995e1922aadf762ca778eb66ff50daca513d7a7771bee7dbd44e862c8ff27640

Analysis

max time kernel
149s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 00:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
983bc1af.exe
Size 3.0MB
Sample260710-ag29msbs2l
SHA256 995e1922aadf762ca778eb66ff50daca513d7a7771bee7dbd44e862c8ff27640
MD5 af1f196d64f050b4a1026b46d87368d5
SHA1 5d20c1d89c37f35e566090aaf09507c6e468ad89
SHA512 15ee2455c4e80d5c46bf93c69d642ec355fddaedb51a7d3f2ba69ad743f5c16ef862516fb49a092d7c1cbf12fa212598836c1121a4e40d2dc818367808caf510
SSDEEP 49152:QEF/vszjIzMRQRikct1flwPMc46dKQHxtGLKU47:QEVeXkcz9wEcTtxs0
TLSH
T17FE58C07BC9149F6C46AA23149B762A1BB75BC485F3633D32E90B3382E727D06C75B94
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery persistence spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 22 IoCs

description	pid	Process	procid_target
PID 3184 created 3172	3184	983bc1af.exe	86
PID 3184 created 5564	3184	983bc1af.exe	87
PID 3184 created 7132	3184	983bc1af.exe	90
PID 3184 created 6564	3184	983bc1af.exe	88
PID 3184 created 6872	3184	983bc1af.exe	91
PID 3184 created 4508	3184	983bc1af.exe	92
PID 3184 created 6624	3184	983bc1af.exe	93
PID 3184 created 3172	3184	983bc1af.exe	86
PID 3184 created 3172	3184	983bc1af.exe	86
PID 3184 created 7132	3184	983bc1af.exe	90
PID 3184 created 7132	3184	983bc1af.exe	90
PID 3184 created 3700	3184	983bc1af.exe	107
PID 3184 created 1868	3184	983bc1af.exe	108
PID 3184 created 7148	3184	983bc1af.exe	109
PID 3184 created 856	3184	983bc1af.exe	110
PID 3184 created 2112	3184	983bc1af.exe	111
PID 3184 created 7136	3184	983bc1af.exe	113
PID 3184 created 1476	3184	983bc1af.exe	114
PID 3184 created 3700	3184	983bc1af.exe	107
PID 3184 created 3700	3184	983bc1af.exe	107
PID 3184 created 856	3184	983bc1af.exe	110
PID 3184 created 856	3184	983bc1af.exe	110

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
46	1416	rundll32.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\UravoxReloader\Parameters\ServiceDll = "C:\\ProgramData\\LRNCorp\\Journal\\Folio\\xqtwrk.dll"	rundll32.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\UravoxReloader\ImagePath = "%SystemRoot%\\System32\\svchost.exe -k KngGroup"	rundll32.exe

Executes dropped EXE 1 IoCs

pid	Process
3396	4b3775f2.exe

Loads dropped DLL 1 IoCs

pid	Process
1416	rundll32.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3184	983bc1af.exe
1416	rundll32.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
7132	chrome.exe
856	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	983bc1af.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	983bc1af.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{93787C95-3EF4-4582-AF00-49DE139342D1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
3184	983bc1af.exe
3184	983bc1af.exe
3184	983bc1af.exe
3184	983bc1af.exe
3184	983bc1af.exe
3184	983bc1af.exe
3184	983bc1af.exe
3184	983bc1af.exe
3184	983bc1af.exe
3184	983bc1af.exe
3184	983bc1af.exe
3172	chrome.exe
3172	chrome.exe
3184	983bc1af.exe
3184	983bc1af.exe
3184	983bc1af.exe
3184	983bc1af.exe
3184	983bc1af.exe
3184	983bc1af.exe
3184	983bc1af.exe
3184	983bc1af.exe
3184	983bc1af.exe
3184	983bc1af.exe
3184	983bc1af.exe
3184	983bc1af.exe
3184	983bc1af.exe
3184	983bc1af.exe
3184	983bc1af.exe
3184	983bc1af.exe
3184	983bc1af.exe
3184	983bc1af.exe
3184	983bc1af.exe
3184	983bc1af.exe
3184	983bc1af.exe
3184	983bc1af.exe
3184	983bc1af.exe
3184	983bc1af.exe
3184	983bc1af.exe
3184	983bc1af.exe
3184	983bc1af.exe
3184	983bc1af.exe
3184	983bc1af.exe
3184	983bc1af.exe
3184	983bc1af.exe
3184	983bc1af.exe
1416	rundll32.exe
1416	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3700	msedge.exe
3700	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	3184	983bc1af.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeDebugPrivilege	1416	rundll32.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3700	msedge.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 3172	3184	983bc1af.exe	86
PID 3172 wrote to memory of 5564	3172	chrome.exe	87
PID 3172 wrote to memory of 6564	3172	chrome.exe	88
PID 3172 wrote to memory of 7132	3172	chrome.exe	90
PID 3172 wrote to memory of 6564	3172	chrome.exe	88
PID 3172 wrote to memory of 6872	3172	chrome.exe	91
PID 3172 wrote to memory of 6872	3172	chrome.exe	91
PID 3172 wrote to memory of 4508	3172	chrome.exe	92
PID 3172 wrote to memory of 4508	3172	chrome.exe	92
PID 3172 wrote to memory of 6624	3172	chrome.exe	93
PID 3172 wrote to memory of 6624	3172	chrome.exe	93
PID 3172 wrote to memory of 4588	3172	chrome.exe	94
PID 3172 wrote to memory of 4588	3172	chrome.exe	94
PID 3172 wrote to memory of 4620	3172	chrome.exe	95
PID 3172 wrote to memory of 2484	3172	chrome.exe	96
PID 3172 wrote to memory of 4580	3172	chrome.exe	97
PID 3172 wrote to memory of 2484	3172	chrome.exe	96
PID 3172 wrote to memory of 4580	3172	chrome.exe	97
PID 3172 wrote to memory of 3484	3172	chrome.exe	102
PID 3172 wrote to memory of 6580	3172	chrome.exe	103
PID 3172 wrote to memory of 3484	3172	chrome.exe	102
PID 3172 wrote to memory of 4196	3172	chrome.exe	101
PID 3172 wrote to memory of 6580	3172	chrome.exe	103
PID 3172 wrote to memory of 4196	3172	chrome.exe	101
PID 3172 wrote to memory of 5812	3172	chrome.exe	104
PID 3172 wrote to memory of 5812	3172	chrome.exe	104
PID 3172 wrote to memory of 5624	3172	chrome.exe	105
PID 3172 wrote to memory of 2460	3172	chrome.exe	106
PID 3172 wrote to memory of 5624	3172	chrome.exe	105
PID 3172 wrote to memory of 2460	3172	chrome.exe	106
PID 3184 wrote to memory of 3700	3184	983bc1af.exe	107
PID 3700 wrote to memory of 1868	3700	msedge.exe	108
PID 3700 wrote to memory of 7148	3700	msedge.exe	109
PID 3700 wrote to memory of 856	3700	msedge.exe	110
PID 3700 wrote to memory of 7148	3700	msedge.exe	109
PID 3700 wrote to memory of 7148	3700	msedge.exe	109
PID 3700 wrote to memory of 2112	3700	msedge.exe	111
PID 3700 wrote to memory of 2112	3700	msedge.exe	111
PID 3700 wrote to memory of 7136	3700	msedge.exe	113
PID 3700 wrote to memory of 7136	3700	msedge.exe	113
PID 3700 wrote to memory of 1476	3700	msedge.exe	114
PID 3700 wrote to memory of 7136	3700	msedge.exe	113
PID 3700 wrote to memory of 1476	3700	msedge.exe	114
PID 3700 wrote to memory of 1476	3700	msedge.exe	114
PID 3700 wrote to memory of 1496	3700	msedge.exe	115
PID 3700 wrote to memory of 1376	3700	msedge.exe	116
PID 3700 wrote to memory of 1496	3700	msedge.exe	115
PID 3700 wrote to memory of 1376	3700	msedge.exe	116
PID 3700 wrote to memory of 4780	3700	msedge.exe	118
PID 3184 wrote to memory of 4112	3184	983bc1af.exe	121
PID 4112 wrote to memory of 3396	4112	cmd.exe	123
PID 3396 wrote to memory of 1416	3396	4b3775f2.exe	125

C:\Users\Admin\AppData\Local\Temp\983bc1af.exe
"C:\Users\Admin\AppData\Local\Temp\983bc1af.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3172
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb9e88c728,0x7ffb9e88c734,0x7ffb9e88c740
    3⤵
    PID:5564
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1656,i,17829789885814097074,9891204572382131495,262144 --field-trial-handle=2040,i,11119984708677198964,9998761845815053312,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:2
    3⤵
    PID:6564
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1500,i,9791422317166664661,17575832574574475925,524288 --field-trial-handle=2040,i,11119984708677198964,9998761845815053312,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:11
    3⤵
    - System Time Discovery
    PID:7132
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2284,i,1939334274286098671,14721689654840427364,524288 --field-trial-handle=2040,i,11119984708677198964,9998761845815053312,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:13
    3⤵
    PID:6872
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3028,i,15382473894045121957,10397559802068116652,2097152 --field-trial-handle=2040,i,11119984708677198964,9998761845815053312,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:1
    3⤵
    PID:4508
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3020,i,2713462767668400852,460233623139857047,2097152 --field-trial-handle=2040,i,11119984708677198964,9998761845815053312,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:1
    3⤵
    PID:6624
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4620,i,3909196318366369100,15221524251740399075,524288 --field-trial-handle=2040,i,11119984708677198964,9998761845815053312,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:14
    3⤵
    PID:4588
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5360,i,932389679210266591,3395557325827304140,524288 --field-trial-handle=2040,i,11119984708677198964,9998761845815053312,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:14
    3⤵
    PID:4620
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5428,i,4350572569484175099,1255240452869996882,2097152 --field-trial-handle=2040,i,11119984708677198964,9998761845815053312,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
    3⤵
    PID:2484
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5468,i,4934825323404072209,9653341476391575371,2097152 --field-trial-handle=2040,i,11119984708677198964,9998761845815053312,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
    3⤵
    PID:4580
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5644,i,18291034051206861407,11663042588807188459,2097152 --field-trial-handle=2040,i,11119984708677198964,9998761845815053312,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:1
    3⤵
    PID:4196
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5540,i,10326057052646423015,915756059780447032,524288 --field-trial-handle=2040,i,11119984708677198964,9998761845815053312,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
    3⤵
    PID:3484
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5832,i,6480403016906107855,11064364845488857733,2097152 --field-trial-handle=2040,i,11119984708677198964,9998761845815053312,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:1
    3⤵
    PID:6580
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5956,i,2036414044197608105,16768462117922903122,524288 --field-trial-handle=2040,i,11119984708677198964,9998761845815053312,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:14
    3⤵
    PID:5812
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5524,i,10460634283482095782,11556028012770562740,2097152 --field-trial-handle=2040,i,11119984708677198964,9998761845815053312,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:1
    3⤵
    PID:5624
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4716,i,412477088728844073,1835897144662158359,2097152 --field-trial-handle=2040,i,11119984708677198964,9998761845815053312,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:1
    3⤵
    PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2e4,0x7ffb7203c188,0x7ffb7203c194,0x7ffb7203c1a0
    3⤵
    PID:1868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1688,i,13272760374850278675,14191333147678108825,262144 --field-trial-handle=2396,i,1845914769350381215,1431677215583573404,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:2
    3⤵
    PID:7148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,12108139143439142740,13877221841676423556,524288 --field-trial-handle=2396,i,1845914769350381215,1431677215583573404,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:11
    3⤵
    - System Time Discovery
    PID:856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,4551270690852763289,15773499361846855170,524288 --field-trial-handle=2396,i,1845914769350381215,1431677215583573404,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:13
    3⤵
    PID:2112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,1935943426072864631,12314961034626735684,2097152 --field-trial-handle=2396,i,1845914769350381215,1431677215583573404,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
    3⤵
    PID:7136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,7891732924468816077,11681310857738894325,2097152 --field-trial-handle=2396,i,1845914769350381215,1431677215583573404,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
    3⤵
    PID:1476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,14236257764080784708,12038184352147254968,524288 --field-trial-handle=2396,i,1845914769350381215,1431677215583573404,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
    3⤵
    PID:1496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,5826527032250816691,14167258792711301634,524288 --field-trial-handle=2396,i,1845914769350381215,1431677215583573404,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
    3⤵
    PID:1376
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,8963178939317154410,10539772077137533292,524288 --field-trial-handle=2396,i,1845914769350381215,1431677215583573404,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
    3⤵
    PID:6996
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,8963178939317154410,10539772077137533292,524288 --field-trial-handle=2396,i,1845914769350381215,1431677215583573404,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
    3⤵
    PID:4780
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c start "" "C:\Users\Admin\AppData\Local\Temp\3e8378d3\4b3775f2.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Users\Admin\AppData\Local\Temp\3e8378d3\4b3775f2.exe
    "C:\Users\Admin\AppData\Local\Temp\3e8378d3\4b3775f2.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3396
  - - C:\Windows\SYSTEM32\rundll32.exe
      rundll32.exe "C:\ProgramData\LRNCorp\Journal\Folio\xqtwrk.dll",NotifyEvent
      4⤵
      Badlisted process makes network request
      Server Software Component: Terminal Services DLL
      Sets service image path in registry
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5680

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:952

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xqtwrk.dll

Path C:\ProgramData\LRNCorp\Journal\Folio\xqtwrk.dll
Size 419KB
SHA256 c534f6c52bae1dcb741e40ce901c373c7dc2e0e0b93d9899aead51a01b3dd896
MD5 714ded17bb5065d10b2f995361814d6f
SHA1 46d6203f1aec3b891d1a3b4050f5df9c4782ba28
SHA512 81878a4d198ee7f48e760feb4c80053ba8572947733cb9c77c18b27f690b78423a12ba5ffa499a7604a5ee1e1663b9e6ff1b0db4fb736e4bf7d6de59d857a8ea
SSDEEP 6144:A+NKAakyo3uUl3oVPhqVqNdtsjlDlf3lwc5zpHIv/pTBguWAxvTwBBLXOWI:A+NL/yo3uKUPhEqmt7p8pTB3BsXO
TLSH
T10394F599F1439EE0C8EBC337965A1267A5FCB80413349E3BABCC65781D40234B6297ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0bec5b08-4c91-4984-b5a9-442fee20621d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0bec5b08-4c91-4984-b5a9-442fee20621d.tmp
Size 10KB
SHA256 961782935279e9501b9f12ce526c26160d62ab5517baa42f6d8d89043fe9dbdb
MD5 3cc2c402f51aabc61cba0cc5d52f32db
SHA1 b367168d9d91d9ccaa191a7d10cdf7390fd7e567
SHA512 56b01de9398d7244aae7c0a2bfadf5ed54b6a5fd4a0c4888ff6961486974ab21c8bea4a77bff2a96ce657c1aeec0cb107840be43aa4dd9c435e36423d63f13cf
SSDEEP 192:+RzBRYTv7FTvAPRp2c9CHsb+WNnsp9I2tjVyIsnAUgR:+RzBqr5T6Xfkw2I23R
TLSH
T11722716FB954697BADCBC229F9617B93E3F5102232E42E84D7F88A2C15D75CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8c98f685-f42a-43e0-8dc0-82fd310b82f3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8c98f685-f42a-43e0-8dc0-82fd310b82f3.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 ac8649953f948bedc77c0d8513c7ebe2d624a7b03c76aad7019a425b3f98aa1f
MD5 0ca268d7f26fb450a0a89da3e078af5a
SHA1 057dcadef7c113c82cde49234a88e2fa6d1b2ee6
SHA512 e4fb88f15f7835d4f4bb0744f88ecb969c611dc20fa2682f27e9522bc1b16abe398510020ea9fe02ec02a5d482d34f6f3d4da91fab393e70baa4f222c99a1f6f
SSDEEP 192:eI/4K6kC7KxkXqK4I40pUZNCgVLHrKHfFKslELQmXzKD/Fc+ErUkKN95nQ1XdSGO:B/jbC7KxkXqKf/pUZNCgVLH2HfgslNmm
TLSH
T1C432C827948D9A3F4FD8D91DDC126B4BBCB5029632780D2497FB5C0803A97CE214A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 d9ca47b7c8fa42c00976549f054038ac0152fcb71ac097971a46b3c07077a404
MD5 55c021e57f7644010720955a386fca13
SHA1 dd5b71bfcc609672e3c7a1efbc0d9a1f11cd45f0
SHA512 9a2a688837f98e25ad8c7a59660ff1d3de143340cba6c7126088929dc58cb1af10c526665373ba630441b50ecf516b01cd15d817d0ac92b38bfe1a91048b0ffa
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2Olenln5xn61VumKn1nfnUna4:1nbZeMrv/hGtlenln5xnfn1nfnUnP
TLSH
T123D3974B3A747102EDE59A721CE0517B5E3CB16D8F55A5D438B620688EF2823A23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 db3af1ceb6e58fb75d97bad94de04fe6d94e34dcc3550290af94542f07915fb3
MD5 3deff0f883a8bfb7eb80d811b25286d9
SHA1 c8a3e47cc00fbe8eb5e7717d979805a5905e0f78
SHA512 2e6c394053a3a978eb64dfd9944236ab4ec2d1bf729de5cd28ffc8d2547f458c67058e9a4745de74bdeadf858db4b91ff517166b9107a3b35088aff009bbc4a2
SSDEEP 96:MkC6ed+CNkx/Fc5vBh2F8vIfjnNA8Xsr6RDotok5g9VDNB6xGyv1T5wqbKv4a:MkC11N2c6AGDDUDgLT1U5wqbU
TLSH
T16EA1F732686E9C7388B2C548B5522F43DEB8712BB521AF98E6ED4B0C11F74EC2381517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 f2df9d474c511bf0852fee75611d2d6d5a6dce0c6e62274d98429a56d90b0d4f
MD5 36d0dca0725f24e5c96ab1136536ab92
SHA1 fb8f35ce2f70beece9204a6762f0e900a1da9def
SHA512 e2c5a4de7d5cf966a85503cf804b2a4ffcc15a8b40096263f067b849ce27ad36075e03710c1199eead27f0da08b60a7338ed52e017a0fc206e6db0d503b7fa60
SSDEEP 96:MWC65d+CNkx/Fc5vBh2F8vIfjnNA8XsrfSl8h4otop5g9BDNB6xGyv1fQBFv1QzO:MWCa1N2c6AG0iU2gDT1wQBF+YLIwZU5c
TLSH
T12AC1F876686DEC3359F3D559B5132B43DEB4613BB651AFA4E7D94B0C02E70EC1382412
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 eb48d80a48946534ec8fb5471845374b87af70b9fa5d2406b0f3ae69aef31947
MD5 f958a4525f378f9737aab59e740e3cb5
SHA1 c9827b502c27500674adbcbd34819a53f7151be2
SHA512 42041e861d3313418de1f17539beb3f86c8682f42642d93e99257cbf713e11e2d3685903d5b820f0bfc3c01816a0d73189033d94fc929d9947a404098bc0f17f
TLSH
T184E02BA6C921BC3769FD1B1860580687EB50131B3B41984B7B3C835C4FF46374687C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 2105f3173a57c43025ea0001861c86305a7c21fd11fd5d930b8e412f768b696f
MD5 9cab4da10e325575eb3abd6d86d4e1a4
SHA1 82b71fb9504807e62236c0bcc1064245bff58159
SHA512 7d717629ba0df96d898dbf7cdf2649f3c98ea1fda9c81567219e22ad6bd4c6f356e018d62f5f064c4b94e13717a8540eef6164afc358a904479ad0cb1825307e
SSDEEP 192:sxRQRSyMqZjK1Ml8wCN/fqsouZJNRZRI1DzoD8pw/g6+WNIYcC4ClsGQYGwIgjsJ:sxRQ38N/fqsDHN/RI1bw/5IW4gsGQIjQ
TLSH
T10862E9166A288D7B8DDBD219FA557F93D6F81163A1905E44ABFC8B0C04E76EC210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 72d99b90d9eae481e1e2da2749eb154370d7ea74e67d45f468d2b26f93206c3c
MD5 124e92aa1658506c1cb8f41edd19bffc
SHA1 64b5902d669411c45271027f6f262e6728ccb7d3
SHA512 c6787caf1ee18bdf0a089398f8adb1f920e8503d79ec657882d58c30d744cbbbfc7311f9350be0e792f773205bcc6d09bc3cfa366d679ede54cab7ce4cb99403
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDobbDwzroi4w:Ob4YZnE7yTWg1NfwBu1jasobHwANw
TLSH
T11CE2FC3B280CCB7E4F804ADDEC29BD9A6DA801CF5AD8C95447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 bd6d4a62b3be61e1b9a13ee90b75f0e385614d450ba8206a135fbb9c888725e0
MD5 dcca8887fe2c74c01253e33317abfb89
SHA1 91aa52e561382efd98703bfca93f1f2e7d223bb2
SHA512 60029dcd9feb14c4d82e4d0b855fa2f51a81c1d6ace571394784e4959d78d1cb47384d22aecd781629793d7a2c6162bd1a5b7cf9b5e29de127c03888c03abf9c
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9h7c:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRn
TLSH
T120B24B11713F4680387EB91C9178981ED6C2B4A37419E52F7BA802A65F67E039DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 7017f39a7eb02510f42b52e22b5aa2da0e4a434d4c857c00546a1182b0467001
MD5 a3e7356c9a61bd051543ef94a49d1827
SHA1 b54ac687ccb598a3cca1c18ebeed55ded8d97c35
SHA512 89c49674ea3952f4231a1b4469c1212012f6544db3dc0a14b9af9b8967dbb3add56576d40a6eaad6ba79d66746b8569e3a2298e0ea773ed183d82d264f3263f9
SSDEEP 384:DNrRZyCSDnxTICfMEhIKyll7svbFKfk7:xFZJSDniByI1l7svbF9
TLSH
T11B44850A7B747001EDE6D9721CB080771E3C716E8F22A6D16DA254694EB3853A63D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 67b4121ec720c886ad7862bf1a3fa37203f2ca562e9e4ed497dd26ac6f5539f8
MD5 a69981659eb8e947b03ea5400dfa74fc
SHA1 66123f53afd3b20a55f11a3128c1ac22054e7996
SHA512 1e278f54411de58bca165cd497b65deae1b3c63bb56acd03395ec86eb679112464b2185e9d422a44ae7d6ab72bbc5005e95f40b2c7eca5c8279d9d75587eb504
SSDEEP 384:nniF1tNn/s3n9Sn8NLX8TUNTUlIR8PvuT5BREqfbYG8oqGqrUkQDVcl1lIO7w/y0:iF1j+9SQXwgeufUG8DGUtQDVcLCO7w/b
TLSH
T185D24A32D865CEB7ECE64FD9B60A7A4ADFE4516385DD49D4DAC91D0D00CB29E030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 52f2a56c7186b90c5c20b1f28cd1f6cc81632e720f87a8ce813f63c4e0fd709e
MD5 8476930e27a66a9dea4a3bef16aa0df7
SHA1 3edef956f728636dad9ce0e0f4b2977c2962989b
SHA512 75714b5a25cb350e9f7687b0cb7482d09ac9e5a3514ac80c892abdea02f91821ce52052bbdc08c2ff5da6e12cc762f4015c7794b461beaddcd8a57b19da04cf3
SSDEEP 384:nhiF1tNn/s3n9Sn8Ngc8TUNTUlIRzPvuTu5REqfbYG8oqHLiOObjI9G6w7aijh83:IF1j+9SXcwgJuQUG8Dri29MaWa
TLSH
T19AC25A36EC55CEB7EDE64F98B70A7A56EEE0126385D85AC4DAD81E4C00C71ED4307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

44917396

Path C:\Users\Admin\AppData\Local\Temp\3e8378d3\44917396
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4b3775f2.exe

Path C:\Users\Admin\AppData\Local\Temp\3e8378d3\4b3775f2.exe
Size 18KB
SHA256 5d069776492eea1f079ce296a6cacb9a684cb9f7dab69c3ff8d99c586c34d50d
MD5 9eea60bb676096a244a0f45f676bb3db
SHA1 f9d358cb2b213d060a35d84fd2c4c33c9ac30d12
SHA512 b207204a406f1a64ab323b0db8030c9ae5b4a63e21f7fa4759d72c4455cfc5da42a164dd133998ba10f0c638d628ff150b12dd52afe44297f308fca5d0959f39
SSDEEP 384:O92ZF+2hnLazK9stpNBtV1NyPul1zQM64e/G5ljT:ayhBejtVdcb/0jT
TLSH
T1A8828301E12BAAD4C4D6C336636A52AB15FC7D2022726B7B5BD8A77A0D41370FB503ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3184-137-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-127-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-50-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-49-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-54-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-51-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-55-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-59-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-58-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-66-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-65-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-72-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-74-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-80-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-83-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-95-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-99-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-103-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-106-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-123-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-130-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-45-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-153-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-155-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-152-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-147-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-150-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-148-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-143-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-140-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-132-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-133-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-129-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-46-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-121-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-122-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-114-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-113-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-112-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-105-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-104-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-96-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-85-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-84-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-79-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-70-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-42-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-16-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-15-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-14-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-12-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-13-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-11-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-10-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-9-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-8-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-6-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-7-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-5-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-4-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-3-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-2-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-1-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-0-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-68-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-61-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/3184-2240-0x0000000360000000-0x0000000360228000-memory.dmp

Download