2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe
Size 5.2MB
Sample260831-mx8skshk61
SHA256 2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da
MD5 4d2e4a88eba99d04375a39fa8f6a37e4
SHA1 4626b22885fd921790a2bd8117b23996ec1c2add
SHA512 1c418e8f1cb1f3c87c321310e582d7b8128e5e9a243d793027b52415ce1b6834743ab8d606e5dd96feae665b20cb9e89241d6e5ae70374b718712786621fa8c0
SSDEEP 49152:s1XldMam5pQ1Pzs3kB5YddLtVMwggonnpeD1z6:lFpqJclLIT
TLSH
T190465B0B7A5412A6C955CA3045B75272EB34BC8CC73533F36E4666B46F7A7C22DBAB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 4 IoCs

description	pid	Process	procid_target
PID 2020 created 5552	2020	2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe	88
PID 2020 created 5552	2020	2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe	88
PID 2020 created 3908	2020	2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe	115
PID 2020 created 3908	2020	2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe	115

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2020	2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_3908_1340600981\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1893783937\_locales\or\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5628	chrome.exe
2920	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134326471314185801"	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{93A35595-7976-47B2-9798-0267EE9A05D6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
2020	2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe
2020	2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe
2020	2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe
2020	2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe
2020	2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe
2020	2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe
2020	2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe
2020	2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe
2020	2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe
2020	2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe
2020	2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe
2020	2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe
2020	2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe
2020	2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe
5552	chrome.exe
5552	chrome.exe
2020	2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe
2020	2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe
2020	2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe
2020	2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe
2020	2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe
2020	2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe
2020	2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe
2020	2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe
2020	2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe
2020	2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe
2020	2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe
2020	2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe
2020	2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe
2020	2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2020	2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe
Token: SeShutdownPrivilege	5552	chrome.exe
Token: SeCreatePagefilePrivilege	5552	chrome.exe
Token: SeShutdownPrivilege	5552	chrome.exe
Token: SeCreatePagefilePrivilege	5552	chrome.exe
Token: SeShutdownPrivilege	5552	chrome.exe
Token: SeCreatePagefilePrivilege	5552	chrome.exe
Token: SeShutdownPrivilege	5552	chrome.exe
Token: SeCreatePagefilePrivilege	5552	chrome.exe
Token: SeShutdownPrivilege	5552	chrome.exe
Token: SeCreatePagefilePrivilege	5552	chrome.exe
Token: SeShutdownPrivilege	5552	chrome.exe
Token: SeCreatePagefilePrivilege	5552	chrome.exe
Token: SeShutdownPrivilege	5552	chrome.exe
Token: SeCreatePagefilePrivilege	5552	chrome.exe
Token: SeShutdownPrivilege	5552	chrome.exe
Token: SeCreatePagefilePrivilege	5552	chrome.exe
Token: SeShutdownPrivilege	5552	chrome.exe
Token: SeCreatePagefilePrivilege	5552	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
3908	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 5552	2020	2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe	88
PID 5552 wrote to memory of 3776	5552	chrome.exe	89
PID 5552 wrote to memory of 4112	5552	chrome.exe	90
PID 5552 wrote to memory of 5628	5552	chrome.exe	91
PID 5552 wrote to memory of 4112	5552	chrome.exe	90
PID 5552 wrote to memory of 4300	5552	chrome.exe	92
PID 5552 wrote to memory of 4300	5552	chrome.exe	92
PID 5552 wrote to memory of 1924	5552	chrome.exe	93
PID 5552 wrote to memory of 1924	5552	chrome.exe	93
PID 5552 wrote to memory of 2344	5552	chrome.exe	94
PID 5552 wrote to memory of 2344	5552	chrome.exe	94
PID 5552 wrote to memory of 3528	5552	chrome.exe	96
PID 5552 wrote to memory of 3528	5552	chrome.exe	96
PID 5552 wrote to memory of 2468	5552	chrome.exe	97
PID 5552 wrote to memory of 2468	5552	chrome.exe	97
PID 5552 wrote to memory of 1424	5552	chrome.exe	98
PID 5552 wrote to memory of 4732	5552	chrome.exe	99
PID 5552 wrote to memory of 5464	5552	chrome.exe	100
PID 5552 wrote to memory of 4732	5552	chrome.exe	99
PID 5552 wrote to memory of 5464	5552	chrome.exe	100
PID 5552 wrote to memory of 904	5552	chrome.exe	102
PID 5552 wrote to memory of 904	5552	chrome.exe	102
PID 5552 wrote to memory of 3420	5552	chrome.exe	106
PID 5552 wrote to memory of 2888	5552	chrome.exe	105
PID 5552 wrote to memory of 3420	5552	chrome.exe	106
PID 5552 wrote to memory of 5268	5552	chrome.exe	107
PID 5552 wrote to memory of 2888	5552	chrome.exe	105
PID 5552 wrote to memory of 5268	5552	chrome.exe	107
PID 5552 wrote to memory of 700	5552	chrome.exe	108
PID 5552 wrote to memory of 700	5552	chrome.exe	108
PID 5552 wrote to memory of 2892	5552	chrome.exe	109
PID 5552 wrote to memory of 2892	5552	chrome.exe	109
PID 5552 wrote to memory of 5096	5552	chrome.exe	110
PID 5552 wrote to memory of 5096	5552	chrome.exe	110
PID 5552 wrote to memory of 1832	5552	chrome.exe	111
PID 5552 wrote to memory of 1832	5552	chrome.exe	111
PID 5552 wrote to memory of 6000	5552	chrome.exe	112
PID 5552 wrote to memory of 6000	5552	chrome.exe	112
PID 5552 wrote to memory of 4684	5552	chrome.exe	113
PID 5552 wrote to memory of 4684	5552	chrome.exe	113
PID 5552 wrote to memory of 4280	5552	chrome.exe	114
PID 5552 wrote to memory of 4280	5552	chrome.exe	114
PID 2020 wrote to memory of 3908	2020	2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe	115
PID 3908 wrote to memory of 2892	3908	msedge.exe	116
PID 3908 wrote to memory of 1572	3908	msedge.exe	118
PID 3908 wrote to memory of 2920	3908	msedge.exe	119
PID 3908 wrote to memory of 1572	3908	msedge.exe	118
PID 3908 wrote to memory of 1572	3908	msedge.exe	118
PID 3908 wrote to memory of 5392	3908	msedge.exe	120
PID 3908 wrote to memory of 5392	3908	msedge.exe	120
PID 3908 wrote to memory of 4248	3908	msedge.exe	121
PID 3908 wrote to memory of 4248	3908	msedge.exe	121
PID 3908 wrote to memory of 4248	3908	msedge.exe	121
PID 3908 wrote to memory of 3300	3908	msedge.exe	122
PID 3908 wrote to memory of 3300	3908	msedge.exe	122
PID 3908 wrote to memory of 3300	3908	msedge.exe	122
PID 3908 wrote to memory of 5152	3908	msedge.exe	123
PID 3908 wrote to memory of 5152	3908	msedge.exe	123
PID 3908 wrote to memory of 5152	3908	msedge.exe	123
PID 3908 wrote to memory of 1984	3908	msedge.exe	124
PID 3908 wrote to memory of 1984	3908	msedge.exe	124
PID 3908 wrote to memory of 1984	3908	msedge.exe	124
PID 3908 wrote to memory of 472	3908	msedge.exe	125
PID 3908 wrote to memory of 472	3908	msedge.exe	125

C:\Users\Admin\AppData\Local\Temp\2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe
"C:\Users\Admin\AppData\Local\Temp\2b4e7eb785b408a59c4c283c27d75cda042e47d7466061439258c6d76f6526da.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" https://google.com --disable-gpu
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5552
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8370fc728,0x7ff8370fc734,0x7ff8370fc740
    3⤵
    PID:3776
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1648,i,2302800612669289129,4001880280276370456,262144 --field-trial-handle=2012,i,2556814621514082283,2943086118747043148,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:2
    3⤵
    PID:4112
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1892,i,7088901106960322308,29273609564199581,524288 --field-trial-handle=2012,i,2556814621514082283,2943086118747043148,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5628
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2992,i,5107226057797422058,3389666617970490739,2097152 --field-trial-handle=2012,i,2556814621514082283,2943086118747043148,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:1
    3⤵
    PID:4300
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3000,i,13310907440978071330,16876866115317816337,2097152 --field-trial-handle=2012,i,2556814621514082283,2943086118747043148,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:1
    3⤵
    PID:1924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2248,i,16630860688540258053,5970609072667830873,524288 --field-trial-handle=2012,i,2556814621514082283,2943086118747043148,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:13
    3⤵
    PID:2344
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4212,i,16707352787325328212,14013234856235079975,524288 --field-trial-handle=2012,i,2556814621514082283,2943086118747043148,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:14
    3⤵
    PID:3528
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4380,i,12238178852049187572,4918276884313444405,2097152 --field-trial-handle=2012,i,2556814621514082283,2943086118747043148,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:1
    3⤵
    PID:2468
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5108,i,14722837738520138716,11874468602940395782,524288 --field-trial-handle=2012,i,2556814621514082283,2943086118747043148,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:14
    3⤵
    PID:1424
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5296,i,2573900045099339103,45499930129908145,2097152 --field-trial-handle=2012,i,2556814621514082283,2943086118747043148,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
    3⤵
    PID:4732
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5336,i,14587097061233097362,1009871044346574226,2097152 --field-trial-handle=2012,i,2556814621514082283,2943086118747043148,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:1
    3⤵
    PID:5464
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5288,i,16897465880730096750,16514435635302502896,2097152 --field-trial-handle=2012,i,2556814621514082283,2943086118747043148,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
    3⤵
    PID:904
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5736,i,15276995548849394638,17411574844830267944,524288 --field-trial-handle=2012,i,2556814621514082283,2943086118747043148,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
    3⤵
    PID:2888
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5728,i,14862475848704422667,16209551088299016801,2097152 --field-trial-handle=2012,i,2556814621514082283,2943086118747043148,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
    3⤵
    PID:3420
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5812,i,14714100846268108737,7325335101637356573,2097152 --field-trial-handle=2012,i,2556814621514082283,2943086118747043148,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:1
    3⤵
    PID:5268
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6212,i,9181697054643067344,8492918519787449267,2097152 --field-trial-handle=2012,i,2556814621514082283,2943086118747043148,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:1
    3⤵
    PID:700
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5552,i,13388063834872595614,9412638530028803019,2097152 --field-trial-handle=2012,i,2556814621514082283,2943086118747043148,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:1
    3⤵
    PID:2892
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5228,i,1250576358046739944,942158617197301606,2097152 --field-trial-handle=2012,i,2556814621514082283,2943086118747043148,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:1
    3⤵
    PID:5096
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5820,i,1688825486455374409,1166206230169351966,524288 --field-trial-handle=2012,i,2556814621514082283,2943086118747043148,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
    3⤵
    PID:1832
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5804,i,1214657821610466405,16063030211276976874,524288 --field-trial-handle=2012,i,2556814621514082283,2943086118747043148,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
    3⤵
    PID:6000
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5288,i,5249214299888345172,7682382564644771360,2097152 --field-trial-handle=2012,i,2556814621514082283,2943086118747043148,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:1
    3⤵
    PID:4684
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5448,i,6406311482723824029,12385849736309755550,2097152 --field-trial-handle=2012,i,2556814621514082283,2943086118747043148,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:9
    3⤵
    PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://google.com --disable-gpu
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ff82521c188,0x7ff82521c194,0x7ff82521c1a0
    3⤵
    PID:2892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1988,i,14006660580548355549,14878107799052586579,262144 --field-trial-handle=2536,i,74440536970479551,579283517707382334,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:2
    3⤵
    PID:1572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2124,i,10715217420798728475,13159248197755678852,524288 --field-trial-handle=2536,i,74440536970479551,579283517707382334,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2624,i,3638518449797305858,11176836894591913113,524288 --field-trial-handle=2536,i,74440536970479551,579283517707382334,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:13
    3⤵
    PID:5392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,15942628063809701819,12600017554686605730,2097152 --field-trial-handle=2536,i,74440536970479551,579283517707382334,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
    3⤵
    PID:4248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,616405176349801022,13574133994485695026,2097152 --field-trial-handle=2536,i,74440536970479551,579283517707382334,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
    3⤵
    PID:3300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,963703433646373190,16602079803945293127,2097152 --field-trial-handle=2536,i,74440536970479551,579283517707382334,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:1
    3⤵
    PID:5152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,16018622392059239126,7534832863636974038,2097152 --field-trial-handle=2536,i,74440536970479551,579283517707382334,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:9
    3⤵
    PID:1984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,15218091549119070780,6404444777140975063,524288 --field-trial-handle=2536,i,74440536970479551,579283517707382334,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:14
    3⤵
    PID:472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3760,i,15495671222171451665,13898259087477285314,2097152 --field-trial-handle=2536,i,74440536970479551,579283517707382334,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
    3⤵
    PID:2376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3808,i,14901362751914937432,13050770509134966543,524288 --field-trial-handle=2536,i,74440536970479551,579283517707382334,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
    3⤵
    PID:5404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3804,i,17158556959334457506,14042806716647081483,524288 --field-trial-handle=2536,i,74440536970479551,579283517707382334,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14
    3⤵
    PID:2096
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,10565523492739060057,9132164432783535055,524288 --field-trial-handle=2536,i,74440536970479551,579283517707382334,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
    3⤵
    PID:700
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,10565523492739060057,9132164432783535055,524288 --field-trial-handle=2536,i,74440536970479551,579283517707382334,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
    3⤵
    PID:5568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,654818452174391580,16703908995424997887,524288 --field-trial-handle=2536,i,74440536970479551,579283517707382334,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:14
    3⤵
    PID:4564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,3394386626552815910,18441093754528958635,524288 --field-trial-handle=2536,i,74440536970479551,579283517707382334,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
    3⤵
    PID:3944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,10401923233521610129,750563746442069982,524288 --field-trial-handle=2536,i,74440536970479551,579283517707382334,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
    3⤵
    PID:4992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,17217342489627150134,3289118070180707314,524288 --field-trial-handle=2536,i,74440536970479551,579283517707382334,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14
    3⤵
    PID:628

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4696

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log
Size 1KB
SHA256 bb5420220a28a8279c7ddf2b207c399f389301480fd025dda62e570df38eb81c
MD5 9cf5f2e5147fd4b1da715d553994e521
SHA1 78a82799962ffd985f690fc165e2edde1aca985a
SHA512 4de3f61aa059de49b43cb724f9726c76b976bf62a4462ce1e2892df83893388ef276656114c182476ebf388634fbeca87e69718d80ad1bef41abcad218cdb51b
TLSH
T19321306FDEE6C0057B8E80D620D7352581DDB0BD3A8CB7E2AC454C1ADF9D45E1914A70
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 ba35d16a20ced5a9ce4a26c82419e4f15e8f23e29a1dea382c37425eaf9853a3
MD5 054bad3f7d5073a4c5ef219b240846a6
SHA1 e1a6bbb7f9fe2f18761a56938129e98dbba2d66f
SHA512 f902ef9877343d4748fea8486917cee9fe29ff073dfed16c32cfb2d375da33a00bc80d042f9faa8fe211c7b4f52340ef704d7464788f31116c10f4771ed0c884
SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2OfpX6ehqcVum8wkRH:jeuvBnhJsueMEGvIW1DcP2Opv7Vum8nN
TLSH
T1B2D3874B3A743102EDE59E721CE051BB5D3CB16D4F15A5D428B620688EF2863B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 dcffcb3384ee30f3238bf8050c7222affb20fa90a0cca21878ca1ebbfb0220a9
MD5 9619b34ac52a7736c6734a3ed6cc2936
SHA1 8aa0ef1a69b223618f6d25e804b65f319296465c
SHA512 8fb1ba9553ed4226c969b6cfaf71888e5a41b6a725fdc03721f5dfd88d4e3b98e3c8da2adc68c644682f8531888e0f9c8e7219649f61361da6873715863e20e6
SSDEEP 96:xC0d+EZUAbKFKu0d6aF7QuGJfmbE13IERDotok5nlD/B60GyvnnXV+lbKmb0v4a:xC0PtbKFKu00UUSb/iDUDNJECXAlbK7
TLSH
T191A12A72A8698D73597AD649F9A22B03CF74E02BAD22DF54D9DD0F0C14FB1E80342627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee00825bbd5a4f21308ad2e10e5a9d3c4512f07fbd288ec8ac76788de6019e25
MD5 c3584e6bc22b3ad2f168ede48d20a993
SHA1 ffb4ecef8f65638ca17e16a32806195193977c7e
SHA512 5fd777359305e67e9f30fc404af9013a876846b1d6db271fa73dfcf2ee22fb25a8e26d4d0c970cc3a8219df11038dc6b4c2c411db652593bda1c3d7643753c0b
TLSH
T18AD02B7637C40404C0D0747621F34602D530C520584C81088801B03CCC207C3010A8DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c80f71026fa07cc9b3e69c8779d4b4b40710cf7bc2893b740943db0d0f79591a
MD5 590eca05f11ec72644a09f205b548fbc
SHA1 c6521700bee3b500259ee3a70292b90201f20597
SHA512 fddd457c35c61ceb727f99bd39f55314cdeb7d062798c573a377675121f972ed95109fec329f911c502139a1794b70e5a98a57dd3b21b5a70e6518890a361f66
TLSH
T1E7D02B7A37C40404C0D0747221F24602D530C520AC4C81088801702CCC207C3010B8EF
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 1KB
SHA256 fc4e0b98948471a0e35b64eb35aea1f62b458c81639a98732869bfd1a8fcd284
MD5 9f4e5d9a9cde18468fff4710a9de0c9d
SHA1 47115208c13da75f6a30fc8bdb106e8a642069bb
SHA512 da92a733d75ae3ad0c3e13302098373e7552eb04f339b493f01cc65d1becdef54616d77bb87d8a3c08d65a1544c8a9c27718080ad5c7f5aea8be0ca7da41d438
TLSH
T170214C6FDFE9C01AAB4E80E52593343AD5ADF0FD3A8C77E22C440C1BEB9D48D1914A60
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 578b518101e694a72c68a20dce7d70c97f205b3798466edab78fa2d9525eeff4
MD5 1bc70f74b970c5ede12bd4ed0fce26dd
SHA1 41a59603101d423fddc62e3f3e8a6b5c67904f30
SHA512 57ea2871e47a67b2c3c00285fb725bf0f3257ed84ad5459017b351fa1971dc6a0eaffd78a394cb08b0f363eb587177ba96d10a9204a02f368cd0df273eac2771
SSDEEP 48:Txk/LopFMaty423w/a9NUuTmOwtLtAsozwnZb1mJj4FZcH9hQtwJNowfhMpt00Nm:qDeMatha98OqGO8MF89fYl9ls
TLSH
T1F8B2A5CE1F216202D0F85B37FDC0419A3D6C003C5763A9A9EA94A0B39DE25DFB702067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 02c1645c0400664972259ee0497ae20f53b856b4b6c57d641b13105a472c946b
MD5 460be0d151a262dec767fa77d8ebff6a
SHA1 57920ac2ebadb241dd182673656a0bd3e061cb33
SHA512 3948a620155a95bc576b23799503efaf3047c4aacbe5b120b699298b576aa11655f63f13aac1999fa277f7be08d442b77d96380b831cd3e3c4950430100825a5
SSDEEP 192:sxRjRcCR/f8sYxS+ZISxzoA8pjvL/g6+WN9yn/YZFLgEMG6IgVhF7J:sxRjdR/f8sYxS4Itf/56/SQ7
TLSH
T1CF42C716AD28A93B5CC7D20DFB55BF53D2F95032A1A15E48A6FC8A1C14EB7DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 692e8187c7c8c3637d8ad14e22205493e66cff219572c5a5e81f5d530ac1c12f
MD5 ad3b0af18e3c952da517f1825d94a93d
SHA1 a64bd0ad6b4d186bbe152b3049841a56784d3a3b
SHA512 25a58b742c3e750a483352d8c20f75ddcbdfba704ab1fb1011e720cc3c75f6d65877f95de5668ef15e9936f314606a0dfcfc932f53aef3fa2ce3e42ea6bafc37
SSDEEP 192:sxR4RcCR/f8sexS+ZISxzoA8pjvL/g6+WN9yn/YZFLgEMG6IgDehF7J:sxR4dR/f8sexS4Itf/56/SQU
TLSH
T10542D816AD28A93B4CC7D20DFB55BF53D2F95032A1E15E48A6FC8A1C14EB7DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 c6f9f52acefb5558093cd686ea43f9645db315ece9c435ff43e7224bd6a5aaf9
MD5 406f7e47d7d692621fb98a4dac00d52d
SHA1 8cd00eb7e392dba8ab1a9158ebfa3974873bdd94
SHA512 c0926e126f820288949f8f586b423a41c2c2b8821daec9c8bb7aa8a8d3d787d22535aec2720c431f7b2f1588b15d65f809a8ffae9c61d533ca3f86a7990b7b87
SSDEEP 768:K80Ec87pLuLzrwWgNhfVN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVBAowLW6roLNn0:K80EcgEzrwWgNhfVNu1jaKAogWxLNn0
TLSH
T187D2D97B640DCA7E4F804ADDEC197E9B6DA802CB96D8CD4047FE851C03C6BEA511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5788e818ab7c465e_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\5788e818ab7c465e_0
Size 191KB
SHA256 b5d60f477631f6505117093a8f425211cd4ec9f7d11d6e1a564677f8a297c6ba
MD5 ffbea1c4d99716026cc9d4d400697be9
SHA1 7694ba30baf0cb7d0ce19314251f522ac1023d62
SHA512 51d7c19002ad84d81bd2a018940a01ea841a152e0bae43eb2ff81e388f280d10e8377f96dca0b7d5fcf58cd287822c65ef02d098cc89b41e2b730a5c73393b65
SSDEEP 1536:Xo/ANGJTtVk4iGmUBDznBChn/jSIClB/wCULnq2W3670mRovNarJUuB6sIncU8XO:cSXUVzB2SICY10HobVIP8XrjvyPP5
TLSH
T1BC146B715200F47BB913DE60A67E7F4E3C39A16BDD0686FCA5D4E870AAD2DF20521B48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 4b01e4fc01100b806a67cec0512cd08651d1bdddc782536217e8a221d2d923b7
MD5 b191793b1893593be63b8166bb0b1f89
SHA1 bfc0489e2d16903ac2ae1432aaecdccf08bf4fe2
SHA512 387168f317ae4bc316886e0eeb032cd45d02486c7e204921e2055853bec4766169516d0dd3031b706e7faa86c7aca4bd8fdac1712ad92ece1526a78b21a333e2
TLSH
T1A3A0022407D11940E9001BB4146B0F651FC06C100461C72340911874C8B3491C915152
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9f3c69fcdbaccc3d111aa5e585568cf9935f960fac76fd74b1d120b49fe53aef
MD5 0dc453752e1ffda8e575fdd332419370
SHA1 b198ccc7f2d6c55213b22db3c89dc14309c7755d
SHA512 bf8a2079f599f36a00249078de00264642e2a43a6f6d8c4aca6b3031999491b7e211d93d16215df9e86fa5468c24a8f1f5396afba38b6211af3cf5eeb575836f
SSDEEP 96:KRT8ZNbRRtWFKAg1tK4MgbtcjbylxWH+zC+4AwmWgFNg+mK4jg8mc2edsKOzCuAL:CT8ZNbRRIFKR1nMgbCjbylxWH+zC+4A4
TLSH
T1B291D21071BA1291393EBA0D85A49C6F978674F23019E52B7FE951E60F67E024EFC8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 133d979e1a2309bfeaa277340f06d451b872bd8e97bb1a403d0a016c8dcdf1ab
MD5 b460702046a214131ea14651b0217158
SHA1 c88405455dee84c4257780b5a48224c0f7cf3497
SHA512 2a42d71131fdbca1bfbc03ea82c475ac33b77522cf9030577d861c5f3295e6cc1a9f6afd054a69f5fdfd907ecc368a28f777be9b55988b979188956f1efabca6
SSDEEP 384:DNrRZyCSDnxTICB4MEhIKyll7svbFKfk7:xFZJSDniI5yI1l7svbF9
TLSH
T10E44840A7B747001EDE6D9721CB080771E3CB16E8F62A6916DA254694DF3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 74f44c1421863bfacc25d4acbe531f90840545a18d7f7784a75606f327897daa
MD5 6981a5a3c2bd4bd1f54cc1c11d8152f6
SHA1 ef2d6a3ab07e8f7bbe1a77d1651d967bbbc0d708
SHA512 104b430d0bb181ae31533b7a4af5170cd5454ed81725ff171682fb50a2dc92890eedbaf0ca338c879cc7fdd1917f467665b5944ca9572dbd94a61783063bd896
SSDEEP 768:grv+4UNbdH3cm1+LeSFOUWX4fouOToPvB2thtA9VAwReVH1SlX:gbsbh3cysnnwthtt0EH1Y
TLSH
T1C003CF32A8A88933EDE6D398720B75472FF4816396900FC4DADD1B4D079B9DD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 f019104081d5e3b86e09a659c12b01b7b2372495f9d1ea6c92f8000badcdc9d7
MD5 f95b13b37a9473481b59eb1737085ea4
SHA1 360d8ab9c4179f3a6bbcc7093485be9f3e590c1f
SHA512 e6a511915fcb65dd4bff6c4321e6eb49f49304a855ea4452624ff5e0e278f1ece9d5cbb9999ea9264621b9d31081dacdbca6e20d6d12b8087f102e72548fb45f
SSDEEP 768:Y03Fd6z+LeSFOUkdFX4fouOToPvB2thtA9VAg61:Y03FdCsnnwthttH1
TLSH
T142F2D0B198A89D63ECEBD394720B72475FF0C06395E45B849EDC9B1E06976AD070FC0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 dc8a3e2005beb29fe56a99a1569d5bf2c2cabba67f1304decafc92ac9367a347
MD5 4d64848bce5b43060d00dc046bf3d38f
SHA1 16f13f82e7da6d99d89de16f340f0c1c2fe7f394
SHA512 f0fa932f378f6bb18420a6fc148c1166417ff9d917e3a01d075c6601c870dd6c0acd2ba83c4af5af0705cc3ef9db51e64812af53136b97639611b8b84f42af15
SSDEEP 768:Arv+4UNbdH3Nmd+LeSFOUkdFX4fouOToPvB2thtA9VAB6eVH1SlX:Absbh3NUsnnwthttQEH1Y
TLSH
T19D03CE72A4AC8933EDE6D398710B75472FF4816396900F8499DD2B5D0A9B9DE070FC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e96dbe65-7885-4f01-9455-e7534a249aa6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e96dbe65-7885-4f01-9455-e7534a249aa6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe5a26b3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5a26b3.TMP
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

a2b19abd-b82b-4110-abef-f9ff8edc5d49.tmp

Path C:\Users\Admin\AppData\Local\Temp\a2b19abd-b82b-4110-abef-f9ff8edc5d49.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3908_1913988461\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5552_1840872874\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2020-5-0x0000000140000000-0x0000000140060000-memory.dmp

Download

memory/2020-7-0x0000000140000000-0x0000000140060000-memory.dmp

Download

memory/2020-10-0x0000000140000000-0x0000000140060000-memory.dmp

Download

memory/2020-4-0x0000000140000000-0x0000000140060000-memory.dmp

Download

memory/2020-1-0x0000000140000000-0x0000000140060000-memory.dmp

Download

memory/2020-956-0x0000000140000000-0x0000000140060000-memory.dmp

Download

memory/2020-957-0x0000000140000000-0x0000000140060000-memory.dmp

Download

memory/2020-0-0x0000000140000000-0x0000000140060000-memory.dmp

Download

memory/2020-960-0x0000000140000000-0x0000000140060000-memory.dmp

Download

memory/2020-961-0x0000000140000000-0x0000000140060000-memory.dmp

Download