f320cb93aca97694e2935d87576da8cda03d47659021c3f79e15dd164e894599

Analysis

max time kernel
150s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d9e1709923ce40c49d6add23c7c95d0e.exe
Size 3.4MB
Sample260708-pgdnlsft9w
SHA256 f320cb93aca97694e2935d87576da8cda03d47659021c3f79e15dd164e894599
MD5 f8634cab0e0d17e9a5808532797efad1
SHA1 39d6ab1e59dc2a3bbd320ffbd07a721753001eaf
SHA512 fc29e6adf43de1368087d44486010316ef61262d75bb3ed70697310d7e92cd4fc5e62576ca181ef46bcf284794ce91d106944e6d969e48c9d99b6884b4840088
SSDEEP 49152:XmbCj+HFJfuFOMP+Xk5F8+eQA99+knYr:XPYMWX/+eQI+k
TLSH
T100F57C07ECD158E6C0A9A231C9B7928A7735BC491F3227E72E90A7782F727D06C36754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 23 IoCs

description	pid	Process	procid_target
PID 5020 created 1772	5020	d9e1709923ce40c49d6add23c7c95d0e.exe	88
PID 5020 created 3384	5020	d9e1709923ce40c49d6add23c7c95d0e.exe	89
PID 5020 created 5612	5020	d9e1709923ce40c49d6add23c7c95d0e.exe	90
PID 5020 created 5736	5020	d9e1709923ce40c49d6add23c7c95d0e.exe	91
PID 5020 created 1796	5020	d9e1709923ce40c49d6add23c7c95d0e.exe	92
PID 5020 created 6068	5020	d9e1709923ce40c49d6add23c7c95d0e.exe	95
PID 5020 created 1464	5020	d9e1709923ce40c49d6add23c7c95d0e.exe	94
PID 5020 created 1772	5020	d9e1709923ce40c49d6add23c7c95d0e.exe	88
PID 5020 created 1772	5020	d9e1709923ce40c49d6add23c7c95d0e.exe	88
PID 5020 created 5736	5020	d9e1709923ce40c49d6add23c7c95d0e.exe	91
PID 5020 created 5736	5020	d9e1709923ce40c49d6add23c7c95d0e.exe	91
PID 5020 created 3788	5020	d9e1709923ce40c49d6add23c7c95d0e.exe	112
PID 5020 created 2076	5020	d9e1709923ce40c49d6add23c7c95d0e.exe	113
PID 5020 created 264	5020	d9e1709923ce40c49d6add23c7c95d0e.exe	115
PID 5020 created 1384	5020	d9e1709923ce40c49d6add23c7c95d0e.exe	116
PID 5020 created 3684	5020	d9e1709923ce40c49d6add23c7c95d0e.exe	117
PID 5020 created 4504	5020	d9e1709923ce40c49d6add23c7c95d0e.exe	119
PID 5020 created 2484	5020	d9e1709923ce40c49d6add23c7c95d0e.exe	120
PID 5020 created 1704	5020	d9e1709923ce40c49d6add23c7c95d0e.exe	121
PID 5020 created 3788	5020	d9e1709923ce40c49d6add23c7c95d0e.exe	112
PID 5020 created 3788	5020	d9e1709923ce40c49d6add23c7c95d0e.exe	112
PID 5020 created 1384	5020	d9e1709923ce40c49d6add23c7c95d0e.exe	116
PID 5020 created 1384	5020	d9e1709923ce40c49d6add23c7c95d0e.exe	116

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5020	d9e1709923ce40c49d6add23c7c95d0e.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1384	msedge.exe
5736	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	d9e1709923ce40c49d6add23c7c95d0e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	d9e1709923ce40c49d6add23c7c95d0e.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134279866992583104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{1847F166-03A1-45E4-998E-5E8BBC9DA13D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
1772	chrome.exe
1772	chrome.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe
5020	d9e1709923ce40c49d6add23c7c95d0e.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	5020	d9e1709923ce40c49d6add23c7c95d0e.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
3788	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 1772	5020	d9e1709923ce40c49d6add23c7c95d0e.exe	88
PID 1772 wrote to memory of 3384	1772	chrome.exe	89
PID 1772 wrote to memory of 5736	1772	chrome.exe	91
PID 1772 wrote to memory of 5612	1772	chrome.exe	90
PID 1772 wrote to memory of 5612	1772	chrome.exe	90
PID 1772 wrote to memory of 1796	1772	chrome.exe	92
PID 1772 wrote to memory of 1796	1772	chrome.exe	92
PID 1772 wrote to memory of 1464	1772	chrome.exe	94
PID 1772 wrote to memory of 1464	1772	chrome.exe	94
PID 1772 wrote to memory of 6068	1772	chrome.exe	95
PID 1772 wrote to memory of 6068	1772	chrome.exe	95
PID 1772 wrote to memory of 5828	1772	chrome.exe	96
PID 1772 wrote to memory of 5828	1772	chrome.exe	96
PID 1772 wrote to memory of 6008	1772	chrome.exe	98
PID 1772 wrote to memory of 2020	1772	chrome.exe	99
PID 1772 wrote to memory of 2020	1772	chrome.exe	99
PID 1772 wrote to memory of 5424	1772	chrome.exe	100
PID 1772 wrote to memory of 5424	1772	chrome.exe	100
PID 1772 wrote to memory of 4736	1772	chrome.exe	104
PID 1772 wrote to memory of 4736	1772	chrome.exe	104
PID 1772 wrote to memory of 4880	1772	chrome.exe	106
PID 1772 wrote to memory of 4880	1772	chrome.exe	106
PID 1772 wrote to memory of 5324	1772	chrome.exe	105
PID 1772 wrote to memory of 5324	1772	chrome.exe	105
PID 1772 wrote to memory of 1564	1772	chrome.exe	107
PID 1772 wrote to memory of 1564	1772	chrome.exe	107
PID 1772 wrote to memory of 6080	1772	chrome.exe	108
PID 1772 wrote to memory of 6080	1772	chrome.exe	108
PID 1772 wrote to memory of 4588	1772	chrome.exe	109
PID 1772 wrote to memory of 4588	1772	chrome.exe	109
PID 1772 wrote to memory of 1192	1772	chrome.exe	110
PID 1772 wrote to memory of 1192	1772	chrome.exe	110
PID 1772 wrote to memory of 2124	1772	chrome.exe	111
PID 1772 wrote to memory of 2124	1772	chrome.exe	111
PID 5020 wrote to memory of 3788	5020	d9e1709923ce40c49d6add23c7c95d0e.exe	112
PID 3788 wrote to memory of 2076	3788	msedge.exe	113
PID 3788 wrote to memory of 264	3788	msedge.exe	115
PID 3788 wrote to memory of 1384	3788	msedge.exe	116
PID 3788 wrote to memory of 264	3788	msedge.exe	115
PID 3788 wrote to memory of 264	3788	msedge.exe	115
PID 3788 wrote to memory of 3684	3788	msedge.exe	117
PID 3788 wrote to memory of 3684	3788	msedge.exe	117
PID 3788 wrote to memory of 4596	3788	msedge.exe	118
PID 3788 wrote to memory of 4596	3788	msedge.exe	118
PID 3788 wrote to memory of 4504	3788	msedge.exe	119
PID 3788 wrote to memory of 4596	3788	msedge.exe	118
PID 3788 wrote to memory of 4504	3788	msedge.exe	119
PID 3788 wrote to memory of 4504	3788	msedge.exe	119
PID 3788 wrote to memory of 2484	3788	msedge.exe	120
PID 3788 wrote to memory of 2484	3788	msedge.exe	120
PID 3788 wrote to memory of 1704	3788	msedge.exe	121
PID 3788 wrote to memory of 2484	3788	msedge.exe	120
PID 3788 wrote to memory of 1704	3788	msedge.exe	121
PID 3788 wrote to memory of 1704	3788	msedge.exe	121
PID 3788 wrote to memory of 2456	3788	msedge.exe	122
PID 3788 wrote to memory of 2456	3788	msedge.exe	122
PID 3788 wrote to memory of 6116	3788	msedge.exe	123
PID 3788 wrote to memory of 5396	3788	msedge.exe	124
PID 3788 wrote to memory of 6116	3788	msedge.exe	123
PID 3788 wrote to memory of 5396	3788	msedge.exe	124
PID 3788 wrote to memory of 4336	3788	msedge.exe	126
PID 3788 wrote to memory of 4592	3788	msedge.exe	127
PID 3788 wrote to memory of 4592	3788	msedge.exe	127
PID 3788 wrote to memory of 3256	3788	msedge.exe	130

C:\Users\Admin\AppData\Local\Temp\d9e1709923ce40c49d6add23c7c95d0e.exe
"C:\Users\Admin\AppData\Local\Temp\d9e1709923ce40c49d6add23c7c95d0e.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8391fc728,0x7ff8391fc734,0x7ff8391fc740
    3⤵
    PID:3384
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1644,i,9040444844987538746,68129435822712779,262144 --field-trial-handle=1900,i,14563197801538688362,7488626769239910402,262144 --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:2
    3⤵
    PID:5612
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1500,i,15942359204188880844,9764191988718769140,524288 --field-trial-handle=1900,i,14563197801538688362,7488626769239910402,262144 --variations-seed-version --mojo-platform-channel-handle=1976 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5736
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2224,i,991002791060604659,4893810469813630222,524288 --field-trial-handle=1900,i,14563197801538688362,7488626769239910402,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:13
    3⤵
    PID:1796
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3024,i,6989796757704599590,12940079624793645938,2097152 --field-trial-handle=1900,i,14563197801538688362,7488626769239910402,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:1
    3⤵
    PID:1464
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3032,i,10465042712998612861,1417687477815499691,2097152 --field-trial-handle=1900,i,14563197801538688362,7488626769239910402,262144 --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:1
    3⤵
    PID:6068
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3684,i,18308909812403634326,9194782628657918736,524288 --field-trial-handle=1900,i,14563197801538688362,7488626769239910402,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:14
    3⤵
    PID:5828
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5332,i,13540329904595684681,7865468835273060705,524288 --field-trial-handle=1900,i,14563197801538688362,7488626769239910402,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
    3⤵
    PID:6008
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5452,i,16595314892951702433,7997683535921498314,2097152 --field-trial-handle=1900,i,14563197801538688362,7488626769239910402,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
    3⤵
    PID:2020
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5436,i,9761413020367227401,34565862684525180,2097152 --field-trial-handle=1900,i,14563197801538688362,7488626769239910402,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
    3⤵
    PID:5424
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5776,i,10763210432151027610,11985450923935021345,2097152 --field-trial-handle=1900,i,14563197801538688362,7488626769239910402,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:1
    3⤵
    PID:4736
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5756,i,9125696464749923593,17223410607751173278,524288 --field-trial-handle=1900,i,14563197801538688362,7488626769239910402,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
    3⤵
    PID:5324
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5848,i,10521333319465071331,3235881322325978189,2097152 --field-trial-handle=1900,i,14563197801538688362,7488626769239910402,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
    3⤵
    PID:4880
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5764,i,15478101651440674582,9125567274789903810,2097152 --field-trial-handle=1900,i,14563197801538688362,7488626769239910402,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:1
    3⤵
    PID:1564
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5812,i,18243711016333965361,5448686839916944910,2097152 --field-trial-handle=1900,i,14563197801538688362,7488626769239910402,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:1
    3⤵
    PID:6080
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4808,i,5250609130568236704,11816263663735768363,2097152 --field-trial-handle=1900,i,14563197801538688362,7488626769239910402,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:1
    3⤵
    PID:4588
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5504,i,16949855754313309527,15265649273521640000,524288 --field-trial-handle=1900,i,14563197801538688362,7488626769239910402,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:14
    3⤵
    PID:1192
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6044,i,15500095947530369378,9023775814945069687,2097152 --field-trial-handle=1900,i,14563197801538688362,7488626769239910402,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:1
    3⤵
    PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x268,0x26c,0x270,0x264,0x288,0x7ff82283c188,0x7ff82283c194,0x7ff82283c1a0
    3⤵
    PID:2076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1996,i,4868525827200073748,15927496525130197635,262144 --field-trial-handle=2480,i,793307464930358715,11473290103074715469,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:2
    3⤵
    PID:264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2136,i,11723523300671796557,606134521875409794,524288 --field-trial-handle=2480,i,793307464930358715,11473290103074715469,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2132,i,10730683564077221437,12864355923191962336,524288 --field-trial-handle=2480,i,793307464930358715,11473290103074715469,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:13
    3⤵
    PID:3684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,7161553313668563668,4077173856486069700,2097152 --field-trial-handle=2480,i,793307464930358715,11473290103074715469,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
    3⤵
    PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,14738871211251111939,3627455296465013142,2097152 --field-trial-handle=2480,i,793307464930358715,11473290103074715469,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:4504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,14273840039713167319,12574797946809208397,2097152 --field-trial-handle=2480,i,793307464930358715,11473290103074715469,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
    3⤵
    PID:2484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,14253033915744604674,8477509429991145056,2097152 --field-trial-handle=2480,i,793307464930358715,11473290103074715469,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:9
    3⤵
    PID:1704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,15471626698752792618,833144251264626949,524288 --field-trial-handle=2480,i,793307464930358715,11473290103074715469,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:14
    3⤵
    PID:2456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,1923156905839989620,18099615637975727789,524288 --field-trial-handle=2480,i,793307464930358715,11473290103074715469,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
    3⤵
    PID:6116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,3089408552520564864,6840260602468055331,524288 --field-trial-handle=2480,i,793307464930358715,11473290103074715469,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
    3⤵
    PID:5396
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,4811424147464580249,6947612064660068374,524288 --field-trial-handle=2480,i,793307464930358715,11473290103074715469,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
    3⤵
    PID:2024
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,4811424147464580249,6947612064660068374,524288 --field-trial-handle=2480,i,793307464930358715,11473290103074715469,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
    3⤵
    PID:4336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,17696978651212772302,13230059494182085291,524288 --field-trial-handle=2480,i,793307464930358715,11473290103074715469,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
    3⤵
    PID:4592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,830716753005465811,14499338486825468876,524288 --field-trial-handle=2480,i,793307464930358715,11473290103074715469,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:14
    3⤵
    PID:3256

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4184

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 87641b20387b075a3a4ee90cef494b7b8ed6fe046c2fcc84f50fdbc77ab56e6d
MD5 80a021a6bdf6fc36e617f80ea8d30b00
SHA1 9944961eeb4dd23c38082ca9f7d4875630b7d643
SHA512 08b1a2ee6ed787856dc49528dcc13728ed67a58e20a908ec1e937664a9e87918b883f3b4cf3f95f727b41c92c4136216491c623b63ab5ae2dd76c3fd64791f1e
SSDEEP 192:pRmuoQa6Ov7OlvAPRp2u9sHsb+WNn5ZP6eleOWVyIsnAUgR:pRmuoN6qe6XBqwLP6SuR
TLSH
T10222941AAD14A53B6CCBD22AFD717753E7F5102226D02E84E6FC8A6C12E79CD2317417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 e44cfcb388ad1fce6b79e1c878671f99844c39d58768226e131191178048255a
MD5 6221187fb04a343e9da733cd795b0c9e
SHA1 f389a3cde120bc8c96f7bafb2a77790af35b95c4
SHA512 1d20014f502b992fc950a26f1abad0b6fc634686a41c25eb052d6e7d8b3600c489449fb1dc804e316f19dca36323999efd11268dd5165abc4c0be36d0900a373
SSDEEP 192:eOl4K66E7KxkXqK4I40pUZNCgVLHrKHfFKslE5WMXzKD/bC+ErUkKN9NognF+S3J:vljpE7KxkXqKf/pUZNCgVLH2HfgslFMG
TLSH
T13732E917A88D9A7F4FD8D54DCC136F4BADB5029773780C2492FB5D0803A678E224A1A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 4dbff91ca7b9e9163ff663cd970b008329ef64eee07ac5821c522b501baf045e
MD5 59c3fddb178271db2513296ac57e052b
SHA1 dd2c1cec368d6e2b4119a0378ca20dade26e5cf6
SHA512 c58c5f6f9488be4c61dd69aa1a03ce7c2cae389d67858b2baee0e2cda9a9116f5dd0b08d43e34562f189721b17bc57d049515957b2d915d487e61fa9142497ca
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OEnVumWnmG7:1nbZeMrv/hGtEKnmG7
TLSH
T1C1D3864B3A743102EDE59A722CE051BB5E3CB16D4F1595D428B720688EF2963A23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 fabf933d11e1b07a548f38f2f7b4d6defa8a67de2023851b3e72dbbd328f611a
MD5 74f22c87a63d60db4b61db8583b6c78f
SHA1 d102ff146522675e5680832474b0a1c21b018b7f
SHA512 a466a9c636509b46dc7ff4265db5e7d83b9acb500f19798895336d33b2d09711e4ddba29f8710ed979e15fcb4907f83a2654ed3f4ea450eb88344f8d01ab7718
SSDEEP 96:/C6Gd+d6+YqlHQS6tfaczygHn7fORDotok5XRDuB6OdGyvuXvZ4ybhvv4a:/Cpq6+Yq2S6Fyon4DUDROZwVZ4ybhL
TLSH
T1C8A10972A87ADD7759B7D48879827E03CFA9626B66216F84A8DD0F0C52F70EC0303613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 6bf6e53e1709e8927671a3888277b88fbd531c22f04543329147926b05e1d285
MD5 b537acb08e6ee824123be482523d03bb
SHA1 29eb08d0ea07ac85b78d92a6d71ca941057b52f8
SHA512 f20d58e799db24c839d75102f1321b759804b629d17b864898deff6907df4482a9389ae9f8ba68f23175424a1fac49a7a8956fa6f9366cd8edf35b0dd9c2600e
SSDEEP 96:jC6ed+d6+YqlHQS6tfaczygHnIfOSl8h4otop5XMDuB6QJGyvumdBx1Qzb1/B4JC:jCdq6+Yq2S6Fyon/iU2KO4gdBElwao4J
TLSH
T150C108B2A87DED7365F3E099B4433E83CEE5616B66602F549ADE0B0D12D74EC1342623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b2d903efec8d558eba6ee4ac12873ce1439014705e9d819ff4dfcffa10c4b270
MD5 d9964ad138b9b56ea7891b8576b8a6ce
SHA1 e8153c0a553b8b81a07f1bbc77037f1700b79956
SHA512 7028c8597edeb715bb44be72ae48ceb181161e73b5380897f449df22a8c2b5302f664d632f2373c4c7a712d85a4b0ca70a4a062d6af265eefcac45dd99a660f1
TLSH
T1FCD092A4BB40EC0ECA91287B25B69A19B6409831BC56061A8966B0F88C517831A1B0EE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1d0eccd9de1dbbf6cbedcb541fa52903c78d66d4d260136bc73243b056beb74
MD5 12c06f300a4b88646d6fda378a48455e
SHA1 86d58840d0666ad8999198dad1983a8cfd61fd18
SHA512 76e813720fc8cd4d829570b1b32d711d2d751540dea1fcac581dd9a5963c4e3161cffa07350cc8d5477fa02d0eb7b1c29b8ffb567f85b5a94259654ff2af3928
TLSH
T118D092A8BB40ED0ECA91287B25B59A19B6509831FC56061A8866B0E88C517831A1B0FE
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 03a2a69b07d80ddeff98a0a33b25e407da5b79de49869f871b7b9533dce47160
MD5 10e1156103e3d568d465ad587c262854
SHA1 552207f059ff4d215ed8829775015353e70ad0d2
SHA512 0f859702ce554c50da9bef4f308a5a340a6423e329f4b6f80cb83888d6599630005e4fd47abf19eb7e6d151114a935ba3e8dc53442c0c3ef10eaec562724c26f
SSDEEP 192:sxRtRDiyM/jK1Ml8wCM/ftsso83rgdxzoA8pi/g6+WNIYnotyGqIgtJ:sxRtY8M/ftssPkGi/5IT83
TLSH
T1D252D9156A38997BCCDBD219FA557F53D6F81463A2901E44AAFC8A0C01E7ADD2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 6b26a5751f3ea5c9125b8f7f6e89e14f1903cdf99b2c948d2b8aed496b863dcc
MD5 b674d23988a405c52efbb8c2dae67fed
SHA1 6e04f4492dff84e38576cb0d1025dc0081ecf5bd
SHA512 41d5dc1e126f60328ceb8dc5fffee781e3780ef9b99cf17cdb3f82102fb9d317a8fcfbf136dd2ee82573bba3f3cec7ce8eca6a181235ba0a9d2a2c9ac22cb4b8
SSDEEP 768:Jl6hhs7pLuL7b2WgqcfHw8F1+UoAYDCx9Tuqh0VfUC9xbog/OVnV3XgucroMuXBo:Jl6hhQE7b2WgqcfHwu1jaQV3QuHMuC
TLSH
T132E2EC3B780CCB7E4F804E9CEC29799A6DE801CB96D8CD5447FA894C03C66EB511A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 a6ca7f5d84b70c2bc9a89ed8f2fce3aefbe44d558d2a9915312cc74bfcc56df7
MD5 127f94117d744ceb5c7f64fb99b5e13f
SHA1 d99de8a301499c89dba8ec27889de3d99612c3a9
SHA512 afa04a7c383d95cb6deed314f3e59c8bf5597b9f5781afb093a72ad885d2009bda4d95a974d63a523adc4e6ac7ecb36ddb4281c7a6822db74661641caf7c0b23
SSDEEP 384:DNrRZyCSDnxTICrMEhIKyll7svbFKfk7:xFZJSDni5yI1l7svbF9
TLSH
T18344850A7B747001EDE6D9721CB080771E3C716ECF26A6916DA254698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b62742f3af3cc9582321d0051e05ad4a57d68c0afaec96867c1e5c839acc927e
MD5 5f7ea922cdc4ad8ca7f3f6403a3944c2
SHA1 0fea066e623cfd52561a72c4e8ca86f9322ebf50
SHA512 ba1398bd1462ee5942aff9d785a5ad751dce707c586a55c95f78fe8558ff81f899916a16389f61dcc9092fe68fff3aac8b9caa0b3197a78961a1cd374a555158
SSDEEP 768:Vj+9M3AcYreNSLfpfsnX7DGFzoqPcNMCNFxMj2p:g9M3ipfpfQ3WkqPaXtp
TLSH
T16AF2BEB5AC6058674DE2CA89BB1A374BDFE0126341C41A54DDED6F0E47CB2AD0307D3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e0e3473942b406d6fc1323a5f589061f47fbf6a9337f30a7b7bbada580bb28a7
MD5 5901fdec0e999b7986c7cb322d3da7f1
SHA1 d5e0483c62252f414d4951f6ba483f5c508678d6
SHA512 53b869ef55512e112b2bfc29a388d825c564c81ab94a984ced8133f470028742096a5be724d9187095d2bd8621ac6eb847deabf021854cab99e66bf85b7dfaf0
SSDEEP 768:Vrv+4UNbda3cKYreNSLf0X7DGFzoqPcNMCNZQeVH1SkM:Vbsb434pf03WkqPaSEH1Y
TLSH
T12003BEB6ACA445374CE3C6C9B71B3607AFF4116746840B94D8ED2F0E879F5AD130BA26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6d2654d-02bd-417f-a32b-ff42f3f183cc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e6d2654d-02bd-417f-a32b-ff42f3f183cc.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

1b3a25da

Path C:\Users\Admin\AppData\Local\Temp\97419cf2\1b3a25da
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3788_1747827954\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5020-120-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-99-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-55-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-51-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-56-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-53-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-65-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-74-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-79-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-94-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-101-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-110-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-130-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-138-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-137-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-136-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-135-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-134-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-129-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-128-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-127-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-126-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-16-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-119-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-118-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-117-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-116-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-115-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-109-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-108-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-107-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-106-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-105-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-44-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-93-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-92-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-91-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-90-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-89-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-77-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-76-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-81-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-80-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-78-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-75-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-64-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-62-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-17-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-15-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-14-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-13-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-7-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-11-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-12-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-10-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-9-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-8-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-6-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-5-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-4-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-3-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-2-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-1-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-0-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-54-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-52-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/5020-2373-0x0000000410000000-0x000000041021A000-memory.dmp

Download