fc2153bde60ab4c6963fdf2e5f71f2eee9a50b0be4841a767763aeace733ca60

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/07/2026, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Pro/mpclient.dll
Size 3.9MB
Sample260724-cfbreaeb39
SHA256 fc2153bde60ab4c6963fdf2e5f71f2eee9a50b0be4841a767763aeace733ca60
MD5 2c5de256afdcc5259774dfd1c9acace6
SHA1 a17c67298b9d6c96f3c8da9ada3d3a999d811c5d
SHA512 b160dfd068a5f4fb1019725517e5c569b6f06bb20f915a3ee67c3314c9def5786e4086b2525ea7eb9890185b33b536a7a846d9d77744785e96e823a1f10e16f9
SSDEEP 49152:gfeP8mWIaBsAMpHuDvhX1fBTa2cWuv7Fvx8fIApwBnmT:g0f8F1yRitWnmT
TLSH
T149168D07ECA249B6C0A9B3318CB74252777DBC494B3227D32E61767A2EB27D05C39758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 25 IoCs

description	pid	Process	procid_target
PID 4300 created 3848	4300	rundll32.exe	80
PID 4300 created 1944	4300	rundll32.exe	81
PID 4300 created 4888	4300	rundll32.exe	82
PID 4300 created 2052	4300	rundll32.exe	83
PID 4300 created 1060	4300	rundll32.exe	85
PID 4300 created 5052	4300	rundll32.exe	86
PID 4300 created 4936	4300	rundll32.exe	87
PID 4300 created 4488	4300	rundll32.exe	88
PID 4300 created 3848	4300	rundll32.exe	80
PID 4300 created 3848	4300	rundll32.exe	80
PID 4300 created 2052	4300	rundll32.exe	83
PID 4300 created 2052	4300	rundll32.exe	83
PID 4300 created 6120	4300	rundll32.exe	92
PID 4300 created 4804	4300	rundll32.exe	93
PID 4300 created 5672	4300	rundll32.exe	94
PID 4300 created 1208	4300	rundll32.exe	95
PID 4300 created 2544	4300	rundll32.exe	96
PID 4300 created 5944	4300	rundll32.exe	98
PID 4300 created 2468	4300	rundll32.exe	99
PID 4300 created 5124	4300	rundll32.exe	100
PID 4300 created 5244	4300	rundll32.exe	101
PID 4300 created 6120	4300	rundll32.exe	92
PID 4300 created 6120	4300	rundll32.exe	92
PID 4300 created 5672	4300	rundll32.exe	94
PID 4300 created 5672	4300	rundll32.exe	94

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4300	rundll32.exe
3	4300	rundll32.exe
58	4300	rundll32.exe
59	4300	rundll32.exe
60	4300	rundll32.exe
61	4300	rundll32.exe
62	4300	rundll32.exe
63	4300	rundll32.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4300	rundll32.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2052	chrome.exe
5672	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293325937221600"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2409539145-3342400454-2096821238-1000\{5DC1F597-3263-4C8D-B2DA-A7D391EA2026}	msedge.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
4300	rundll32.exe
4300	rundll32.exe
4300	rundll32.exe
4300	rundll32.exe
4300	rundll32.exe
4300	rundll32.exe
4300	rundll32.exe
4300	rundll32.exe
4300	rundll32.exe
4300	rundll32.exe
4300	rundll32.exe
3848	chrome.exe
3848	chrome.exe
4300	rundll32.exe
4300	rundll32.exe
4300	rundll32.exe
4300	rundll32.exe
4300	rundll32.exe
4300	rundll32.exe
4300	rundll32.exe
4300	rundll32.exe
4300	rundll32.exe
4300	rundll32.exe
4300	rundll32.exe
4300	rundll32.exe
4300	rundll32.exe
4300	rundll32.exe
4300	rundll32.exe
4300	rundll32.exe
4300	rundll32.exe
4300	rundll32.exe
4300	rundll32.exe
4300	rundll32.exe
4300	rundll32.exe
4300	rundll32.exe
4300	rundll32.exe
4300	rundll32.exe
4300	rundll32.exe
4300	rundll32.exe
4300	rundll32.exe
4300	rundll32.exe
4300	rundll32.exe
4300	rundll32.exe
4300	rundll32.exe
4300	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	4300	rundll32.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
6120	msedge.exe
6120	msedge.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 3848	4300	rundll32.exe	80
PID 3848 wrote to memory of 1944	3848	chrome.exe	81
PID 3848 wrote to memory of 4888	3848	chrome.exe	82
PID 3848 wrote to memory of 4888	3848	chrome.exe	82
PID 3848 wrote to memory of 2052	3848	chrome.exe	83
PID 3848 wrote to memory of 1060	3848	chrome.exe	85
PID 3848 wrote to memory of 1060	3848	chrome.exe	85
PID 3848 wrote to memory of 5052	3848	chrome.exe	86
PID 3848 wrote to memory of 5052	3848	chrome.exe	86
PID 3848 wrote to memory of 4936	3848	chrome.exe	87
PID 3848 wrote to memory of 4936	3848	chrome.exe	87
PID 3848 wrote to memory of 4488	3848	chrome.exe	88
PID 3848 wrote to memory of 4488	3848	chrome.exe	88
PID 3848 wrote to memory of 5388	3848	chrome.exe	90
PID 4300 wrote to memory of 6120	4300	rundll32.exe	92
PID 6120 wrote to memory of 4804	6120	msedge.exe	93
PID 6120 wrote to memory of 5672	6120	msedge.exe	94
PID 6120 wrote to memory of 1208	6120	msedge.exe	95
PID 6120 wrote to memory of 1208	6120	msedge.exe	95
PID 6120 wrote to memory of 1208	6120	msedge.exe	95
PID 6120 wrote to memory of 2544	6120	msedge.exe	96
PID 6120 wrote to memory of 2544	6120	msedge.exe	96
PID 6120 wrote to memory of 3280	6120	msedge.exe	97
PID 6120 wrote to memory of 3280	6120	msedge.exe	97
PID 6120 wrote to memory of 3280	6120	msedge.exe	97
PID 6120 wrote to memory of 5944	6120	msedge.exe	98
PID 6120 wrote to memory of 5944	6120	msedge.exe	98
PID 6120 wrote to memory of 5944	6120	msedge.exe	98
PID 6120 wrote to memory of 5244	6120	msedge.exe	101
PID 6120 wrote to memory of 5244	6120	msedge.exe	101
PID 6120 wrote to memory of 5244	6120	msedge.exe	101
PID 6120 wrote to memory of 2468	6120	msedge.exe	99
PID 6120 wrote to memory of 2468	6120	msedge.exe	99
PID 6120 wrote to memory of 2468	6120	msedge.exe	99
PID 6120 wrote to memory of 5124	6120	msedge.exe	100
PID 6120 wrote to memory of 5124	6120	msedge.exe	100
PID 6120 wrote to memory of 5124	6120	msedge.exe	100
PID 6120 wrote to memory of 3024	6120	msedge.exe	102
PID 6120 wrote to memory of 3024	6120	msedge.exe	102
PID 6120 wrote to memory of 3024	6120	msedge.exe	102
PID 6120 wrote to memory of 5392	6120	msedge.exe	104
PID 6120 wrote to memory of 5392	6120	msedge.exe	104
PID 6120 wrote to memory of 5460	6120	msedge.exe	106
PID 6120 wrote to memory of 5460	6120	msedge.exe	106
PID 6120 wrote to memory of 5460	6120	msedge.exe	106
PID 6120 wrote to memory of 5460	6120	msedge.exe	106
PID 6120 wrote to memory of 4892	6120	msedge.exe	107
PID 6120 wrote to memory of 4892	6120	msedge.exe	107
PID 6120 wrote to memory of 5356	6120	msedge.exe	108
PID 6120 wrote to memory of 3276	6120	msedge.exe	110
PID 5356 wrote to memory of 3980	5356	msedge.exe	111
PID 6120 wrote to memory of 712	6120	msedge.exe	112
PID 712 wrote to memory of 1480	712	msedge.exe	113
PID 6120 wrote to memory of 4524	6120	msedge.exe	114
PID 6120 wrote to memory of 4524	6120	msedge.exe	114
PID 6120 wrote to memory of 1288	6120	msedge.exe	115
PID 6120 wrote to memory of 1288	6120	msedge.exe	115
PID 6120 wrote to memory of 3128	6120	msedge.exe	116
PID 6120 wrote to memory of 3128	6120	msedge.exe	116
PID 6120 wrote to memory of 5336	6120	msedge.exe	117
PID 6120 wrote to memory of 5336	6120	msedge.exe	117
PID 6120 wrote to memory of 5280	6120	msedge.exe	118
PID 6120 wrote to memory of 5280	6120	msedge.exe	118

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Pro\mpclient.dll,#1
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Badlisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3848
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0x90,0x108,0x7ffef022c728,0x7ffef022c734,0x7ffef022c740
    3⤵
    PID:1944
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1648,i,6823893880187139414,16292950990104536644,262144 --field-trial-handle=1948,i,50238354978355678,2912988396776175550,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1944 /prefetch:2
    3⤵
    PID:4888
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,17077105113530753554,1256391273430356456,524288 --field-trial-handle=1948,i,50238354978355678,2912988396776175550,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2196 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2052
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2292,i,2797617503360621832,16766647110326643421,524288 --field-trial-handle=1948,i,50238354978355678,2912988396776175550,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2636 /prefetch:13
    3⤵
    PID:1060
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2928,i,8078055683088170808,15051025254639748314,2097152 --field-trial-handle=1948,i,50238354978355678,2912988396776175550,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3080 /prefetch:1
    3⤵
    PID:5052
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2936,i,6574360264979198578,8810484036783854009,2097152 --field-trial-handle=1948,i,50238354978355678,2912988396776175550,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3100 /prefetch:1
    3⤵
    PID:4936
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4176,i,2037910588089211491,17789375591992845230,2097152 --field-trial-handle=1948,i,50238354978355678,2912988396776175550,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4192 /prefetch:9
    3⤵
    PID:4488
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5628,i,5561220385251890681,3995302867751476095,524288 --field-trial-handle=1948,i,50238354978355678,2912988396776175550,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5632 /prefetch:14
    3⤵
    PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffeeb6bc188,0x7ffeeb6bc194,0x7ffeeb6bc1a0
    3⤵
    PID:4804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1716,i,13636212365611449874,1029580207876155289,524288 --field-trial-handle=2200,i,1526926164610736677,1711193778296279315,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1632,i,1976106604294416472,4374862417653166457,262144 --field-trial-handle=2200,i,1526926164610736677,1711193778296279315,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:2
    3⤵
    PID:1208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2164,i,221437312309313939,17430372056659499433,524288 --field-trial-handle=2200,i,1526926164610736677,1711193778296279315,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:13
    3⤵
    PID:2544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,4085338095802925471,14040415221353535737,2097152 --field-trial-handle=2200,i,1526926164610736677,1711193778296279315,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
    3⤵
    PID:3280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,2857925046757049736,15310740345273080967,2097152 --field-trial-handle=2200,i,1526926164610736677,1711193778296279315,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:5944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4032,i,15747067191876172232,7493818056215174314,2097152 --field-trial-handle=2200,i,1526926164610736677,1711193778296279315,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:9
    3⤵
    PID:2468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4060,i,18229709375772973489,14329998141753887768,2097152 --field-trial-handle=2200,i,1526926164610736677,1711193778296279315,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:9
    3⤵
    PID:5124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4008,i,5766431435024148173,15520640733656642390,2097152 --field-trial-handle=2200,i,1526926164610736677,1711193778296279315,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:1
    3⤵
    PID:5244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4020,i,4519786803629479308,15543102727451346499,2097152 --field-trial-handle=2200,i,1526926164610736677,1711193778296279315,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:1
    3⤵
    PID:3024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,17616322737376713465,12736314607695018052,524288 --field-trial-handle=2200,i,1526926164610736677,1711193778296279315,262144 --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:14
    3⤵
    PID:5392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,1651760314356344684,16029137789165631260,524288 --field-trial-handle=2200,i,1526926164610736677,1711193778296279315,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
    3⤵
    PID:5460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,13062658609192074312,4297935413523127005,524288 --field-trial-handle=2200,i,1526926164610736677,1711193778296279315,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
    3⤵
    PID:5460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,17921097216113659497,5833508080042442157,524288 --field-trial-handle=2200,i,1526926164610736677,1711193778296279315,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
    3⤵
    PID:4892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,6689573550809393533,10426520704268494442,524288 --field-trial-handle=2200,i,1526926164610736677,1711193778296279315,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:3980
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,2382677304366737753,1277845803318819306,524288 --field-trial-handle=2200,i,1526926164610736677,1711193778296279315,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:14
    3⤵
    PID:6060
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,2382677304366737753,1277845803318819306,524288 --field-trial-handle=2200,i,1526926164610736677,1711193778296279315,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:14
    3⤵
    PID:3276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,17081847135294003168,8671181849315295537,524288 --field-trial-handle=2200,i,1526926164610736677,1711193778296279315,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=600
      4⤵
      PID:1480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,15716095984141110548,1724188008880732300,524288 --field-trial-handle=2200,i,1526926164610736677,1711193778296279315,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:14
    3⤵
    PID:4524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6968,i,417940105750968991,10725071932442824537,524288 --field-trial-handle=2200,i,1526926164610736677,1711193778296279315,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:14
    3⤵
    PID:1288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,771261777059170743,1779326339553903663,524288 --field-trial-handle=2200,i,1526926164610736677,1711193778296279315,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:14
    3⤵
    PID:3128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6864,i,593102972694695922,122870931688713897,524288 --field-trial-handle=2200,i,1526926164610736677,1711193778296279315,262144 --variations-seed-version --mojo-platform-channel-handle=7272 /prefetch:14
    3⤵
    PID:5336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,4208321234818809778,11636113832454841256,524288 --field-trial-handle=2200,i,1526926164610736677,1711193778296279315,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:14
    3⤵
    PID:5280

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5968

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 93aacd1d107d5ff9e25b10cf4d31c65e63faf7b67623e722c648b32db4461c26
MD5 9a23a24abef1841944688319585747a0
SHA1 d07e2c554c3a1c62dbec97585aa619902a476aba
SHA512 1fdac10b4125206807abfeaeeeae6b7333c7d9af7fbb212cb5d9b46b935cd6b833113e3067bcb7b89df60461be8aad2b07d768598b725fb1602fdf3e0ac6c0b3
TLSH
T1B7E02BBAC951DC6B2CFD0B596025475AE60513573741494B3ABEC20C8FB0A3B96A1C6C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 bac71916f8f6a550f70f37790b2c903c98b7d0061cfa545acdf3c6f2c86840ee
MD5 3f80aa09c4a39999876d06ddb563e97b
SHA1 89bbeafd5cebcbbb338a1d5fe1cc587d2b5f02df
SHA512 1f11d63cdf64c8a5f63cd022a7c37dcd37c52c90b8e0420f7dac771d4cd3b9cfaba5153914af93f1d96ed806f31859a3c11b6c11d672ed421bcc75a10118434f
SSDEEP 192:qRpjthddSCv7lpAPRp2O9+Hsb+WNn0kPiQ72Pe+gaLVyIsnAUgtaJ:qRpjuORUXB0w/Pim2yaN8
TLSH
T1B242B67EED14A97B6CCBC219FA257757D7F5102162842E84EAFC8A1C14E79CC321B05B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c48ea4851d93573421a1f5e92dfdd9c0cc0bbeca9216e615794ab2013501d5f1
MD5 9365e110646fce4577746230e9396c69
SHA1 43e90a5f0d59e1baf6618dc088b25f7ee4f34390
SHA512 9a5685ed76a706c9438a8141f54d0da5f900ed9164cb7aba717892a4e4661ae16db249ed13fc8eb242bd0321b328b8cf3e2f2ff69067bbe412ad1a880371f8d4
SSDEEP 384:RXjVs7KxkXqKf/pUZNCgVLH2Hfgsl++M9r7pLuLcSjzOXODV0+ErU3O3MDTHGRjs:RzVs7KxkXqKf/pUZNCgVLH2Hfgs8+M9k
TLSH
T1A97209A76C4C8E7B0F94C6CCD8267B4FADB5024B55D9C86483FA582903D5BCB110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 621fcd6af88947ebfb25a8f3bec972bad6ee57730b21b32d7b0f5497dc2775a1
MD5 1de3a8d80151b3af1abd8564aa651671
SHA1 8d2f6428cb93a00d504e4fb2a3024b9a81983cf5
SHA512 73110ab71288b5fc54ef9b2b17bdc26a1bf98e3a5adab0ca3c748601e3fc435e9ed0895f22503d2f50fc73f4a59d66077c2ae79ab661454c0c37d5f6b0fd644d
SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2OLZTpX6LqUVumeBwkuc8:jeuvBnhJsueMEGvIW1DcP2OXaVumMnu5
TLSH
T153D3884B3A743102EDE69A722CE0517B5D3CB16D8F51D5D428B620688EF2953A23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 290298b215f0de2ae8f48cf3116b62b5c787a39931c402d9cb4faacea34d397e
MD5 b30a986f973f93a9afcc4848549aee68
SHA1 58829904a2b83175c0136d27b51938066dedc3e2
SHA512 b50d8dce10bd42c296e776cf0426e64d580817356e76ac33e40f80c4ccb7c07d47db46722742e14d731a414b04427d6bbc72b591633ce18561e11a18c9180f9b
SSDEEP 3072:bGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:Cm7Rkm1tYpBeh2BAoa
TLSH
T1D6C3123B5E71E97759B9BB4EB08E0B1E1EF149A2D920DE42C8D85B0427F97CD0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 b602b950c69feefc52b224ff2f63241cf4ade2c2363637bdea37b9cef5e8524c
MD5 3d108804f0415ec45e4766a7f5c80c43
SHA1 85851fc7cd7e15e87c71234b4efb90eec9e4799c
SHA512 739cd2a429a54bc8d3007577130b9735533e6cd40a0dd20fce7a67998fe59386cfdcdab348386b109fe48500cf5117fd099b8116860a0b74cd1d32272d4b8c63
SSDEEP 6144:9RH45be5cuEhT31EXVm7Rkm1tYpBeh2BAoD:9RH4Y5WUc9oBGcAoD
TLSH
T10F34131B7D26AD3B6DA9975FB00B271E2FF008529759E9A0ED8C9C4413D7BC64704D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e3c932e879f8a7071362a654b47cd73c05f90d7fe66be785d811b84b86743e1b
MD5 8c92d931ed33c3d779a020ae7e111fb4
SHA1 de123f6d92bf24747affe820aaa8be3785388fae
SHA512 5be895d6a61eacf4f3117293636fb4890abbe186ddcbfbb3c8d3aa0fd1aa59519bbdd86e552732d2ded27aae5be1ffb0d6d9f6ccaac824d1b13ed03a12a438dc
TLSH
T13BD08032BB9D6452E7455230D893DF10276644A12C978B42E325C84CD5B90D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0b5dc1bf65a27f8ea20844919d7db192caf7a54fd791434a1304a7df2e9b496f
MD5 5de7bfd3f869f48e7255b6bdc532c4bc
SHA1 c26027eb70bc9887bf69c2b22be60226b685dbae
SHA512 0e6af8c455f57dc816a2c01366f46a0d069e8f41cccb1f7565e2afd873b71ffd5f135649fb4bf44d1a15a9efd68dc59696dc74a971b3483ec9d87a4323b2b4f2
TLSH
T112D08032FB5D6052E7455230D893DF10276644A12C974B41E325C84CD5B80D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 33caf63a97477499e2fac36f771ceaa9e97e7a3345e8d75d0cfd713d69ce2bc5
MD5 755a638809db3d6fd1308c461af42b46
SHA1 8af96e203e074e3df26ecc3389fe394f1844be2d
SHA512 c5ffe8f7e39e69c2eda4e6663d37c634024ef1d0ab835560803aa65d4b5b8d958eb5e1387a2fd69d4ef0316ce2e063e98944244962431b9c939ca1f77bfb1eb8
SSDEEP 48:K80I7KV6M/y5QI7KBSUHyIYps4S66+4KrlIdY+KaLCG++AuzD2w:K80gKV62KQwKBS2WbWKQ0i
TLSH
T17B91EF9332BA02417C7D692C92918767AA43F2A3701CA83B77B810B11E67F205DFD5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 53b511d5a0cb0ca28e7380fd34f0cb7d35df1033671daed676953472c5fc3d6c
MD5 ec5b6cffba19deefff07de0fbf169b2d
SHA1 130e722d83ce1e8c011f8795e82ee6e19634916b
SHA512 c0a2b36c3fdfa4ee5d0773460dc8b1adc0eb724fc04fa2e903c10be163e5d7abd502070a07298f7eeea73a7d1f7ebd8913f4a2846e0caa82d23718a7c8ce8487
SSDEEP 192:FvoWPVgtsMfT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:aq6tVfQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T1E024640A7B747001EDE7D9725CB080771A3CB16ECF22A6915DA254694DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1fabf83a7e4ee29f3fc381f6e29d5eee3c381e57d960ff1d3209387f9f49b867
MD5 efc455bed77303b4dc10406c8ef0117f
SHA1 810a4ee16fc3f5c48561cdd631c600f287604311
SHA512 a0147cc137191ca4576501122572fc82af2f02cf2d63ed9d119d51d3f9c70dd9a5a73127d77f27fffb4196af3891b498ef06dce6fb6a85af0a24729e117b3657
SSDEEP 192:XGNn6jCQmiUyHICf4SufoPxzYXSus6c1o6vSniWuvU6:XGNn6qMdfju8YCus9W6wi9vU6
TLSH
T17E02EA356C78687BAFA36E45FA8737175FA5212BD9852F44DAF81F0C00E728C2346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6445c812bb32c842ed62c8e54867fefe09c2f25fdf20c1f8486aaf5af3411dac
MD5 c47608a3afd8cb97f604613b843e90dd
SHA1 8ac309bc1b0d99f14bc0c74084a159e8276681d1
SHA512 3122cd7aa83dea509c616066e819498417ebaf8e7d525847060891a8ca684401746e91b2fa64072e4010bd6ad7bebcb87c4f048d8a349bacb0ecff99bf91d05b
SSDEEP 192:kGNP6j5QmiUygCi4SufoPxzYXSus6c1o6SSu0lOMigqJ5WU6:kGNP6b4iju8YCus9W6tuUi3MU6
TLSH
T1FA1209756C28A867AEE36E55F58732279FA5202BDD853F44DAE41E1C00DB65C3306832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

334ce9e6-0b8d-45b2-a2b2-316fb0a62282.tmp

Path C:\Users\Admin\AppData\Local\Temp\334ce9e6-0b8d-45b2-a2b2-316fb0a62282.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

42da470d

Path C:\Users\Admin\AppData\Local\Temp\71592061\42da470d
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab3438be-febb-4c6f-a985-5a883bcfd19d.tmp

Path C:\Users\Admin\AppData\Local\Temp\ab3438be-febb-4c6f-a985-5a883bcfd19d.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6120_1766551477\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cec5de8b-26ed-412b-9a3d-3a977ff9c8e1.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6120_479432293\cec5de8b-26ed-412b-9a3d-3a977ff9c8e1.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4300-117-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-87-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-78-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-114-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-150-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-148-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-147-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-146-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-145-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-144-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-143-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-128-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-126-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-122-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-125-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-124-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-123-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-121-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-119-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-120-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-118-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-48-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-116-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-115-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-112-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-111-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-109-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-108-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-113-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-110-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-28-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-27-0x00007FFEFFF70000-0x00007FFF00374000-memory.dmp

Download

memory/4300-88-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-77-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-86-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-85-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-84-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-83-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-82-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-79-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-76-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-75-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-74-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-73-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-72-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-71-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-70-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-81-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-80-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-69-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-15-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-14-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-12-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-13-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-11-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-10-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-9-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-8-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-7-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-3-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-5-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-6-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-4-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-2-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-1-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-0-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/4300-2784-0x0000000360000000-0x0000000360228000-memory.dmp

Download