e7c5f34dbbae4d49edee90f7ad98c6e548f50b8c86a9f6ce0b15e49491cafabd

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 21:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e7c5f34dbbae4d49edee90f7ad98c6e548f50b8c86a9f6ce0b15e49491cafabd.exe
Size 5.3MB
Sample260820-zyacmaap2w
SHA256 e7c5f34dbbae4d49edee90f7ad98c6e548f50b8c86a9f6ce0b15e49491cafabd
MD5 795ffcf26fed5ce55a0ea4bf1ec86eae
SHA1 5234d4747032f35221b8fa44e887ca4e9c186df7
SHA512 547b2f43e043f11ffdf5291add85754ead1182a1897e986497624a90b4d68f7f20a0ff07f849843f09545a47328c8cd3a85ba9216dfaa0bd72337f8644ded47b
SSDEEP 49152:/+xLCeAxhC38a97UaefQnCBArgrTmC/dJ:2pCuZUzYyHv
TLSH
T1D2466C03BDA545A9C0AA9734C9B79612BB76BC88873133D72E50B6383F76BD06E75700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1812	e7c5f34dbbae4d49edee90f7ad98c6e548f50b8c86a9f6ce0b15e49491cafabd.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5560_1927021365\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5576	chrome.exe
1732	msedge.exe
1952	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	e7c5f34dbbae4d49edee90f7ad98c6e548f50b8c86a9f6ce0b15e49491cafabd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	e7c5f34dbbae4d49edee90f7ad98c6e548f50b8c86a9f6ce0b15e49491cafabd.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{2EE655B6-7FD7-43CA-B39F-C08FD0E9289E}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1812	e7c5f34dbbae4d49edee90f7ad98c6e548f50b8c86a9f6ce0b15e49491cafabd.exe
1812	e7c5f34dbbae4d49edee90f7ad98c6e548f50b8c86a9f6ce0b15e49491cafabd.exe
1812	e7c5f34dbbae4d49edee90f7ad98c6e548f50b8c86a9f6ce0b15e49491cafabd.exe
1812	e7c5f34dbbae4d49edee90f7ad98c6e548f50b8c86a9f6ce0b15e49491cafabd.exe
1812	e7c5f34dbbae4d49edee90f7ad98c6e548f50b8c86a9f6ce0b15e49491cafabd.exe
1812	e7c5f34dbbae4d49edee90f7ad98c6e548f50b8c86a9f6ce0b15e49491cafabd.exe
1812	e7c5f34dbbae4d49edee90f7ad98c6e548f50b8c86a9f6ce0b15e49491cafabd.exe
1812	e7c5f34dbbae4d49edee90f7ad98c6e548f50b8c86a9f6ce0b15e49491cafabd.exe
1812	e7c5f34dbbae4d49edee90f7ad98c6e548f50b8c86a9f6ce0b15e49491cafabd.exe
1812	e7c5f34dbbae4d49edee90f7ad98c6e548f50b8c86a9f6ce0b15e49491cafabd.exe
5712	chrome.exe
5712	chrome.exe
1812	e7c5f34dbbae4d49edee90f7ad98c6e548f50b8c86a9f6ce0b15e49491cafabd.exe
1812	e7c5f34dbbae4d49edee90f7ad98c6e548f50b8c86a9f6ce0b15e49491cafabd.exe
1812	e7c5f34dbbae4d49edee90f7ad98c6e548f50b8c86a9f6ce0b15e49491cafabd.exe
1812	e7c5f34dbbae4d49edee90f7ad98c6e548f50b8c86a9f6ce0b15e49491cafabd.exe
1812	e7c5f34dbbae4d49edee90f7ad98c6e548f50b8c86a9f6ce0b15e49491cafabd.exe
1812	e7c5f34dbbae4d49edee90f7ad98c6e548f50b8c86a9f6ce0b15e49491cafabd.exe
1812	e7c5f34dbbae4d49edee90f7ad98c6e548f50b8c86a9f6ce0b15e49491cafabd.exe
1812	e7c5f34dbbae4d49edee90f7ad98c6e548f50b8c86a9f6ce0b15e49491cafabd.exe
1812	e7c5f34dbbae4d49edee90f7ad98c6e548f50b8c86a9f6ce0b15e49491cafabd.exe
1812	e7c5f34dbbae4d49edee90f7ad98c6e548f50b8c86a9f6ce0b15e49491cafabd.exe
1812	e7c5f34dbbae4d49edee90f7ad98c6e548f50b8c86a9f6ce0b15e49491cafabd.exe
1812	e7c5f34dbbae4d49edee90f7ad98c6e548f50b8c86a9f6ce0b15e49491cafabd.exe
1812	e7c5f34dbbae4d49edee90f7ad98c6e548f50b8c86a9f6ce0b15e49491cafabd.exe
1812	e7c5f34dbbae4d49edee90f7ad98c6e548f50b8c86a9f6ce0b15e49491cafabd.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5712	chrome.exe
5712	chrome.exe
5712	chrome.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
1364	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1812	e7c5f34dbbae4d49edee90f7ad98c6e548f50b8c86a9f6ce0b15e49491cafabd.exe
Token: SeShutdownPrivilege	5712	chrome.exe
Token: SeCreatePagefilePrivilege	5712	chrome.exe
Token: SeShutdownPrivilege	5712	chrome.exe
Token: SeCreatePagefilePrivilege	5712	chrome.exe
Token: SeShutdownPrivilege	5712	chrome.exe
Token: SeCreatePagefilePrivilege	5712	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
5712	chrome.exe
5712	chrome.exe
5712	chrome.exe
5712	chrome.exe
5712	chrome.exe
5712	chrome.exe
5712	chrome.exe
5712	chrome.exe
5712	chrome.exe
5712	chrome.exe
5712	chrome.exe
5712	chrome.exe
5712	chrome.exe
5712	chrome.exe
5712	chrome.exe
5712	chrome.exe
5712	chrome.exe
5712	chrome.exe
5712	chrome.exe
5712	chrome.exe
5712	chrome.exe
5712	chrome.exe
5712	chrome.exe
5712	chrome.exe
5712	chrome.exe
5712	chrome.exe
5712	chrome.exe
5712	chrome.exe
5712	chrome.exe
5712	chrome.exe
5712	chrome.exe
5712	chrome.exe
5712	chrome.exe
5712	chrome.exe
5560	msedge.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 5712	1812	e7c5f34dbbae4d49edee90f7ad98c6e548f50b8c86a9f6ce0b15e49491cafabd.exe	89
PID 5712 wrote to memory of 1228	5712	chrome.exe	90
PID 5712 wrote to memory of 6112	5712	chrome.exe	91
PID 5712 wrote to memory of 6112	5712	chrome.exe	91
PID 5712 wrote to memory of 5576	5712	chrome.exe	92
PID 5712 wrote to memory of 4144	5712	chrome.exe	93
PID 5712 wrote to memory of 4144	5712	chrome.exe	93
PID 5712 wrote to memory of 248	5712	chrome.exe	95
PID 5712 wrote to memory of 248	5712	chrome.exe	95
PID 5712 wrote to memory of 2596	5712	chrome.exe	96
PID 5712 wrote to memory of 2596	5712	chrome.exe	96
PID 5712 wrote to memory of 3684	5712	chrome.exe	98
PID 5712 wrote to memory of 3684	5712	chrome.exe	98
PID 5712 wrote to memory of 4148	5712	chrome.exe	99
PID 5712 wrote to memory of 4148	5712	chrome.exe	99
PID 1812 wrote to memory of 5560	1812	e7c5f34dbbae4d49edee90f7ad98c6e548f50b8c86a9f6ce0b15e49491cafabd.exe	100
PID 5560 wrote to memory of 3796	5560	msedge.exe	101
PID 5560 wrote to memory of 1732	5560	msedge.exe	102
PID 5560 wrote to memory of 5532	5560	msedge.exe	103
PID 5560 wrote to memory of 5532	5560	msedge.exe	103
PID 5560 wrote to memory of 5532	5560	msedge.exe	103
PID 5560 wrote to memory of 1076	5560	msedge.exe	104
PID 5560 wrote to memory of 1076	5560	msedge.exe	104
PID 5560 wrote to memory of 3100	5560	msedge.exe	106
PID 5560 wrote to memory of 3912	5560	msedge.exe	107
PID 5560 wrote to memory of 3100	5560	msedge.exe	106
PID 5560 wrote to memory of 3100	5560	msedge.exe	106
PID 5560 wrote to memory of 3912	5560	msedge.exe	107
PID 5560 wrote to memory of 3912	5560	msedge.exe	107
PID 5560 wrote to memory of 4304	5560	msedge.exe	108
PID 5560 wrote to memory of 6120	5560	msedge.exe	109
PID 5560 wrote to memory of 4304	5560	msedge.exe	108
PID 5560 wrote to memory of 4304	5560	msedge.exe	108
PID 5560 wrote to memory of 6120	5560	msedge.exe	109
PID 5560 wrote to memory of 6120	5560	msedge.exe	109
PID 5560 wrote to memory of 1320	5560	msedge.exe	110
PID 5560 wrote to memory of 1320	5560	msedge.exe	110
PID 5560 wrote to memory of 3732	5560	msedge.exe	111
PID 5560 wrote to memory of 3732	5560	msedge.exe	111
PID 5560 wrote to memory of 3732	5560	msedge.exe	111
PID 5560 wrote to memory of 4740	5560	msedge.exe	112
PID 5560 wrote to memory of 4740	5560	msedge.exe	112
PID 5560 wrote to memory of 1724	5560	msedge.exe	113
PID 5560 wrote to memory of 1724	5560	msedge.exe	113
PID 5560 wrote to memory of 5132	5560	msedge.exe	115
PID 5560 wrote to memory of 5932	5560	msedge.exe	116
PID 5560 wrote to memory of 5932	5560	msedge.exe	116
PID 1364 wrote to memory of 1764	1364	msedge.exe	119
PID 1364 wrote to memory of 1952	1364	msedge.exe	120
PID 1364 wrote to memory of 4936	1364	msedge.exe	122
PID 1364 wrote to memory of 4936	1364	msedge.exe	122
PID 1364 wrote to memory of 4936	1364	msedge.exe	122
PID 1364 wrote to memory of 1928	1364	msedge.exe	123
PID 1364 wrote to memory of 1928	1364	msedge.exe	123
PID 1364 wrote to memory of 1928	1364	msedge.exe	123
PID 1364 wrote to memory of 4476	1364	msedge.exe	121
PID 1364 wrote to memory of 4476	1364	msedge.exe	121

C:\Users\Admin\AppData\Local\Temp\e7c5f34dbbae4d49edee90f7ad98c6e548f50b8c86a9f6ce0b15e49491cafabd.exe
"C:\Users\Admin\AppData\Local\Temp\e7c5f34dbbae4d49edee90f7ad98c6e548f50b8c86a9f6ce0b15e49491cafabd.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" https://google.com --disable-gpu
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5712
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x134,0x138,0x13c,0x110,0x140,0x7ffd9234c728,0x7ffd9234c734,0x7ffd9234c740
    3⤵
    PID:1228
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1644,i,4032850546294940608,11460511977534424161,262144 --field-trial-handle=1916,i,14730297055300933852,6041053290454694901,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
    3⤵
    PID:6112
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1500,i,12051833488566002595,2309435982075504336,524288 --field-trial-handle=1916,i,14730297055300933852,6041053290454694901,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5576
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2240,i,12496928599238422185,17342488946619986267,524288 --field-trial-handle=1916,i,14730297055300933852,6041053290454694901,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:13
    3⤵
    PID:4144
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3140,i,13680471889359004465,18053016803732744300,2097152 --field-trial-handle=1916,i,14730297055300933852,6041053290454694901,262144 --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:1
    3⤵
    PID:248
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3160,i,11226267570268181255,14698024549021215977,2097152 --field-trial-handle=1916,i,14730297055300933852,6041053290454694901,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:1
    3⤵
    PID:2596
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4608,i,11100917343266735262,10279409307152295175,2097152 --field-trial-handle=1916,i,14730297055300933852,6041053290454694901,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:1
    3⤵
    PID:3684
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3224,i,13950855027451519122,2862522164875355360,524288 --field-trial-handle=1916,i,14730297055300933852,6041053290454694901,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:14
    3⤵
    PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://google.com --disable-gpu
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffd8dd6c188,0x7ffd8dd6c194,0x7ffd8dd6c1a0
    3⤵
    PID:3796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,3069258451002923122,13307548073902636272,524288 --field-trial-handle=2828,i,7789514078827990781,11833182170801795080,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1624,i,17026316077797005711,12266972711346659944,262144 --field-trial-handle=2828,i,7789514078827990781,11833182170801795080,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:2
    3⤵
    PID:5532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2284,i,14555563708384631737,4131133480886681218,524288 --field-trial-handle=2828,i,7789514078827990781,11833182170801795080,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:13
    3⤵
    PID:1076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,16379426503489142250,3392817652150923719,2097152 --field-trial-handle=2828,i,7789514078827990781,11833182170801795080,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
    3⤵
    PID:3100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,7710101446347357762,16654118704742522534,2097152 --field-trial-handle=2828,i,7789514078827990781,11833182170801795080,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:3912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,5130114678520436216,7363948068028126309,2097152 --field-trial-handle=2828,i,7789514078827990781,11833182170801795080,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:1
    3⤵
    PID:4304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4160,i,9369121432968319213,16645208711653446655,2097152 --field-trial-handle=2828,i,7789514078827990781,11833182170801795080,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:9
    3⤵
    PID:6120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,5351870057037067557,9349157094067385639,524288 --field-trial-handle=2828,i,7789514078827990781,11833182170801795080,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
    3⤵
    PID:1320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5288,i,8219967753843245028,3110871180379213378,2097152 --field-trial-handle=2828,i,7789514078827990781,11833182170801795080,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:1
    3⤵
    PID:3732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3816,i,37615889698900765,4239216135937545006,524288 --field-trial-handle=2828,i,7789514078827990781,11833182170801795080,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:14
    3⤵
    PID:4740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3804,i,12987163227226482479,2487724418881212628,524288 --field-trial-handle=2828,i,7789514078827990781,11833182170801795080,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
    3⤵
    PID:1724
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,5083190993081616140,4731300913255962581,524288 --field-trial-handle=2828,i,7789514078827990781,11833182170801795080,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
    3⤵
    PID:2376
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,5083190993081616140,4731300913255962581,524288 --field-trial-handle=2828,i,7789514078827990781,11833182170801795080,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
    3⤵
    PID:5132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,10629531802051249590,17466409774391804961,524288 --field-trial-handle=2828,i,7789514078827990781,11833182170801795080,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
    3⤵
    PID:5932

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4692

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ffd8dd6c188,0x7ffd8dd6c194,0x7ffd8dd6c1a0
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,6957209685181823637,3761505221708809106,524288 --field-trial-handle=2824,i,13440117840470997195,13248470029248924577,262144 --variations-seed-version --mojo-platform-channel-handle=2852 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2372,i,3989800841637486786,7468034709640493083,524288 --field-trial-handle=2824,i,13440117840470997195,13248470029248924577,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:13
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,5194936030596759344,11647527431291976630,262144 --field-trial-handle=2824,i,13440117840470997195,13248470029248924577,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:2
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3328,i,15064870695934963299,10005120984282528458,2097152 --field-trial-handle=2824,i,13440117840470997195,13248470029248924577,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:9
  2⤵
  PID:1928

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log
Size 1KB
SHA256 de38fc6cd3100cf9b6cc583071595ea4f024eb6fc3f07f84032f69ec8b60f1ea
MD5 654044e3af119c9aa00f0ef27df9d582
SHA1 645ddf171a7a76a947babe138434b0ab60c7fc78
SHA512 6c000bf02b4650ef61cabeb0df722d411690e8b2693337c0158bd9e2c1fcc28f1352a365c4ac2efa245fa9a85d4fa55de17e488d8438e9ca70efd79e45ca7474
TLSH
T1E411262FE7D9C0057B8F80D621E7743581ADB0BE3E8CA7E26C85491BDB9D88D2614A30
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 b237022f5c50c2835340688615e0c32e4a4447d647c07fcfbf1c8cfb9dd9cb05
MD5 8f3b98e1bb095be5d8557326fe625729
SHA1 53bc243092524b8cd050b9e5a9c9ffc2741dbb69
SHA512 4b0c0d47653298b753a95910ad45295be3c555d5716992d2bf437df1e2715eed4f2b4ab39e7a80b7eb154bb0a150878735db99b4f916f5a28362b4b50af9414f
SSDEEP 96:5KC0d+oJm4V0FH+pqf+HBKyoytsRDotok5oHDFB6eGyvkonPob1v4a:MC0HJm5FHuPgXDUDq7W8nPobZ
TLSH
T126A12BF168694CBB59B7D345F8823A83DEA4A22769A1EF80D9DD1F0C01F31D81342527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 44233a8169c5af8b7a94348b48ed8cdaf8f3d9bd394d7b9c60a62acf8f9ab025
MD5 2e2d82a1014816f3df7e2fe0333b44c0
SHA1 971925213dbe137ab0931d140444fea04ca212b6
SHA512 2e2ea64868938cb766a7445275909bb792c7b35a8d9273a727713ff61085d7f1b4ee596d7e31fb81b64e8b8a223e2f31c6d606922d176a4e77b4173c5bf9b1ee
TLSH
T101D023203628FDC1F001613204E03300B1250433745AD74A3110C01CCC7418213F3CDF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 45fa8035e7ddc320cc1674cc0706ea9e2f6f77a795b07960840f5eace97c4fd3
MD5 778f1c21e41ec6c306e90b04de9d4f98
SHA1 afe62b41b1c8ce8500ce1332ede3b04644da43be
SHA512 5b06de33b32c6a1840c829331d8d7cfad7ad8e57aa74ed8981c6a66068dd27b0098403acb4c9fc1d61cccded2c85886402c9cb035ad4c9c19a93ff5a9ff86210
TLSH
T1FDD0C0203308EC01D042A13218C03311B1220833785ED7052020D01CCC7A24153F74CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab51bfd434f5e9d4e8df0cf36bdde321925b5ce87d623bf98f98d6c01579200a
MD5 2cc95474df5d27b5873236b7e909e780
SHA1 75351288c253c29378e10901cdec043a1277ab48
SHA512 3872c7e9119e2a1d83b96504f4c3e30e003d6ca5adc30d5e2365b0b9cfb4f2cf7b3f1ad4a2dc4fa29feb8fc97e830e47f81f93d2e1ebb3169eaecb3f3bce8ee7
TLSH
T12DD0C0203308EC05D042A13218C03321B1120833345ED7052020C01CCC7A24153F64CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log
Size 285B
SHA256 fff9c841af450dfefe7f284f645d4a26b048e6bd5709ad766b308172bc260a53
MD5 785c71b68bf89a0e9973e06d76434ab1
SHA1 2eb96ed892a724f5f223fe37abbd075d448d45e3
SHA512 a84d94a4b22d325a41b84c193a2e279bc3969085d87eda3fad0dc1032989bd26e67aba7cefa085838590e5aef8958c40e22a000d158fd80782b614dcdbc55030
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG
Size 319B
SHA256 f8363dbd0af43678bd423086ea4252dc075d59610d35bb97785dcc9abdb6cd2e
MD5 4ec12fa9e2ada9472fc8d1898ffd9a6f
SHA1 0a620b450b753290603321d39ae60e824c2ab6fe
SHA512 cb1a73de710ce8fabaa5edf98b76ea609a897757a9321037543e7c3464807749db531185643ce1f0aecd6f18bb888268bd04cf561c4a6d8ae992053b0d2447da
TLSH
T158E07DA425CCC33D9064F483E2A8974DC392750FE788B922770C8CC17222184B3CAAA1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG
Size 323B
SHA256 0409b5daa76ec72fe838eff8a8d7778a724a269904eaf5145b6a8efd82f1ae88
MD5 9d9bc336ed63387c9a7060052c94a4a7
SHA1 1e3a7faa926fe9b5318d3d385b7fac49143b79da
SHA512 f1a1ba30214c5b1080bdf510c8c34e17423708a12e03e1c16a516d361f18a9cc563c662560e898bc985139f8dbff05d17689df89ccd9b8419148a3f4987a5fa7
TLSH
T127E026A819CCC27D9064B8C38378A74CC3D2340BE288F922670CCCD07021280F7C6AA1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 61000ab541ecafc9aa9e7d1a0a0dc07ff0a982ae5a9b25dd54884b0b332661ad
MD5 0e5221f42abeb0aae6659a34fe4392af
SHA1 fe55c49403caa4abe56a6f381fe8e8043e21f10a
SHA512 138df4109a7cbcb18b1785ca211f66005d43c3b5b38b9c94d503e05329637d02f115a488b3d20d69cb5e99196220676f022f5dee3e408746482995692886f8a3
TLSH
T11BE086A407CEC27DD42468D3A27C7B4A87DA3447A798B912270D8C516111795F3D63F0
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons-journal
Size 16KB
SHA256 e5797dd2cbb96eab52ed5c60e429ca432582ee3009f7fcce6f56b4d35d4ebc4f
MD5 8e779ee0d61b078f3e90fbfabce3185e
SHA1 465a92ebb9270b668643557980656a34bdee9d29
SHA512 24fe45f4689cba67cb41a639b5185bdb2c86f1e9dca9105a58e5ae20d80d91aade03bde2de7bce4eec0123a83bb92c2234579a9daf6a70ebe4cec228ffcbb736
SSDEEP 24:XyLRQJY90+mhh0GY/l1rWR1PmCx9fZjsBp6Uw86:XNzBmw6QUF6
TLSH
T175728A175FB8740BDB620DBD2A7B1835993ED2685FB69C98386420618CF9483A4354EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
Size 40KB
SHA256 2ceaf2b8028593533c788fc311b67c15b74d2f3cfc8cdeb75700186fe4043aab
MD5 0af572f4c79a3a29265c4200b869a3b5
SHA1 c15baa47a79ac85c1f970dc868394d970da62849
SHA512 0fa5f8776c2b20328e138122355213a66801c76a8a3bef90e262d9a409023e92849e6bd19f27821a7fcaac4a236cf5653e38fc8e736c4468c4722d458738a567
SSDEEP 6:C5bjDEME1exIbjDEM+tF0/Bq9+uSCMPert4yFpCMRCIEdNaiTQNY/A/b:C5bHE1Q4Hg0pq9+L5PtEp5RodTd/Az
TLSH
T13E13E5C5DB106471C61F863DEE46CFB025285C697E6CD033A4580E6594869120374CF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 1KB
SHA256 a3d24236ca90180081137ea91a5a6a38a924c74a0feaf654b6a04179564c31a8
MD5 e5c4f2a14c14993b23ce91bd2f8f1b20
SHA1 a37c955d9e943926244b557cb70ec13a4b6ac1d3
SHA512 9be657349167bb5f14b30e7ac989f049e98f15c7802d19e0602f5b5402ed20eecbdac0f92936178d1888842b42e4ff2a0ea9cca5d922db7345a7d7718a5288d9
TLSH
T19A11D86FDFE9C05A764F40D624E7387AD1DCB0B9394C67E2AC450C1BDE9949E2918A30
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 5aeacf42fb490e7e0a89d2183c0434d4a67c2996e835b8750ec9d7901797fbda
MD5 32b9f9baf99dd060414c0f6c022ca149
SHA1 faa62d913f230e71f8249b9ce0ca3cdc2d4a917e
SHA512 183b6a2b8b0d722c54ca94b1c76cde1b469347406ef95a8cc0c9be088e5f69fee05f937f3298b3498b5061aea0d6d06e3fbb36b3bf727ac6e132798bb9001b30
TLSH
T159E026E007CCC27DA02520830338A78D82E47807EAC8BE026F01CF44A14250CF6965A0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 a9445d630be615c9a5acc735dd52aca89c9a93d25d2ba5c88485eef5b2d1ad3c
MD5 58ba1da1fd69dfb4fd1ef58da7b52ad6
SHA1 fc2baeb8008a34d4dde4695bc55afd15eef9a331
SHA512 d8b69ad26b0727f7c6720e99f47f65c563e105ab4a73f18a2ba17e71dadfa6ac0e3ec2a773644f2e27f6d00bfc54956fe8d33340b9bf97805750be9efa5e4454
TLSH
T141E0207017CDCB3FA15B308B9219FB4CC5E27416D6C9AD216F0CED5062065407347E60
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 194B
SHA256 f9a497be96dcab58091e4d5d2389fea3cf4fbde7f8e2e4abac7010cb35ca84ef
MD5 b3b74961bff7ab9fc0f4f3a57f637184
SHA1 1f77ba6e313bc4c498df1c7c4157d79e3df685bd
SHA512 7cedf227788ff68e18579e70187c3dff712652063f322be6eba969f768f719ae9ee7b52c721ce92b7717c29c7e58e480a8739cf862cef123b87ff0b11ebf3c2c
TLSH
T14AC04CD55A903023FDCA59390DAB53041B20C4752F74CE57D28430901C0A285FE61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 c7e47bc1fb3e4bc9b729123d63c86bd45cb9a5a9989fd4a309519e14c67fe202
MD5 c2749688645bcaa28a9216cde80ea179
SHA1 f91f9afc90750997bc3a3990dafd2ad29c915d76
SHA512 ac2d5d50e5f2364f934de270c3aa57661587895867f5d7eb2b71f6db643772a50133b052ea07c014821127a7639904522375b5c3a78b0e8921749755387d2370
TLSH
T17FE026B07ECCC73D981060A343A8BB4DD2F17D0793C9BB02A7085880A111198B3AE9B0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 610e56ff7b58616a121c724387b05793b5291ccb0d6548927c80ee0316e62795
MD5 0be5d0c149acd5a423a0f12456d9385d
SHA1 7a0e5f264d2af660718c3535797dc2d06c50f3dc
SHA512 bb065bd7853b24020610464a49ef1f33d59bf578f076e1985f808f1f24a98a40715fb0ed2b157a7e9b9682e0da9497a9cfce059e34cc315720fb75d96d17142f
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHWLa2Q44eWIdFgWeK4rgEec+W10m/Hd0dp:CbEBVj5JAdSp9/EgTK7j6dJOHWLa2Q49
TLSH
T1D1917A04313A0650B87E760CC1BD9C2E82C574723519E52B3FAC06960F6AE47ADFDAD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 769a3eb5e4f91baf54eacfea3aa594d2de7b961d6407012165522c65e4984319
MD5 7905b6971cf61198bbe95dc79cdd5c3c
SHA1 acf6558e10d0cbd5dc41618b784e1aabd29124e8
SHA512 5398f7e446fdc9a685d78a63f9361275c394ac62f781a691c95472931813b62944b8ccd5e47542cfa3f5a783ea346681b06c6b115ca5235e0053866cbf9bde6c
SSDEEP 384:DNrRZyCSDnxTICYMEhIKyll7svbFKfk7:xFZJSDniwyI1l7svbF9
TLSH
T1EC44640A7B747001EDE2D9725CB080771E3CA16E8F22E6815DB654694EB3853A63D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db-wal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal
Size 1.6MB
SHA256 628659800fe3c8f2c13a9bcf612f56787bd0163335d71b96b7828a34d2f50e89
MD5 1d6e3a940267ac0bfb80052a71bc1684
SHA1 fe7494ebcf89b74f0290fcd075ab27c3a704d85b
SHA512 1cbf24006843485fcc0a423a71a56d5a474bbba6dc6ffd9bb73c17a6f89752118c54adac9a008e17f07f03bc05c8a24e47b55b8daec80b540e15c6ad5838e6b1
SSDEEP 6144:Yfdyo+8y27pQ3YKQglArJQB9VB/7AHVkShDwVifoKhPEMrIWj63Os/OrwouUonzL:x
TLSH
T1BA7536E7AC054263DDC85138A90BFF81253352719768D8D9BE7D48D37F3AA067CB8682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 215ae0de721e0335cd1867f194f830a144068dbbcc99407bb316853ad828b3c5
MD5 b6ce4e13b86d3a1ed57ddccf6aad5e60
SHA1 f548f8481623842d753f397b891333c95615b5ee
SHA512 35cb30937a12243ef2ad534488e05ec3955e08d5ec26218093e32a7c52fedde85408e51c3f0b86a62dd66e29a96ecb41f2c0fce259b23a28ffde7601f27e07fa
SSDEEP 192:/T95QkIIIbbLMIMNsYcYqoOyJAsfl8HECsA1:bQkIIIbbLMIM2BVyqsdas
TLSH
T10642555F36052B77C06E5F7A137A82949AE848810072A52D7362AC1F8DF3F9783C52F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 f1d807735821e8216f8b91388946402d9e8c44faaa41b3dac37c23e64cce6aee
MD5 5145cb12fb03e251134b223d4066dfd9
SHA1 ba037b3a119332b75f2855f672b82cdd241589e7
SHA512 27affe1b20741945158f7dc175fb9102d390c3264baffb3a5512ab8db9dbbfd944ab0ecb0f742995568829f8fa6273a6daa165a39fee48c60a555644969336dc
TLSH
T17EE0206097CCC3BEEC6530D711186749C3C33447EEC469152F00C548B4012C073C5272
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 14a4b7f5316ea40309f16fc29d4015c1b019ff031d43aff40f3edd9ad5d9a56a
MD5 c5aca2710517aae8102abc18cac359d7
SHA1 581208d45caa8b9cd8dc221589ddfbda19384518
SHA512 4ba0c78a66fc5928c03e435a9ed02e6c562c9cba202431ae8b18795a9dffae26c2811fe2320d5d008ba8314388fc752395db62c7845076d2eafef8702cf03ead
TLSH
T18D21A156F330C448E159C67E507F9B361738E8168FBCED0F457A20686E76B140E4B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 b0852ad6ffcfb85d4bc666e42b5f301e23a1be1bfd4841a8193b606f1e22a4ae
MD5 093e66c299d10451525ee6011cb1a992
SHA1 97d8038f15ecf78b7d01be034c46fc5fea66901c
SHA512 8a2063b39189c02fd11ae65f8634f2a8c30ef3e8b4db895f697d9c8d5427b78024680df4d8c476bb2324ccc6e8d9536909bd69910526aec2bb980405c03d96ff
TLSH
T18EE0D86066C8C2BF916130830268E78CD2933817FA846E112F04CA4461013C1B386273
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 eaec5f0124c0cc7084d70639c3df2bfdffa2c08bb5170644c6bdf857fda13741
MD5 0cc67a57489acdaf9c426bc799c7596a
SHA1 26ccdcf55fb89fdb5aa2510643d4602007b08a36
SHA512 4242be164db4723fd3e435708b7e0d916780be479308812845f714c512540cf75a5164a0d56a1b86c12f28716412b296ffb82e0dfda610370b4931cb732b5472
SSDEEP 768:Irv+4UNbdD3vczNp8+p3bd66j+4BRv86aLIiy2bwCl1:Ibsbp3mL8+p3Z6n4yE0ww
TLSH
T1BC03CE73F99899739CF6C644B2467B837FF851A39AC10AC0D4DD2B4E415A19E630BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 3ddcac9f74c2c2a6cca90ec51d4aedd7f55497a52d76483a6ed86cb42001971a
MD5 c2a4c2cb09cfa135d7101e8a5e32989b
SHA1 bc04c2e1c8a01b8a2002814efc90eb59e848410a
SHA512 1e6bcdfb3fd0b84830956c2d31c48389512aab80f815f22e01f3f81acd6bc9e527328970b8524dc494b98a89d260d534e27d621935fbca4dc20c92abbf8435af
SSDEEP 768:drv+4UNbdD3YVF2Np8+p3bd66j+4BRv86aLITL2bwCl1:dbsbp3/L8+p3Z6n4y20ww
TLSH
T1B103BF72E9A8A9739CF6C644B1467A437FF851A396C10ED0D8CD2B4E419B19E630BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 86c1ea70e3607ca7202146e7bfa5579d5bbdd768c45f565a34e618a7201a1009
MD5 0a438a1dea792e67b6a48fea365781fc
SHA1 821d420097a07d10eed7048c356de4b5d977c18a
SHA512 24e34d8f700bffa8310f781f38f1843c927a53da258581733d074046928259b9f9619229f32c2a8ecb20adc8ae39f9df4f9241518487695f66d7e23f29adf9e9
SSDEEP 768:prv+4UNbdD3J7FTkep8+p3bd66j+4BRv86aLIYd2bwC3:pbsbp3QY8+p3Z6n4yN0wc
TLSH
T1B313BE76E5A8A9739CF6CA44B1467B837FF821A385C10ED4D9C96B4E414719E230BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 3dc9043838386f5363ac96a01477cf3163b5118b80191576a11b32ce9894314c
MD5 cdddc745a8c954dc438c931889999bdb
SHA1 7908f975b6815460caa2bc3438efbd8fc8d36211
SHA512 3d2d4852aa2ac6cb0b9b6cbca9f04366afd48d362d869be877ef324c16d72ff119b5842891baa2b6b99df2de2db8d3be5c23f0f97f8943bd74195996bcb66a0a
TLSH
T159A02407C473C00FF4144051C45C034114F4C047011DD0115070D33714D40CF03F5C35
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1812-5-0x0000000140000000-0x000000014005C000-memory.dmp

Download

memory/1812-6-0x0000000140000000-0x000000014005C000-memory.dmp

Download

memory/1812-2-0x0000000140000000-0x000000014005C000-memory.dmp

Download

memory/1812-303-0x0000000140000000-0x000000014005C000-memory.dmp

Download

memory/1812-304-0x0000000140000000-0x000000014005C000-memory.dmp

Download

memory/1812-0-0x0000000140000000-0x000000014005C000-memory.dmp

Download

memory/1812-1-0x0000000140000000-0x000000014005C000-memory.dmp

Download

memory/1812-307-0x0000000140000000-0x000000014005C000-memory.dmp

Download

memory/1812-308-0x0000000140000000-0x000000014005C000-memory.dmp

Download