097f1279f7f5fc84f00da5905eebd62e483323d61c08d4796012f10b14213f12

Analysis

max time kernel
149s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 09:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_cf788281e6acb3db1b0ccff49e389ddf_akira_cobalt-strike_glassworm.exe
Size 12.5MB
Sample260804-lk75vagh64
SHA256 097f1279f7f5fc84f00da5905eebd62e483323d61c08d4796012f10b14213f12
MD5 cf788281e6acb3db1b0ccff49e389ddf
SHA1 7282e1b6e7b28f5cde8bf89af696174426ce6d5f
SHA512 3c16cd87173f83bc6553565680aad94692d53beb1f144fceb9b7cbc788cf0352cfd1f271f99dc6d3b0b38d94cde758befac61840842a7b00692df6175542b379
SSDEEP 196608:u2t5g1dVcBpV4rUcugHW4QQcDtucnp1a/ZKPA7lrzpFEt5pWqJ2qHopGJSXPlpK6:rt5WyP4rU1gH8QlI1YKSZzDW/2/IoP26
TLSH
T186D6235371551E59C213D53882A666367235B2C82331DFFB3CACAE79EF429DA8F09708
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
108	python.exe
6004	app_0e598312.exe

Loads dropped DLL 15 IoCs

pid	Process
108	python.exe
108	python.exe
108	python.exe
108	python.exe
108	python.exe
108	python.exe
108	python.exe
108	python.exe
108	python.exe
108	python.exe
108	python.exe
108	python.exe
108	python.exe
108	python.exe
108	python.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\128.png	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4240_1042495435\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1641947792\_locales\gl\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5588	chrome.exe
2672	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	app_0e598312.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	app_0e598312.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{E5C81446-DA06-43F3-A27F-80184815EEB4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
6004	app_0e598312.exe
6004	app_0e598312.exe
4576	chrome.exe
4576	chrome.exe
6004	app_0e598312.exe
6004	app_0e598312.exe
6004	app_0e598312.exe
6004	app_0e598312.exe
6004	app_0e598312.exe
6004	app_0e598312.exe
6004	app_0e598312.exe
6004	app_0e598312.exe
6004	app_0e598312.exe
6004	app_0e598312.exe
6004	app_0e598312.exe
6004	app_0e598312.exe
6004	app_0e598312.exe
6004	app_0e598312.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4576	chrome.exe
4240	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 108	4684	2026-08-03_cf788281e6acb3db1b0ccff49e389ddf_akira_cobalt-strike_glassworm.exe	90
PID 108 wrote to memory of 6004	108	python.exe	91
PID 6004 wrote to memory of 4576	6004	app_0e598312.exe	92
PID 4576 wrote to memory of 1368	4576	chrome.exe	93
PID 4576 wrote to memory of 5588	4576	chrome.exe	94
PID 4576 wrote to memory of 4884	4576	chrome.exe	95
PID 4576 wrote to memory of 4884	4576	chrome.exe	95
PID 4576 wrote to memory of 5832	4576	chrome.exe	96
PID 4576 wrote to memory of 5832	4576	chrome.exe	96
PID 4576 wrote to memory of 4652	4576	chrome.exe	99
PID 4576 wrote to memory of 3836	4576	chrome.exe	98
PID 4576 wrote to memory of 4652	4576	chrome.exe	99
PID 4576 wrote to memory of 3836	4576	chrome.exe	98
PID 4576 wrote to memory of 1608	4576	chrome.exe	100
PID 4576 wrote to memory of 1608	4576	chrome.exe	100
PID 4576 wrote to memory of 1428	4576	chrome.exe	101
PID 4576 wrote to memory of 1428	4576	chrome.exe	101
PID 6004 wrote to memory of 4576	6004	app_0e598312.exe	92
PID 6004 wrote to memory of 4240	6004	app_0e598312.exe	105
PID 4240 wrote to memory of 2788	4240	msedge.exe	106
PID 4240 wrote to memory of 2672	4240	msedge.exe	109
PID 4240 wrote to memory of 2680	4240	msedge.exe	110
PID 4240 wrote to memory of 2680	4240	msedge.exe	110
PID 4240 wrote to memory of 4404	4240	msedge.exe	107
PID 4240 wrote to memory of 4404	4240	msedge.exe	107
PID 4240 wrote to memory of 4404	4240	msedge.exe	107
PID 4240 wrote to memory of 3596	4240	msedge.exe	111
PID 4240 wrote to memory of 3596	4240	msedge.exe	111
PID 4240 wrote to memory of 4152	4240	msedge.exe	112
PID 4240 wrote to memory of 3596	4240	msedge.exe	111
PID 4240 wrote to memory of 4152	4240	msedge.exe	112
PID 4240 wrote to memory of 4152	4240	msedge.exe	112
PID 4240 wrote to memory of 4888	4240	msedge.exe	113
PID 4240 wrote to memory of 4888	4240	msedge.exe	113
PID 4240 wrote to memory of 4888	4240	msedge.exe	113
PID 4240 wrote to memory of 4336	4240	msedge.exe	114
PID 4240 wrote to memory of 4336	4240	msedge.exe	114
PID 4240 wrote to memory of 4336	4240	msedge.exe	114
PID 4240 wrote to memory of 2856	4240	msedge.exe	115
PID 4240 wrote to memory of 2856	4240	msedge.exe	115
PID 6004 wrote to memory of 4240	6004	app_0e598312.exe	105
PID 4240 wrote to memory of 3712	4240	msedge.exe	117
PID 4240 wrote to memory of 5136	4240	msedge.exe	118
PID 4240 wrote to memory of 3712	4240	msedge.exe	117
PID 4240 wrote to memory of 5136	4240	msedge.exe	118
PID 4240 wrote to memory of 2864	4240	msedge.exe	120
PID 4240 wrote to memory of 3836	4240	msedge.exe	123
PID 4240 wrote to memory of 3836	4240	msedge.exe	123
PID 4240 wrote to memory of 5848	4240	msedge.exe	124
PID 4240 wrote to memory of 5848	4240	msedge.exe	124

C:\Users\Admin\AppData\Local\Temp\2026-08-03_cf788281e6acb3db1b0ccff49e389ddf_akira_cobalt-strike_glassworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_cf788281e6acb3db1b0ccff49e389ddf_akira_cobalt-strike_glassworm.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Users\Admin\AppData\Local\Programs\AppRuntimeHost\r3799\python.exe
  "C:\Users\Admin\AppData\Local\Programs\AppRuntimeHost\r3799\python.exe" -B C:\Users\Admin\AppData\Local\Programs\AppRuntimeHost\r3799\bootstrap.py
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:108
- - C:\Users\Admin\AppData\Local\Temp\app_0e598312.exe
    "C:\Users\Admin\AppData\Local\Temp\app_0e598312.exe"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:6004
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --disable-session-crashed-bubble --window-position=-32000,-32000 --window-size=800,600
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4576
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffcf854c728,0x7ffcf854c734,0x7ffcf854c740
        5⤵
        
        PID:1368
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1892,i,12310108916231506118,7724157401586061549,524288 --field-trial-handle=2032,i,11428188117990996541,14485971613906025351,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:5588
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1640,i,4826183022972284648,1364752788164405589,262144 --field-trial-handle=2032,i,11428188117990996541,14485971613906025351,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:2
        5⤵
        
        PID:4884
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,9402510908280475580,9400612742921311671,524288 --field-trial-handle=2032,i,11428188117990996541,14485971613906025351,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:13
        5⤵
        
        PID:5832
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,12671897500581863738,1049985162710992879,2097152 --field-trial-handle=2032,i,11428188117990996541,14485971613906025351,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:1
        5⤵
        
        PID:3836
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,4039366946985610746,4536762053702030184,2097152 --field-trial-handle=2032,i,11428188117990996541,14485971613906025351,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:1
        5⤵
        
        PID:4652
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4580,i,12918204652450626729,9839250904799553892,2097152 --field-trial-handle=2032,i,11428188117990996541,14485971613906025351,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:1
        5⤵
        
        PID:1608
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4788,i,8021518550517789318,17955134323200403816,524288 --field-trial-handle=2032,i,11428188117990996541,14485971613906025351,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:14
        5⤵
        
        PID:1428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check --disable-session-crashed-bubble --window-position=-32000,-32000 --window-size=800,600
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4240
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ffcedffc188,0x7ffcedffc194,0x7ffcedffc1a0
        5⤵
        
        PID:2788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,9367631095147473979,18343429882775108443,262144 --field-trial-handle=2380,i,799033842770052076,13107359926898418530,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:2
        5⤵
        
        PID:4404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,12963360369669219613,12861390658321143393,524288 --field-trial-handle=2380,i,799033842770052076,13107359926898418530,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:2672
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,5374086251545714548,4599445180200580590,524288 --field-trial-handle=2380,i,799033842770052076,13107359926898418530,262144 --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:13
        5⤵
        
        PID:2680
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,15918939051521558755,14103310787371906902,2097152 --field-trial-handle=2380,i,799033842770052076,13107359926898418530,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
        5⤵
        
        PID:3596
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,2269769517971972443,7005771400402606781,2097152 --field-trial-handle=2380,i,799033842770052076,13107359926898418530,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
        5⤵
        
        PID:4152
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4324,i,18249696833701010911,11806426219022174877,2097152 --field-trial-handle=2380,i,799033842770052076,13107359926898418530,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
        5⤵
        
        PID:4888
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4356,i,4907946961694743254,15481347811472128047,2097152 --field-trial-handle=2380,i,799033842770052076,13107359926898418530,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:9
        5⤵
        
        PID:4336
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,6951683196327988445,8755235712618878874,524288 --field-trial-handle=2380,i,799033842770052076,13107359926898418530,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:14
        5⤵
        
        PID:2856
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,2246255289138420431,4941222183089965861,524288 --field-trial-handle=2380,i,799033842770052076,13107359926898418530,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
        5⤵
        
        PID:3712
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,3105532455771402507,17901094173232163955,524288 --field-trial-handle=2380,i,799033842770052076,13107359926898418530,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
        5⤵
        
        PID:5136
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,7712145360844862393,1077571885319121804,524288 --field-trial-handle=2380,i,799033842770052076,13107359926898418530,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
        5⤵
        
        PID:3160
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,7712145360844862393,1077571885319121804,524288 --field-trial-handle=2380,i,799033842770052076,13107359926898418530,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
        5⤵
        
        PID:2864
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,5992823697087004905,10262873692924446472,524288 --field-trial-handle=2380,i,799033842770052076,13107359926898418530,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
        5⤵
        
        PID:3836
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,1085180295826895733,10685344818348419830,524288 --field-trial-handle=2380,i,799033842770052076,13107359926898418530,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:14
        5⤵
        
        PID:5848

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4640

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2108

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:928

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5832

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 f34c85bd49b774eb4393e8999f5b21ea6eb80f98507f57d3705cf4a9fec5b092
MD5 96174996e1d00b37fcc7f03313381be1
SHA1 90bdd081fca4839187935191267e50f05af1b595
SHA512 c3ff413997eecf5fcbb5feca3aa59e26e6f99db0926678312c992d4219d986951dd5211976ef646fe33452c23a73d1c9a13caf72abe17b39ab9f346ffd61dcc2
TLSH
T1DAF05967A67D746344BA95AF4E05B80969B5E434014128E8CF5A426CE0A64FB1F02057
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 2261490db09ae73189a4a703381c40943aa54357d47740831b7e76e2479379fc
MD5 1c71361d85b40f199a8edfddfd83fca0
SHA1 814aed8bfcb7f40f96782371dc93f7992cb5e9e0
SHA512 ecb9c0214fb35022c14eb8b18485d6516a076016c5f99b66a6602baac47d96a390f328f6fead5e59628b9d258f37d3411350fd1d70c5e6ac06b4504f2996fcee
SSDEEP 96:5KC0d+oJm4V0FH+pqf+HBKyoytsRDotok5hbHDHB6eGyvkon2ob1v4a:MC0HJm5FHuPgXDUDhXhW8n2obZ
TLSH
T1B5A12AB1A8B948B759B7D345F8822A83DEA4A22769A0AF80D9DD1E0D01F31D81342627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

4919fc79-a5b5-4b10-9761-c141ea751cfe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4919fc79-a5b5-4b10-9761-c141ea751cfe.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 fc753a5b0bf467455aa9d47130f6b5259e948f4682d7078a33e909f2bc2b90fa
MD5 966671d54719a6148b669136b60e11e2
SHA1 c8797760e5da376dd7dca5f233ff485e6774aad8
SHA512 88a657bd5a92be75e4dabc9239e22742b4552ff7233bee51ed0f4e60a5cdd2ef543a06a89ffcb96602b8bd857d73b10a90932a317407afba87c396a727b92b44
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHmGmbmqmGmAmomomuWmYmNm1gmmmuK4mb+:CbEBVj5JAdSp9/EgTK7j6dJOHZ2HDxTt
TLSH
T10A910101317B02C17C3DA54C8479C86E86C2B066341AB76B3FA946664F66E479DFF8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 769a3eb5e4f91baf54eacfea3aa594d2de7b961d6407012165522c65e4984319
MD5 7905b6971cf61198bbe95dc79cdd5c3c
SHA1 acf6558e10d0cbd5dc41618b784e1aabd29124e8
SHA512 5398f7e446fdc9a685d78a63f9361275c394ac62f781a691c95472931813b62944b8ccd5e47542cfa3f5a783ea346681b06c6b115ca5235e0053866cbf9bde6c
SSDEEP 384:DNrRZyCSDnxTICYMEhIKyll7svbFKfk7:xFZJSDniwyI1l7svbF9
TLSH
T1EC44640A7B747001EDE2D9725CB080771E3CA16E8F22E6815DB654694EB3853A63D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9c89aff961a56425cdd640f8b6bdf993decfa63af1d54c0d23fabdece550dfe0
MD5 b8a47afb2affb3132213c83342cfdfc4
SHA1 e558fb27f116712bdda1228ee877d781cceaf1a4
SHA512 8f764e840121fecb4c27cbe5518e3f052986115feca471fdeeae54482be4fbe8d89c73fb91389fd4cbe50321260956bd3a091d0f37d12e06bc00b13df7f10603
SSDEEP 768:Irv+4UNbdD3xcDtFNp8+p3bd66j+4BRv86aLIif2bwCl1:Ibsbp3IL8+p3Z6n4yF0ww
TLSH
T1B603CE73F96899739CF6C644B2467A837FF861A396C10EC4E5DD2B4E015A19E230BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f0ff0dec8cb0339edc489fcf497529a2821c87e3232cc16961564487799cdc05
MD5 b340d5d9fd7ab84365f916169442f5c3
SHA1 aee8b34b68b00b01efd174c9616725daf54401fe
SHA512 9bf62cb158644b7657f1792c5e9f76e0943da892d9f9acb2f8ffa1fb92e951ad58282dc416a59f73f4e5c3cd07f959cf6ce24045aa4874b78562b4a950984f7c
SSDEEP 768:Brv+4UNbd/35oDt/LTp8+p3bd66j+4BRv86aLIWPx:BbsbF3il8+p3Z6n4ydx
TLSH
T14903AE72F868AD739DF6CA44B1467B437FB820A351C00EE4E8D96B5E019719E270B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Programs\AppRuntimeHost\r3799\VCRUNTIME140.dll
Size 117KB
SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
MD5 862f820c3251e4ca6fc0ac00e4092239
SHA1 ef96d84b253041b090c243594f90938e9a487a9a
SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
TLSH
T1A2C38D4572A042F7D17AD274C1A36A17FB75B94487A0A3CF03B58A650F13BE0AE3D396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Programs\AppRuntimeHost\r3799\_bz2.pyd
Size 84KB
SHA256 178c6eeb30843e656cc407aaf53ae6d0f170966e4e0bdd2ee1bede73962275cd
MD5 03bad8289d9aa18e859ed7270a719e92
SHA1 ee371b1afc7d5be754553d54bd0db8968568c703
SHA512 5267906b6daf79e898f87d24b6c0467f75df4c53fe0f44c5dcb02eeffef3b9b7078b2b1af3417ba92ab7586a7968a6b4fdb44b398287cdc1cb0c1dff2e4e9aab
SSDEEP 1536:smNz7JrA+VLsS7XtGHakUwFHkklV88YmTNiR1iNI+CVzyUzR9pfI/KYF:jNzdb7XfQVpn/pTSYNI+CVCb
TLSH
T171839E86E36962F6F46B91B986910393F730BA51075093BFF258C2592F03F816E6C35E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Programs\AppRuntimeHost\r3799\_ctypes.pyd
Size 124KB
SHA256 9ffdedd0f1f09f21870bd75c08d05c32994a1193be3955e367f260690a36cbd0
MD5 f8d2950d5496d3940aef6758c9e9e576
SHA1 ed68c88c14e44871a085e93bf8cf6aabc816ce28
SHA512 ab25ff65abd64f39b156f7aa91c35a327c930f31d3a5d128e67e00c6307e0a0637595ab812931dc2ffec7102e33a2afc746de6267f6130d4f5a8d3445bcded79
SSDEEP 3072:+X+A2TuMyOpRf8/dy+5pf/EaWODBiPxI+LPKaO:3VTuTOpRIpf/EaNDCo
TLSH
T1C5C36D0B379400A6EBA35178C5736E07D7B1B45B172193CF12A4C6992F637A36E3E316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Programs\AppRuntimeHost\r3799\_lzma.pyd
Size 156KB
SHA256 f6e0c786395ccc7b22f4c435b19f7073eb5974eb29e09f4c91060cab10450e6a
MD5 02b16654f73129b1a1220c00d757112d
SHA1 7ce602e4c2854be7c6b439bc64162d58b1467750
SHA512 8daf5d68230d0340e5d940067afca39922078ce94b6753f2be7ae208d7982e87f5273aca768465b110477f83735f4c8e14f7bf95c2a48e2e5457bc723398e541
SSDEEP 3072:dA1h7DfXFDu7NjQ69wJGznfV9mNojn+RN1VlHNiNI+Z1zxVVm:dMDfZOX9YOjKlHNiHw
TLSH
T117F34B96A394F0D6F3628C78D6628F53E7F5781A0310929E01CC976D2B1FB659E2B313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Programs\AppRuntimeHost\r3799\_socket.pyd
Size 83KB
SHA256 0e2c1089974a2757426dac3295201a33c990c36f3c09593f8a2b6e07fd36b99c
MD5 dc5a5ab89e6e2b48cb50b463b214fd89
SHA1 f7740ff9d75767ccdac7aa0dde8659d3133249a2
SHA512 98a886daa82848bc4ca352ec7e7f663822cbad5cd40c5ea7915821097964167d0628af47b8f19f22a825f9696f3199ffbaa94d699ae773a7eb57ae6dc1c3814f
SSDEEP 1536:bOYxHEUZql2HLSyypHT9/s+S+pzm8iaWmIHJyKNxI+LwWWyUzR9nfIc2Xm:qdUZqzyypHT9/sT+pzm8NxIplNxI+Lw5
TLSH
T175836A05A6A051FADB63C175C2639E23FBB4B5C11395A35F10A2C65A1F337C2BF39A81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Programs\AppRuntimeHost\r3799\_ssl.pyd
Size 175KB
SHA256 81344e3e16cf6f2d5b24cc0cf92e95c5fd0592e4a3859bb00c3f5891e2482128
MD5 25d4b1c6ca053c573a55d68ae3db5ce2
SHA1 ed6bc021e3d5e5ca8083e22b718bc89d55d3ab7f
SHA512 396a5432461408059ccda92cc9ca641e68150aad02efcb635dcd3f7d68d9dd09ccec0619705abf3f43a959997b4f8821b726822b89c217c4054f8e8a67eb7fc3
SSDEEP 3072:H1l+KugCpMRjN/fP6X6z7Gx8nvgkKuFBZd4rYcvsswCfyX0NoFNI+C7Bt:H1QKugCpAJHP6X6gQvg9gFq
TLSH
T15B048C07B6442AF7D813E4B9C2334903EBB1F155331257DE48D5D68A0F07B4AAE6AB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

assets.pak

Path C:\Users\Admin\AppData\Local\Programs\AppRuntimeHost\r3799\assets.pak
Size 104KB
SHA256 39a52d0971475be4656b09510fbff8ab9bd970fa1b3435e5e63834eeaea67118
MD5 9d65cddd642aff4bdd2c82e0ba63a69a
SHA1 b8d81ff956bc39ecb84cbe2d203ef22e45d7a18f
SHA512 2958d5a2ce34a7bdb13f2811c5223bbfefee02b225b5d553902e9e9ec84f4dd9dc5e615538ac4eec83722cb10aee8adc3471079ca1f9b4c1261857dc30a98091
SSDEEP 1536:qpLniCQQPpupzoW8MYzUVDRZJZL7lNSeUImU2aogPwGdmmNR8vEaEqvjZDnKaIjy:WBQeupkW+yhLx11EvllvjZTKvusQp7V
TLSH
T108A312E3D932C395DF1B0B1CA5AFBA62CCF730A5824E8E81157749B444C4B28199BC9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootstrap.py

Path C:\Users\Admin\AppData\Local\Programs\AppRuntimeHost\r3799\bootstrap.py
Size 7KB
SHA256 934f83fa3279a02e35f98acc4aab2d73e3e28a646c3eace27b7a21266258be6b
MD5 dea56407d4b97779d602d908d14cdb53
SHA1 bfd049d039173fa5d69ff7201ef2feb9bd4b6af5
SHA512 cb9b43d52f181d7c4ab0ec53e23fbccb35a7ca237d1ad7044d9fadccc9886b2896116064b666e5b0780820c285ae99753317e63baaa54076c3c9670eb4c2e0e2
SSDEEP 192:GtF73IynUnxvTUWU5mgPRo7y684nxJVAujKv6nW03EPK7o0+Li:aF73IynUnx4WU5xQnzV5+v6nWmECX
TLSH
T1D5F1D7028E5AE471D393E959943B8C872A4AB817BE0A193C77DDD2B19F4C43C8134EF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Programs\AppRuntimeHost\r3799\libcrypto-3.dll
Size 5.0MB
SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
MD5 123ad0908c76ccba4789c084f7a6b8d0
SHA1 86de58289c8200ed8c1fc51d5f00e38e32c1aad5
SHA512 80fae0533ba9a2f5fa7806e86f0db8b6aab32620dde33b70a3596938b529f3822856de75bddb1b06721f8556ec139d784bc0bb9c8da0d391df2c20a80d33cb04
SSDEEP 98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
TLSH
T11A367B6AA7A80189E4BAC13CC9534617D2B1F81A17B097CF19A1967D0F37FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Programs\AppRuntimeHost\r3799\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Programs\AppRuntimeHost\r3799\libssl-3.dll
Size 774KB
SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
MD5 4ff168aaa6a1d68e7957175c8513f3a2
SHA1 782f886709febc8c7cebcec4d92c66c4d5dbcf57
SHA512 c372b759b8c7817f2cbb78eccc5a42fa80bdd8d549965bd925a97c3eebdce0335fbfec3995430064dead0f4db68ebb0134eb686a0be195630c49f84b468113e3
SSDEEP 12288:7LN1sdyIzHHZp5c3nlUa6lxzAG11rbmFe9Xbv:7LgfzH5I3nlUa2AU2Fe9Xbv
TLSH
T108F44BADB3B8059CD8B6C17D86934623E3B6F4553330EBEB06518A790F277D51B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python.exe

Path C:\Users\Admin\AppData\Local\Programs\AppRuntimeHost\r3799\python.exe
Size 102KB
SHA256 1a078825122b059f04b6c1545909f1d3ed0838dd24ab80d1c7fa60ca68ff9af5
MD5 d9c8d53a62847aed598af8c0bad37b26
SHA1 b02e24ad66e57bc5f8d5751bec4556742151bb2a
SHA512 c5ab728c9349ba1b406856d9c130242cd43151d19f17c4330a3408958587f0508a4e63b1ce8a4e971f6062294996167aa419f837629f09b1fc64a1f26c061956
SSDEEP 1536:mj1oKbuEYE+9z2wp+FavGmhMn+IhzZtzU/XZRbyUzR9LfI5go:mBoKbuAs0FNmhMn+IhNG/XZRk5Z
TLSH
T157A3E38A6A1E8191D5709471437B87F26B2C2F62A9C3C68DA7C13F16E97D2C1F609733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Programs\AppRuntimeHost\r3799\python3.DLL
Size 68KB
SHA256 7c3e2956271eff4949145d14635c0ca659db5ed19215201d2d8b3a4a3d3006f9
MD5 acd6bad0ea9a91ce06189bb63d594b41
SHA1 46ee5089000b5c312739a909662142104d4d8be9
SHA512 79b888bda9804a9091f5fe8d411f2a81439d3d9618e6bd73a3f729bc977cd8e15914f3fd9f90462331aee431713c8ed7ffe864c975faa6083d7925d17d43b315
SSDEEP 1536:zDmF61JFn+/OzxI+L04yUzR96fI+vuGVR:zqU1txI+L0U4VR
TLSH
T16A637142BB54F893D7FA66FC7AD199CE642B12CC472988ECA47593D30D1A310A2E734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312._pth

Path C:\Users\Admin\AppData\Local\Programs\AppRuntimeHost\r3799\python312._pth
Size 80B
SHA256 2820f241bc9d6810d4db21c21cca3845799367fbdf0199620fb37c86a74b945c
MD5 535c72e819d6b1e99fc4e85d68784e78
SHA1 01325ced71fd06fd22f453e68f4e41c48223a090
SHA512 83ddff71dce6ddf7c7e8e2dacf2188ec38f60d32f569a77df5d7a8d6e10f7f9cbe1a0a57759a5b7886f81deb6f47cbdab6893ccaec6af2df18babece9466e10a
TLSH
T102A022020AA30080023030A83FC000F88F32330C8B00320C8AC02E380200E30ABE202F
MD5 SHA1 SHA512 TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Programs\AppRuntimeHost\r3799\python312.dll
Size 6.6MB
SHA256 3b56fa10d3797c231468cee42caeaaaff40dbede7bc0d142ec4878493f48e07d
MD5 f9a43765b486c561bf0895eb9390ed1f
SHA1 b398fbd02bd7fdb32dcb88f11758a0a9826b75a4
SHA512 f2709ba81fe1e01789fc0aae65d31f5adcfd64dd72d161b4cddfa35f91eb2c8d66954925c825b22ce9034fd894ee18500b1ff0a32e4d585491e09d2c540a305c
SSDEEP 98304:8HdLykRHSHAtre59efJBVvTHqMiEnrZpd50:8HdLykRXg9Y5iEZpdu
TLSH
T11A667C567358C0A9C97BA0B0CC13C68EE7B27C517F50930B70AAB75E2F73792969A344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.zip

Path C:\Users\Admin\AppData\Local\Programs\AppRuntimeHost\r3799\python312.zip
Size 3.7MB
SHA256 9b3697310fa506b4a098adf7a037342b1112b10fa036d378cc9420e68768f6a6
MD5 c7d7f7dc9544e4065d0199c6c717232d
SHA1 7066736fa25e84297016335380b89cd612f7988a
SHA512 b10d25fe86d6ace45a6e024ea30f38d95b036faa03dbfac19f682145475b79051484e1eb237d07395da1a46867f59cc86540ba98dcdd1a039bd3d4d1d566b9da
SSDEEP 98304:TzRxh7WWCCcnV8U85tz7SE55ztoNM/SejlPJyy:TFnzZcV8D5tz7v9toN4flMy
TLSH
T1A4062322CE2DB84ED463F23D1A32D716864E87897142B75E0919D1CB99177EB6F0F02E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Programs\AppRuntimeHost\r3799\select.pyd
Size 32KB
SHA256 fcac4646ff709ac07aee532c4612a19b7070f2dd6ef67ba09c743644e92f7376
MD5 208cef2d2c60a3457b13aa428dceb347
SHA1 f78ddbe4be3ff0b21f06aea5f2266625d489470b
SHA512 8b0d14d1c93089368d34bdf49602f4c8e1daa1711c2760eeb2c59a10dbf7611fce098af0f11d7d5aa53d7d07dde39b1f31ecf5f62f7f91f31d7abeed5d828b19
SSDEEP 768:+FypHfy2YxI+QGXJyUFRYT2Ip4UJCxf1mltdK2363:+Fyp/y2YxI+QGZyUzR9UefI/K2e
TLSH
T1ABE27DCA6B745047EAA3D631C6A2CE43F939B7A35711869F30B9D1890E137C1B73A319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Programs\AppRuntimeHost\r3799\unicodedata.pyd
Size 1.1MB
SHA256 e7fe7ae7342b1dec8dfe52a95d768039a46189209b9f42a21c4d2473faaa1753
MD5 5e432cca03cd6c18cf4043ed1f3af40a
SHA1 f418bc194c3d35298028bb43dc8cff720360eb2b
SHA512 02076ef322d23becfe3e24cca5e868a3acb28086dfe83188d82a1a138ad24b9ea097df667bcf8b5486b3306abff0138462e757171a92cd2b58a98a2ac152ec91
SSDEEP 12288:drEHdcM6hbBCjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfcQPXs:drEXsCjfk7bPNfv42BN6yzUQPXs
TLSH
T1EA354BC5BB828E66E87B31B944D1212F1360C273476B573BB25513294C8B3B74EE69EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app_0e598312.exe

Path C:\Users\Admin\AppData\Local\Temp\app_0e598312.exe
Size 104KB
SHA256 b8737944bbb4c7b08f0ba955c45cdffd2c34b4afc622e0b05af529283f1b52af
MD5 f45e89739622dff68d5c7e75d84dc4c7
SHA1 4fa33c1ad8f81d33b2124c5a161619b1a40af3a2
SHA512 cb76eab34b66ff033d9253fef05c07cde18974bc1d2995cc35bef4a3a7bde94e5a8fd81dbd8527339ee5cc216900303c0202e4d80ae10f5005ae101fcdcc07c0
SSDEEP 1536:EIWGLPw9b6JjQ7ZvQvJwkOwtN47O6WUymaNnnU4tvZLqqgv32/u20YqKCdhloP5I:EjGLI9m7XOqNRVqqgvbXQPsN1taqrk
TLSH
T14BA33A59BB9511FCC976E138C9C76127EBF2F04895324B8A43624E522F73361EE2D2C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4684-79-0x0000000000480000-0x00000000010B5000-memory.dmp

Download