d9013fa366c2460da14ac377b986dc54acaf08633bf4b436157ea74ae15f991d

Analysis

max time kernel
149s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
734f12aafddc4617a3bcae5e56ccbe58.exe
Size 2.9MB
Sample260708-pgvbcsgt9p
SHA256 d9013fa366c2460da14ac377b986dc54acaf08633bf4b436157ea74ae15f991d
MD5 0b8944ac66c79484cc10a68e833e33e2
SHA1 a57b53161ab4a9c1ba00484d6708c67805719c3c
SHA512 b16926f64a1f659965d36b7e0fbf0cbb229e4e1b5fd834bea4227aa02fbc541a1289a288800c13923304c23a18b587a6405a597158b7bf693e8027b40d92e654
SSDEEP 49152:ChW6diw7wMEgr0zDwsWnyLVsq0wY5M3mRzq10dH6dsw4YSWh5Fl9V8zUt:ChpBr8eyD8v951wBSCf
TLSH
T1C5D59D0B7CE148EAD8AA623259B75182BB75BC054F3233D32E90B7382E767D09E75744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 23 IoCs

description	pid	Process	procid_target
PID 972 created 4528	972	734f12aafddc4617a3bcae5e56ccbe58.exe	88
PID 972 created 2040	972	734f12aafddc4617a3bcae5e56ccbe58.exe	89
PID 972 created 960	972	734f12aafddc4617a3bcae5e56ccbe58.exe	90
PID 972 created 5968	972	734f12aafddc4617a3bcae5e56ccbe58.exe	91
PID 972 created 2180	972	734f12aafddc4617a3bcae5e56ccbe58.exe	92
PID 972 created 1536	972	734f12aafddc4617a3bcae5e56ccbe58.exe	94
PID 972 created 2348	972	734f12aafddc4617a3bcae5e56ccbe58.exe	95
PID 972 created 4528	972	734f12aafddc4617a3bcae5e56ccbe58.exe	88
PID 972 created 4528	972	734f12aafddc4617a3bcae5e56ccbe58.exe	88
PID 972 created 5968	972	734f12aafddc4617a3bcae5e56ccbe58.exe	91
PID 972 created 5968	972	734f12aafddc4617a3bcae5e56ccbe58.exe	91
PID 972 created 708	972	734f12aafddc4617a3bcae5e56ccbe58.exe	108
PID 972 created 240	972	734f12aafddc4617a3bcae5e56ccbe58.exe	109
PID 972 created 4728	972	734f12aafddc4617a3bcae5e56ccbe58.exe	111
PID 972 created 5544	972	734f12aafddc4617a3bcae5e56ccbe58.exe	112
PID 972 created 5988	972	734f12aafddc4617a3bcae5e56ccbe58.exe	113
PID 972 created 1032	972	734f12aafddc4617a3bcae5e56ccbe58.exe	115
PID 972 created 5296	972	734f12aafddc4617a3bcae5e56ccbe58.exe	116
PID 972 created 5568	972	734f12aafddc4617a3bcae5e56ccbe58.exe	117
PID 972 created 708	972	734f12aafddc4617a3bcae5e56ccbe58.exe	108
PID 972 created 708	972	734f12aafddc4617a3bcae5e56ccbe58.exe	108
PID 972 created 5544	972	734f12aafddc4617a3bcae5e56ccbe58.exe	112
PID 972 created 5544	972	734f12aafddc4617a3bcae5e56ccbe58.exe	112

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
972	734f12aafddc4617a3bcae5e56ccbe58.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5968	chrome.exe
5544	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	734f12aafddc4617a3bcae5e56ccbe58.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	734f12aafddc4617a3bcae5e56ccbe58.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134279867396041211"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2626306573-1585762579-411806764-1000\{91313440-7DE2-4104-ABF1-6ABE775BD63B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
4528	chrome.exe
4528	chrome.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe
972	734f12aafddc4617a3bcae5e56ccbe58.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	972	734f12aafddc4617a3bcae5e56ccbe58.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
708	msedge.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 972 wrote to memory of 4528	972	734f12aafddc4617a3bcae5e56ccbe58.exe	88
PID 4528 wrote to memory of 2040	4528	chrome.exe	89
PID 4528 wrote to memory of 5968	4528	chrome.exe	91
PID 4528 wrote to memory of 960	4528	chrome.exe	90
PID 4528 wrote to memory of 960	4528	chrome.exe	90
PID 4528 wrote to memory of 2180	4528	chrome.exe	92
PID 4528 wrote to memory of 2180	4528	chrome.exe	92
PID 4528 wrote to memory of 1536	4528	chrome.exe	94
PID 4528 wrote to memory of 1536	4528	chrome.exe	94
PID 4528 wrote to memory of 2348	4528	chrome.exe	95
PID 4528 wrote to memory of 2348	4528	chrome.exe	95
PID 4528 wrote to memory of 6120	4528	chrome.exe	96
PID 4528 wrote to memory of 6120	4528	chrome.exe	96
PID 4528 wrote to memory of 2116	4528	chrome.exe	97
PID 4528 wrote to memory of 2096	4528	chrome.exe	98
PID 4528 wrote to memory of 2096	4528	chrome.exe	98
PID 4528 wrote to memory of 2412	4528	chrome.exe	99
PID 4528 wrote to memory of 2412	4528	chrome.exe	99
PID 4528 wrote to memory of 3972	4528	chrome.exe	103
PID 4528 wrote to memory of 3668	4528	chrome.exe	104
PID 4528 wrote to memory of 3972	4528	chrome.exe	103
PID 4528 wrote to memory of 2884	4528	chrome.exe	105
PID 4528 wrote to memory of 3668	4528	chrome.exe	104
PID 4528 wrote to memory of 2884	4528	chrome.exe	105
PID 4528 wrote to memory of 700	4528	chrome.exe	106
PID 4528 wrote to memory of 568	4528	chrome.exe	107
PID 4528 wrote to memory of 700	4528	chrome.exe	106
PID 4528 wrote to memory of 568	4528	chrome.exe	107
PID 972 wrote to memory of 708	972	734f12aafddc4617a3bcae5e56ccbe58.exe	108
PID 708 wrote to memory of 240	708	msedge.exe	109
PID 708 wrote to memory of 4728	708	msedge.exe	111
PID 708 wrote to memory of 5544	708	msedge.exe	112
PID 708 wrote to memory of 4728	708	msedge.exe	111
PID 708 wrote to memory of 4728	708	msedge.exe	111
PID 708 wrote to memory of 5988	708	msedge.exe	113
PID 708 wrote to memory of 5988	708	msedge.exe	113
PID 708 wrote to memory of 4900	708	msedge.exe	114
PID 708 wrote to memory of 4900	708	msedge.exe	114
PID 708 wrote to memory of 4900	708	msedge.exe	114
PID 708 wrote to memory of 1032	708	msedge.exe	115
PID 708 wrote to memory of 1032	708	msedge.exe	115
PID 708 wrote to memory of 1032	708	msedge.exe	115
PID 708 wrote to memory of 5296	708	msedge.exe	116
PID 708 wrote to memory of 5568	708	msedge.exe	117
PID 708 wrote to memory of 5296	708	msedge.exe	116
PID 708 wrote to memory of 5296	708	msedge.exe	116
PID 708 wrote to memory of 5568	708	msedge.exe	117
PID 708 wrote to memory of 5568	708	msedge.exe	117
PID 708 wrote to memory of 5476	708	msedge.exe	118
PID 708 wrote to memory of 5476	708	msedge.exe	118
PID 708 wrote to memory of 6104	708	msedge.exe	119
PID 708 wrote to memory of 5856	708	msedge.exe	120
PID 708 wrote to memory of 6104	708	msedge.exe	119
PID 708 wrote to memory of 5856	708	msedge.exe	120
PID 708 wrote to memory of 6120	708	msedge.exe	123
PID 708 wrote to memory of 3344	708	msedge.exe	124
PID 708 wrote to memory of 3344	708	msedge.exe	124
PID 708 wrote to memory of 5104	708	msedge.exe	127
PID 708 wrote to memory of 5104	708	msedge.exe	127

C:\Users\Admin\AppData\Local\Temp\734f12aafddc4617a3bcae5e56ccbe58.exe
"C:\Users\Admin\AppData\Local\Temp\734f12aafddc4617a3bcae5e56ccbe58.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4528
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8551ac728,0x7ff8551ac734,0x7ff8551ac740
    3⤵
    PID:2040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1648,i,13766597425214735960,16908013602467088804,262144 --field-trial-handle=1920,i,12398644148910479158,7281742528140360828,262144 --variations-seed-version --mojo-platform-channel-handle=1916 /prefetch:2
    3⤵
    PID:960
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1500,i,9843751197747750730,9962711065875392907,524288 --field-trial-handle=1920,i,12398644148910479158,7281742528140360828,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5968
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2248,i,1177813310264156445,18410790677886924635,524288 --field-trial-handle=1920,i,12398644148910479158,7281742528140360828,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:13
    3⤵
    PID:2180
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3032,i,15957151075203294443,17661147884652931568,2097152 --field-trial-handle=1920,i,12398644148910479158,7281742528140360828,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:1
    3⤵
    PID:1536
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3044,i,15694749335597144153,12366220181678917683,2097152 --field-trial-handle=1920,i,12398644148910479158,7281742528140360828,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:1
    3⤵
    PID:2348
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4608,i,11503300444787670798,2828796796742134529,524288 --field-trial-handle=1920,i,12398644148910479158,7281742528140360828,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:14
    3⤵
    PID:6120
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5396,i,748819795589455581,16620382429184845031,524288 --field-trial-handle=1920,i,12398644148910479158,7281742528140360828,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
    3⤵
    PID:2116
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5496,i,15821406484955506454,10830610063933864865,2097152 --field-trial-handle=1920,i,12398644148910479158,7281742528140360828,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
    3⤵
    PID:2096
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5508,i,290317589567054797,6594567509952521537,2097152 --field-trial-handle=1920,i,12398644148910479158,7281742528140360828,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
    3⤵
    PID:2412
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5504,i,13997657757750749970,7302725631815636017,2097152 --field-trial-handle=1920,i,12398644148910479158,7281742528140360828,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
    3⤵
    PID:3972
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5824,i,12884278538119208310,634722769366242756,524288 --field-trial-handle=1920,i,12398644148910479158,7281742528140360828,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
    3⤵
    PID:3668
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4952,i,17696203298892015272,6288762055367040199,2097152 --field-trial-handle=1920,i,12398644148910479158,7281742528140360828,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
    3⤵
    PID:2884
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5964,i,5067274416760276407,12634001915200718240,2097152 --field-trial-handle=1920,i,12398644148910479158,7281742528140360828,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:1
    3⤵
    PID:700
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6100,i,10913416748061477936,10098773822235369456,524288 --field-trial-handle=1920,i,12398644148910479158,7281742528140360828,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
    3⤵
    PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ff83611c188,0x7ff83611c194,0x7ff83611c1a0
    3⤵
    PID:240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1984,i,17206782556634315792,16947289553663144556,262144 --field-trial-handle=2520,i,16644085711042802684,15375475484598485474,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:2
    3⤵
    PID:4728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2140,i,7631287056965382285,222343027986395537,524288 --field-trial-handle=2520,i,16644085711042802684,15375475484598485474,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,3027457313073748892,5959032989887436558,524288 --field-trial-handle=2520,i,16644085711042802684,15375475484598485474,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:13
    3⤵
    PID:5988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,12203536438590637171,13872691401089866075,2097152 --field-trial-handle=2520,i,16644085711042802684,15375475484598485474,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
    3⤵
    PID:4900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3524,i,11082640025462493033,14673622016070217759,2097152 --field-trial-handle=2520,i,16644085711042802684,15375475484598485474,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:1032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4052,i,8619859473577166338,1295896490775787648,2097152 --field-trial-handle=2520,i,16644085711042802684,15375475484598485474,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
    3⤵
    PID:5296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4064,i,15744269486213372366,8959764302237149710,2097152 --field-trial-handle=2520,i,16644085711042802684,15375475484598485474,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:9
    3⤵
    PID:5568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,6116114985170740990,10231087757768686381,524288 --field-trial-handle=2520,i,16644085711042802684,15375475484598485474,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:14
    3⤵
    PID:5476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3492,i,18120483097915780673,10655189284403927929,524288 --field-trial-handle=2520,i,16644085711042802684,15375475484598485474,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
    3⤵
    PID:6104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,13778974943766577047,13317875989140498616,524288 --field-trial-handle=2520,i,16644085711042802684,15375475484598485474,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
    3⤵
    PID:5856
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,5129450107501845361,402203095002986958,524288 --field-trial-handle=2520,i,16644085711042802684,15375475484598485474,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
    3⤵
    PID:2824
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,5129450107501845361,402203095002986958,524288 --field-trial-handle=2520,i,16644085711042802684,15375475484598485474,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
    3⤵
    PID:6120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,13512222485583903084,15271609628123485412,524288 --field-trial-handle=2520,i,16644085711042802684,15375475484598485474,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
    3⤵
    PID:3344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,15295309503691542731,985584710201301974,524288 --field-trial-handle=2520,i,16644085711042802684,15375475484598485474,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14
    3⤵
    PID:5104

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5036

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 34d812f2779eea6b8ea523073886c9879d25555b87ea0cdeaa4854b4b69c6153
MD5 3d0860edbadf3650dde8a6bee45f9555
SHA1 f29b608bae5e4d390567367fa26d3a02b5b29d17
SHA512 f79280a1589b52bc3bc3bb86778be2ed90742317d17203d105986f6913011b5c1f258d2e2d4e2f63151032f6c0bb92f8372277ebbc96d2c30d836790380dd063
SSDEEP 192:RBRVg9nvHhv78vAPRp2/9vHsb+WNnCXPpGYehQhVyIsnAUgR:7Rq9vHxg6Xk5woP1HR
TLSH
T19422972EAD15653B5CDBD22AFE317753D7F6106121942E84EAFC8A2C12E76CC2327417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 3606fe76b7001513a47bc04adfa9c206c876a42a9380a140a2a9388bfc39e442
MD5 50852a134c9ec9d316a56b405228ac61
SHA1 b5a369978c9167b931ac019906037da3b8d62c03
SHA512 10c81c5080fcd2b3e2e85e9069eb940b5a59986b2104274b1fa6b24bef479f29e253acf78bb6525d5e4c9417da133298c31ed1534e8df2be37cb9fc394c4535b
SSDEEP 192:eNq4K6Hv7KxkXqK4I40pUZNCgVLHrKHfFKslEf17XzKD/cz+ErUkKN9tV2DcUSrd:IqjUv7KxkXqKf/pUZNCgVLH2Hfgslg7e
TLSH
T14432D827A48D9A7F4FD8D509CC536F4F6CB502977278092466FBAD0803A978A114B2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 861801eb972807ed3d4264a30ab7b476e4bd67a73374c5c17eeb8909740a4907
MD5 863ce89a77b8ec5f84eb5163a5b1381d
SHA1 4a135f0cbd39bb00e6f1cec6fd7e8d5aa2931c61
SHA512 5f080a3c94fe34fc1e76c5dcedb3bd53d892ca2ada63e457f50394d484e716078b1ae148e0a5e2ac88c3254cf93fa96e06b3e1a2cb4798fdf92fc89976d25f26
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OKiB1VumlqnRL:1nbZeMrv/hGtKOHqnV
TLSH
T1FCD3764B3A743002EDE59A721CE0517B5D3CB16D8F56A5D428B620688EF2963B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 f4f0b6cf32179c21ed95001ca3d9cba018358bd84f949f17025c12a782cc92b9
MD5 8b11e07afbe39e70a6c8b7f0c7522547
SHA1 5e77aaf83aeee87ea61cd2bc4ab64c43f0f6c240
SHA512 84194cb7b6e084eaea914e02cbc3bac32967eb2a9a8900c62ae368961210de255da47b8f69571d6ce20e6e887e2b8e1c1970604c1d761fb52baa32eb7bb26b9b
SSDEEP 96:cMC6dd+BXK7CXon4efaRN6GRDotok5AHD1B6AdGyvLtWy2OdTFn5v4a:JCubWXon4XRBDUDOL7wz1OdTFn1
TLSH
T12DA1F732A43A9D7398B6D585B9526713DFB47167AA509FC8A9EC0F0C02FB4DC1782B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 c9a7ab3270ab8aebf6dbff7b9589d6025475e68fdce2537f37a9aeb07913b815
MD5 2911dbf5115ab346a3c49cff0b73d6ce
SHA1 27d4fcadd3f07ee0160a22de63d0e16818a67505
SHA512 1c194ec068905e0643e17e66a262d34aa5f1dae199783baefa641c248dc461fce8177dc662d7264334ef7a7d3f683b593348b56988ef73dfc50ae2e109c9c8b3
SSDEEP 96:ceC6Iod+BXK7CXon4efaRK60Sl8h4otop5AyD1B61dGyvLtJjaNrxwkYTywLvdBZ:JCzobWXon4XRyiU29LWw+jcxoT1LvdBZ
TLSH
T155C10972683EAC736AF7E545B5036617DEB4616BAF00AF94E9E90F0D03D74DC1382A12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3f51b0e24e52d8511f72e348c132f84b6b8edb54027a5c8c4fbe2a976322a690
MD5 e32f775acc5ed08adf9d5f6678c2bc4d
SHA1 bd5f4d60c6c8f97a1fed276a8c02ca345e30bb2a
SHA512 2b2fef021516ee5e90b192840780767fff5c147cfb2dfe5b900a8b298d542111707f16c28e265447d090c61e8e091b3529eb29ff376abe03cd34315206805eba
TLSH
T1DAD09B996686AD54DD80343534A1E34B9A18F522102C46488117B064CCA464246561FF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a54d1be6da491be16ecc22dac3ad8cfbe4eabb017451e32c26f2904977fde58e
MD5 9daa45ac0383b3b978ad8da2d5000b62
SHA1 f52083ce5d095366a6fa9406b8b49000fcb53bc0
SHA512 ac55ccfd63460f712cd2ffb1ff656349475683b1ec07abd198254ac469a634f7129cf280de184340d8314fe2b8f7e955f7a112deb1511d52de882ae801a7c1af
TLSH
T17DD09B9D6686AE54DD80343134A1E34B9A18F522642C464880177054CCA464246571FF
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9e2122ca88e73cd4a896dbb2dc342c5faa041fdd909e1823c5265deb42ab9948
MD5 3a6a0aaefe0c10d82a3f5199c037e94e
SHA1 5e57196700cd7333619ffe9d16debc0c1990efff
SHA512 8443299a41aedc3ab807cb961bd9128cb75029f5471d792b137a948a437ab27231a774c34d1a28249e6ee56500448e91cfcf3546940aa2395c67e08fb1713368
SSDEEP 192:sxRpRV4yM/jK1Ml8wCY/fzEsq8FLZv8xVzoA8pi/g6+WNIYDQEGczIgtJ:sxRpPA8Y/fAsqOlv8x4i/5I6L3
TLSH
T15752D716AA389977CCDBD209FA557F53D6F81563A2901E04AAFCCA0C05E76ED1213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 8d95c9f884357a0b852ce7d05691fdf5e5bb7fecf0b5f1a54c2c2a1e50d7ac4f
MD5 0c6dc17abea8e1453a72bdcfb80f5c5a
SHA1 7246106363e39dcecf6e68c015f5478892d998ed
SHA512 93772e7c8e6cce4d90eef4c94970e1f085ee64caf802123e544b51da59511ad028864d70ad882f788f5e5694844fbe49c79d0aaf711bd59350ee8e26f4f178e1
SSDEEP 768:f+4+zH7pLuL7eDWgb/fPI8F1+UoAYDCx9Tuqh0VfUC9xbog/OVBHkIn22ro7h2:f+4+zBE7eDWgb/fPIu1jaaHkw2N7h2
TLSH
T1F7E2EA7B680CCB7F4F404A9DEC29BD9A6DE801CF9698C95447EA880C03C6AEB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 af7aa4f6574903029c3382f0bdd1c4db4e4d56dab8e5c9aa046e0e1ddcb72dfa
MD5 487dbcf5e87d2ad4794a9906d49d6e7d
SHA1 9c66c804bd1914675529a9214289a8c97dc5611c
SHA512 8c0b4aa19b02e8928232af7e217360a724c8b17c691101dfb1b06cca5517a11e34f927dab3c8476fe828557470bd4082cc4bab01fbc74a3bc3f8e31c2bc12db8
SSDEEP 96:KRlyLf1vz3W7gugn3K4Wg53cdF4LDcHEFw0Oy2UWS/fg8UK4Rg2Uc00/uUbxbObe:ClyLf1vzG7gPntWg5sdF4LDcHEFw0Oyo
TLSH
T10E913205753B02C03C7F784980998957D6C2B4E23259B42B7FE842E69B67E018EFEDD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 1bfa1349fc07d6db569ae9e9e6147b0e01acd8771f9fb1153e0ddf26d6ce8da3
MD5 4806af8385b2f9bdb5d582710ef713ef
SHA1 7b61fe707756dfeea52166e4700573a68b1ee565
SHA512 e0a6a9569283ec5292e8ed5fb5f23fd3fb14f35f2aba9d9ad5a852a69fbc0a55971d85ecb7f551dfc54a84459f86fd736af31c79f1b575211dccbecc9f05526c
SSDEEP 384:DNrRZyCSDnxTICl7MEhIKyll7svbFKfk7:xFZJSDni+QyI1l7svbF9
TLSH
T1C744840A7B747001EDE6D9721CB080771E3CB16D8F22A6D16DA254698DB3853A63D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 0e76c5c4b7be12597603f7a216a690dd66f64e268bcb066b9520c7b746efb39d
MD5 0d6413efb630e2770bd22fe1e9d87b82
SHA1 a32b88d90e559baa87956c766ad96c69193f6f73
SHA512 0c16236702a4fb92083beba4a5a3a4a07fca89b2d5ad460189956470c7e6a6c2c6d40523b7f092b6b2f42bf3424a3b1d1dddd1e88201a538609c05edbfc9df2d
SSDEEP 768:5j+9o3FgvwifJBTaHuVboPzkZLNx9OF8MjM:k9o3Fr7HOawZLNqGn
TLSH
T1F9F2AF32B8615D67DEB6C789B20A7B87AFF4116381C01A88CDE86F0D05D76AD1707E36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 df02504713fd878bc830dedbc75a3ebe90529ec21fea0e6865f44e5668fc41f2
MD5 f011f741c549e62105cc89cf12e6f4f3
SHA1 d70fa3591bc39c8f97dbb642d8b6df440a94cdda
SHA512 13c24b7c280955bc2ac68e3478c76ceb7e6298af53406298d981c40be12f4b45eb8ac27d3ebb81bcc2d4ba57a97362fc768bb87314d84778a2318541fc319d30
SSDEEP 768:0rv+4UNbdC31eSwifJGaHuVboPzkZLNx9OZuUik4K:0bsbs31Y6HOawZLNqsUVr
TLSH
T1DF03BF36A8649937CDF7D289B14B7A477FF4111385C40B88C9EC2B4D46AB4AD170BE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1fcf943d-0c03-47e0-ae14-0c9a6f367639.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1fcf943d-0c03-47e0-ae14-0c9a6f367639.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

7a0a36af

Path C:\Users\Admin\AppData\Local\Temp\2d96145c\7a0a36af
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir708_350414209\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/972-113-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-88-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-52-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-57-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-81-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-80-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-89-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-98-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-101-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-119-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-137-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-136-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-135-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-134-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-133-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-132-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-125-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-124-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-123-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-122-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-121-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-120-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-16-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-112-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-111-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-110-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-109-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-102-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-100-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-99-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-97-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-91-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-90-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-44-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-87-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-79-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-78-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-77-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-76-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-69-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-68-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-67-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-66-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-65-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-56-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-55-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-53-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-17-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-15-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-14-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-13-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-12-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-10-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-11-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-9-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-8-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-7-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-6-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-5-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-4-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-3-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-2-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-1-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-0-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-58-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-54-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/972-2417-0x0000000410000000-0x000000041021A000-memory.dmp

Download