    3⤵
    PID:3396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,18161359982980048012,7358087631657159255,2097152 --field-trial-handle=2560,i,5726770309230828784,8890162097933639387,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
    3⤵
    PID:2144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,17809132002843382595,12290748940863982298,524288 --field-trial-handle=2560,i,5726770309230828784,8890162097933639387,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
    3⤵
    PID:2180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,10896079535153385823,6452608348764284547,524288 --field-trial-handle=2560,i,5726770309230828784,8890162097933639387,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
    3⤵
    PID:2808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,11406764359243346649,1763056308310323654,524288 --field-trial-handle=2560,i,5726770309230828784,8890162097933639387,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
    3⤵
    PID:2328
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,6101669663208786914,4197049959735259288,524288 --field-trial-handle=2560,i,5726770309230828784,8890162097933639387,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
    3⤵
    PID:5660
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,6101669663208786914,4197049959735259288,524288 --field-trial-handle=2560,i,5726770309230828784,8890162097933639387,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
    3⤵
    PID:4116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,6719509956640213193,17371402341113103270,524288 --field-trial-handle=2560,i,5726770309230828784,8890162097933639387,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
    3⤵
    PID:2488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,15714356176789291569,7960872354507214469,524288 --field-trial-handle=2560,i,5726770309230828784,8890162097933639387,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:14
    3⤵
    PID:1916

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5348

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 cfa3fce19525b58b7ae657c8e76d2efad50fed502d37b3cdc5e780ffab89d47c
MD5 84c34fe29e9700c1e686d49077305ad3
SHA1 58dc4cd1129068d5c5e5b55ca3d2649caeef8c94
SHA512 d6c201ae616d28102925a3f40def807cc8aab6776ed609709f5d189a2f78cd3f6b8d33676d46a079697a0778743931ee77b8fcd77bb8677cdd7ae38523223461
SSDEEP 192:pR/PQShv7OlvAPRp2u9sHsb+WNna5PYIe4VyIsnAUgR:pR/P9xe6XBqwYPJR
TLSH
T1F322952AAE14663B6CCBD22AFD717B53E7F5102522942E84E6FC8A6C11E79CC2317417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 7f670b636d17d594854b0f1ae6292f07e636ecfb5dafdd1636d31b6f2d00e1b1
MD5 e2eeaffb5f641b6241c27abf0a16db9d
SHA1 617d93c636f93c8b57ce9e9844568814699ef3df
SHA512 276f4ebc8d18aae842f0cd6004d1d0d79b111c4c136ab6b926de89bcdda3295939e29869bddc02f22f83047fa498abb969b053ede833e89c987b16734c60ba82
SSDEEP 192:eOl4K66E7KxkXqK4I40pUZNCgVLHrKHfFKslE5WMXzKD/bC+ErUkKN9ZognF+c3J:vljpE7KxkXqKf/pUZNCgVLH2HfgslFME
TLSH
T1DA32D917684D9A7B4FD8D51DCC136F4BADB502D773780C2492FB6D0803A678E224A1AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 71aca75c22a05b14b66ef4ade2c2c7c8e73788de98195748342c3c17201d7e61
MD5 416a879526617c45d4e235ca6072fd4b
SHA1 e75a787a62da27f1e750c62a015bc4879cb18672
SHA512 4ce5af870f0f2b8eafef8899631b90fd81be2d3061be4beb90d025df6fb3ac4a8b60638b583e9cdba5567c75f03821c7d78eab5f370d3098c92f39facf922801
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OEetUVumWnmG7:1nbZeMrv/hGtEetJnmG7
TLSH
T1CCD3864B3A743102EDE59A722CE051BB5E3CB16D4F1595D428B720688EF2963A23D0FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 4ed32ec2ca19f5b712947124be1d5b1da3e5e7d72b5c0976c2abcca46ccd06d7
MD5 81046cc3c8be5d541974027ac6a5074d
SHA1 130545f1f47db699b2801b34135e185864fc58ba
SHA512 5cfd9e1bdda60cb7471732a364fe3452d7b55f8b2d0560b3ae6a74434cd21693d1876b90716aefd6d73bbe9e956f3d24600ad69962036d4be26116b990ab3e3f
SSDEEP 96:/C6Gd+d6+YqlHQS6tfaczygHn7fORDotok5ARDcB6OdGyvuXvZ7ybhvv4a:/Cpq6+Yq2S6Fyon4DUDOwZwVZ7ybhL
TLSH
T156A11B72A87A9D7755B6D48879827E03CFE4626B66206F84A8DD0F0C52F30EC0303113
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 9365c9ea3e124853c0299e44e7f4dd2cb46e9e5e95d4d78a29873c48e8d88ec0
MD5 6f0706ab4793db65f735cb5e0bef1f9c
SHA1 b3dcdde138461c349a2c2843d7e23c064ade7b1f
SHA512 e2ca800795e43fd47ae9306fb477cd2e54ce656e8a34ffadf2ad3d720c4447fc59bb9a9ced9e0d4be0d771bfc58da3179ee2aefdc848449e7ec2b01e22a1c699
SSDEEP 96:jC6PRd+d6+YqlHQS6tfaczygHnWf3zSSl8h4otop5AMDcB6uGyvumdBx1Qzb1/BE:jCSRq6+Yq2S6FyonOaiU2BwWgdBElya+
TLSH
T174C1F872A87DEE7325F3E489B4436A87CEF5612B66102B549ADD0B0C22E74AC1343523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b2d903efec8d558eba6ee4ac12873ce1439014705e9d819ff4dfcffa10c4b270
MD5 d9964ad138b9b56ea7891b8576b8a6ce
SHA1 e8153c0a553b8b81a07f1bbc77037f1700b79956
SHA512 7028c8597edeb715bb44be72ae48ceb181161e73b5380897f449df22a8c2b5302f664d632f2373c4c7a712d85a4b0ca70a4a062d6af265eefcac45dd99a660f1
TLSH
T1FCD092A4BB40EC0ECA91287B25B69A19B6409831BC56061A8966B0F88C517831A1B0EE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1d0eccd9de1dbbf6cbedcb541fa52903c78d66d4d260136bc73243b056beb74
MD5 12c06f300a4b88646d6fda378a48455e
SHA1 86d58840d0666ad8999198dad1983a8cfd61fd18
SHA512 76e813720fc8cd4d829570b1b32d711d2d751540dea1fcac581dd9a5963c4e3161cffa07350cc8d5477fa02d0eb7b1c29b8ffb567f85b5a94259654ff2af3928
TLSH
T118D092A8BB40ED0ECA91287B25B59A19B6509831FC56061A8866B0E88C517831A1B0FE
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 614616cbd4f7cdeffaa9039e601afd13b572ff90b90af5d7e479960034348332
MD5 5845570b9e208262dcb9d505d8722a8a
SHA1 c972bb379387a38cccc8098083084195ac09bcc7
SHA512 ec592fbaf75d1a3654056540128c97768a94301d59761fdb52db42ec704c244cc733ea74ca071d318f579441d87344dfa2916dba04b2cc8f01be8f7edbd494a5
SSDEEP 192:sxRTR6yM/jK1Ml8wC7/fRsyErykZizoA8pi/g6+WNIYnotBG3IgtJ:sxRTY87/fRsyhavi/5ITW3
TLSH
T13652C9166A349977CCDBD20DFA557F53D6F81563A2901E44AAFC8A0C01E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 268b22ce1e714a2454bb9d0d45a8ca6b5ff6053cc5f415a08bd4373dc22fa719
MD5 ad3f053dd2923afaaa770c39d2d66439
SHA1 4ae14fd484d3646b1a2bba534211fa8587fba5ac
SHA512 3ec01fff76cc06ec8935800610ce9fd490e85b91bdd1bda676a7cd16df36e003745e3a61187dcec225626613a1e7876d6c795b288e490919a9c1dff16188bab6
SSDEEP 768:Jl6hhs7pLuL7b2WgqcfHw8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPU3Xgu+roMC8Br:Jl6hhQE7b2WgqcfHwu1ja0U3QuVMC2
TLSH
T17BE2EC3B780CCB7E4F804A9CEC297D9A6DE801CB96D8CD5447F9894C03C66EB511A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 67194cb43cd56c2941560da4b4491c3adbbd645df325a1b77d66c2a87927bf31
MD5 2d53a8e4c8b200425da5f2535cb6e07b
SHA1 f33a3dee1b9715f231b07bfea18359b04e8e4efc
SHA512 438bd740004051295074b7a8973d8adc9d4eb5d3df475d5ed5d9e55e42009f7e43fb1e7b175c750d6beab3ba105c6437485ee1af99ed7eec7850485e6d81cd05
SSDEEP 96:KRfItpfd9xWJmsgRxK44g/xcnvOR9SHm7KmgIIOW4tVgGOK47g0OcOGlkWU1gkeM:CfItpfd9cJmtR74g/envOR9SHm7KmgIx
TLSH
T11791860570B78640287E395CC1688957D6C77066311AF42F7FA911D22FAEE02AFFD8E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 64b6c69699c96e0fa077013bff8e2b03fce396998eb07d7aac32ab593a107841
MD5 6fd99c4ed2f63f7b4a66bac8df9c7033
SHA1 bcf022e021ae8cd98332ccb0354c2d58089eaec1
SHA512 e7505a301a8c990ea946f6c1ae683c8473b4285b9be74879d42742512a2c426668edcaa9b4d227e0460c578c2681c6c649b4c2847a341fe0ebe51c536a33d3d2
SSDEEP 384:DNrRZyCSDnxTICGOMEhIKyll7svbFKfk7:xFZJSDniTPyI1l7svbF9
TLSH
T19444750A7B747001EDE6D9B25CB080771E3CB16E8F22E6915DA254694DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c0f09a9b073ce5edb7c5e3dc84d3184480c2c3689dc82852b21357848cbc9c1f
MD5 d37901f8adeb3ac26f7651999b3c6aad
SHA1 09c9e54e997ad3ab094a8856b6c2cfe3bd8a7d0b
SHA512 0615fa9f8cba95366c4dafbf8403c3aa441cc73e205f7d13290239b3c0f03c8c4743602974666ab63dddd08875a9303429529d080146f37d397b51c963d0faf2
SSDEEP 768:nj+9M3/6wovmYreNSLfifotAf0X7DGFzoqPcNMCNFRb9MA:K9M3/6wKdpfifVf03WkqPa7b+A
TLSH
T1BAF2AFB5AC645A674DE3CAC9B7173B4BAFF0066741841A48DCED6F0E468B6BC0307929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 982ba4601ff9f67d08da177f50c37b3ac6b2f5abec6a675d304cc742ee69e93d
MD5 b6a1d671e1aa5e2feb1ac79769ef4e4e
SHA1 22eda7cbb3cb40f943b45f8ff642046ad27d3b3c
SHA512 5d718d07afbab7af222ad74e3546458188d38e49643fe826d618ac7ed7925413b1866acdba5eb7ed6350e5785c082633410c53f190d34067b7af5d55e9e2dde6
SSDEEP 768:Vrv+4UNbda3LFYreNSLfifotxX7DGFzoqPcNMCNZPeVH1SkM:Vbsb43ipfifg3WkqPa5EH1Y
TLSH
T1D803BFB6A8A455378CE3C6C9B75B360B6FF0015746440B94D8EE2F0E879F5AD130BE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2dbc8718

Path C:\Users\Admin\AppData\Local\Temp\0bf0ea8e\2dbc8718
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5908_1087562137\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2976-116-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-88-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-49-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-50-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-58-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-66-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-69-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-77-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-90-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-94-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-104-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-102-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-122-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-134-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-145-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-144-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-143-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-142-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-133-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-132-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-127-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-126-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-124-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-16-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-115-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-114-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-113-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-107-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-106-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-105-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-103-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-96-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-95-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-42-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-87-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-86-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-85-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-84-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-83-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-76-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-75-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-74-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-67-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-65-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-64-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-68-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-57-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-56-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-14-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-15-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-13-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-12-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-11-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-10-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-9-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-8-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-7-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-6-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-5-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-4-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-3-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-2-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-1-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-0-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-48-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-47-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2976-2345-0x0000000410000000-0x000000041021A000-memory.dmp

Download