91a67896f3d58d3b3ec5d12a0f45a4678b6983b5033cc0905ad71776f5fd463b

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/09/2026, 18:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 4.4MB
Sample260906-w4dqfseq4s
SHA256 91a67896f3d58d3b3ec5d12a0f45a4678b6983b5033cc0905ad71776f5fd463b
MD5 ea967c2f0238a326f3d3f786448cca6c
SHA1 35492b09032244440381294d63e34d51475e1bac
SHA512 612f815d517319232259c56b01a6aab5c08c774d411a3c975c9be135c16facba0c8fd1996f866d6b8c0a459962f5cc3e0a0046ef1987723b20ef22e0251f02ed
SSDEEP 49152:uSWYEcmiKM/B5dsq20J7PeVfjLVzDJIHBvtsvBp6mSM8ZZo:uS95m5vcSTkmmo
TLSH
T134265C03749894E9C0199638C57B52A3AA64BC8C573633E31E90BB383F6EBD07DB5716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 4 IoCs

description	pid	Process	procid_target
PID 4976 created 2364	4976	file.exe	89
PID 4976 created 2364	4976	file.exe	89
PID 4976 created 5576	4976	file.exe	100
PID 4976 created 5576	4976	file.exe	100

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4976	file.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5576_1912378199\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5576_2009712191\_locales\am\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4492	chrome.exe
3312	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	file.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134331929391918363"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{AF6C7328-6BC7-444D-8558-78C5696D54AA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
4976	file.exe
4976	file.exe
4976	file.exe
4976	file.exe
4976	file.exe
4976	file.exe
4976	file.exe
4976	file.exe
4976	file.exe
4976	file.exe
4976	file.exe
4976	file.exe
4976	file.exe
4976	file.exe
2364	chrome.exe
2364	chrome.exe
4976	file.exe
4976	file.exe
4976	file.exe
4976	file.exe
4976	file.exe
4976	file.exe
4976	file.exe
4976	file.exe
4976	file.exe
4976	file.exe
4976	file.exe
4976	file.exe
4976	file.exe
4976	file.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4976	file.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
5576	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 2364	4976	file.exe	89
PID 2364 wrote to memory of 6084	2364	chrome.exe	90
PID 2364 wrote to memory of 2036	2364	chrome.exe	92
PID 2364 wrote to memory of 2036	2364	chrome.exe	92
PID 2364 wrote to memory of 4492	2364	chrome.exe	93
PID 2364 wrote to memory of 616	2364	chrome.exe	95
PID 2364 wrote to memory of 616	2364	chrome.exe	95
PID 2364 wrote to memory of 4060	2364	chrome.exe	96
PID 2364 wrote to memory of 4808	2364	chrome.exe	97
PID 2364 wrote to memory of 4060	2364	chrome.exe	96
PID 2364 wrote to memory of 4808	2364	chrome.exe	97
PID 2364 wrote to memory of 1604	2364	chrome.exe	98
PID 2364 wrote to memory of 1604	2364	chrome.exe	98
PID 2364 wrote to memory of 1472	2364	chrome.exe	99
PID 2364 wrote to memory of 1472	2364	chrome.exe	99
PID 4976 wrote to memory of 5576	4976	file.exe	100
PID 5576 wrote to memory of 4256	5576	msedge.exe	101
PID 5576 wrote to memory of 4132	5576	msedge.exe	103
PID 5576 wrote to memory of 3312	5576	msedge.exe	104
PID 5576 wrote to memory of 4132	5576	msedge.exe	103
PID 5576 wrote to memory of 4132	5576	msedge.exe	103
PID 5576 wrote to memory of 2000	5576	msedge.exe	105
PID 5576 wrote to memory of 2000	5576	msedge.exe	105
PID 5576 wrote to memory of 3172	5576	msedge.exe	106
PID 5576 wrote to memory of 3172	5576	msedge.exe	106
PID 5576 wrote to memory of 3172	5576	msedge.exe	106
PID 5576 wrote to memory of 3476	5576	msedge.exe	107
PID 5576 wrote to memory of 3476	5576	msedge.exe	107
PID 5576 wrote to memory of 3476	5576	msedge.exe	107
PID 5576 wrote to memory of 4144	5576	msedge.exe	108
PID 5576 wrote to memory of 2536	5576	msedge.exe	109
PID 5576 wrote to memory of 4144	5576	msedge.exe	108
PID 5576 wrote to memory of 4144	5576	msedge.exe	108
PID 5576 wrote to memory of 2536	5576	msedge.exe	109
PID 5576 wrote to memory of 2536	5576	msedge.exe	109
PID 5576 wrote to memory of 1496	5576	msedge.exe	110
PID 5576 wrote to memory of 1496	5576	msedge.exe	110
PID 5576 wrote to memory of 2252	5576	msedge.exe	112
PID 5576 wrote to memory of 3452	5576	msedge.exe	111
PID 5576 wrote to memory of 2252	5576	msedge.exe	112
PID 5576 wrote to memory of 3452	5576	msedge.exe	111
PID 5576 wrote to memory of 4820	5576	msedge.exe	114
PID 5576 wrote to memory of 5568	5576	msedge.exe	117
PID 5576 wrote to memory of 5568	5576	msedge.exe	117
PID 5576 wrote to memory of 4052	5576	msedge.exe	118
PID 5576 wrote to memory of 4052	5576	msedge.exe	118
PID 5576 wrote to memory of 4516	5576	msedge.exe	119
PID 5576 wrote to memory of 4516	5576	msedge.exe	119
PID 5576 wrote to memory of 420	5576	msedge.exe	120
PID 5576 wrote to memory of 420	5576	msedge.exe	120
PID 5576 wrote to memory of 5260	5576	msedge.exe	121
PID 5576 wrote to memory of 5260	5576	msedge.exe	121
PID 5576 wrote to memory of 5260	5576	msedge.exe	121

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" https://google.com --disable-gpu
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x134,0x138,0x13c,0x110,0x140,0x7ff8f3fcc728,0x7ff8f3fcc734,0x7ff8f3fcc740
    3⤵
    PID:6084
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1648,i,15532372393734037193,13226959386624695287,262144 --field-trial-handle=1860,i,18370161482939168988,12280481337252285223,262144 --variations-seed-version --mojo-platform-channel-handle=1848 /prefetch:2
    3⤵
    PID:2036
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1500,i,11392887634105211580,11598543301340348492,524288 --field-trial-handle=1860,i,18370161482939168988,12280481337252285223,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4492
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2256,i,8927407683606416483,14454503671515176092,524288 --field-trial-handle=1860,i,18370161482939168988,12280481337252285223,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:13
    3⤵
    PID:616
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3148,i,16197724947523901209,4835843369361101226,2097152 --field-trial-handle=1860,i,18370161482939168988,12280481337252285223,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:1
    3⤵
    PID:4060
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3156,i,5281710405997822236,10271345930410007121,2097152 --field-trial-handle=1860,i,18370161482939168988,12280481337252285223,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:1
    3⤵
    PID:4808
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4604,i,11089185601893936104,15140749057028751948,2097152 --field-trial-handle=1860,i,18370161482939168988,12280481337252285223,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:1
    3⤵
    PID:1604
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4772,i,10845018403266168840,6286046310990253028,524288 --field-trial-handle=1860,i,18370161482939168988,12280481337252285223,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:14
    3⤵
    PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://google.com --disable-gpu
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff8eb18c188,0x7ff8eb18c194,0x7ff8eb18c1a0
    3⤵
    PID:4256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=2004,i,7596856388335250226,6264835370945648710,262144 --field-trial-handle=2464,i,10719477595996470028,5038281690995260324,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:2
    3⤵
    PID:4132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2140,i,1582777911855937118,2484240813715639190,524288 --field-trial-handle=2464,i,10719477595996470028,5038281690995260324,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,13122946782717601280,15322861494584481122,524288 --field-trial-handle=2464,i,10719477595996470028,5038281690995260324,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:13
    3⤵
    PID:2000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,6420996750190543549,14369859227285838666,2097152 --field-trial-handle=2464,i,10719477595996470028,5038281690995260324,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
    3⤵
    PID:3172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,13765382785764079431,11082149810064499254,2097152 --field-trial-handle=2464,i,10719477595996470028,5038281690995260324,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
    3⤵
    PID:3476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4076,i,3003693926752335069,16488700619664361395,2097152 --field-trial-handle=2464,i,10719477595996470028,5038281690995260324,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:1
    3⤵
    PID:4144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4100,i,4619116221512485334,8736391027893625725,2097152 --field-trial-handle=2464,i,10719477595996470028,5038281690995260324,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:9
    3⤵
    PID:2536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,18102630543387184651,3353186795789217913,524288 --field-trial-handle=2464,i,10719477595996470028,5038281690995260324,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
    3⤵
    PID:1496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,17684611948418333005,6669731262331261082,524288 --field-trial-handle=2464,i,10719477595996470028,5038281690995260324,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
    3⤵
    PID:3452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,4616852132449212659,14175308735798250260,524288 --field-trial-handle=2464,i,10719477595996470028,5038281690995260324,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
    3⤵
    PID:2252
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,11731749523996642935,5255526330171776987,524288 --field-trial-handle=2464,i,10719477595996470028,5038281690995260324,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
    3⤵
    PID:5632
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,11731749523996642935,5255526330171776987,524288 --field-trial-handle=2464,i,10719477595996470028,5038281690995260324,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
    3⤵
    PID:4820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,14301720377554515703,15497279171008814846,524288 --field-trial-handle=2464,i,10719477595996470028,5038281690995260324,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:14
    3⤵
    PID:5568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,1017058849152008034,703873656285596621,524288 --field-trial-handle=2464,i,10719477595996470028,5038281690995260324,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
    3⤵
    PID:4052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,12893614137245639400,17489560826365825631,524288 --field-trial-handle=2464,i,10719477595996470028,5038281690995260324,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
    3⤵
    PID:4516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,9615226587450720266,1181037780061264450,524288 --field-trial-handle=2464,i,10719477595996470028,5038281690995260324,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:14
    3⤵
    PID:420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6732,i,18140313055255536011,14904157766818802841,2097152 --field-trial-handle=2464,i,10719477595996470028,5038281690995260324,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:1
    3⤵
    PID:5260

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:208

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log
Size 1KB
SHA256 3734aa29731efc7ca7a9c72931a1be2ce3233fd15f42813e25a7fd039982b518
MD5 7be18865e2185f8cecf83918d8d4673c
SHA1 1a901cecf091dba506fccf0768977f3cbee46043
SHA512 0c9526607596374ec17541cec7881743a78b121ffa481840801374ea38b1a28bf3434aa97ab2e927798f552e70be527a9885614f6fa48838ec8a5a5b92ef384e
TLSH
T167115E6FEBEDC012BB8E80E420D3243681ECF0BD3A8DB2F26C064C0BDF8945D1905A10
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Size 20KB
SHA256 a936c62a3e083c8ac157020801a483164ddb9c5672f7909c66ad56f850d685e7
MD5 5a317ea6e1a4e600e27f15d4e28c0e8f
SHA1 1220145a0192454a07e0634961a8667b9ad7daab
SHA512 68472b83fc12004d5e191444d8b5ba32b33473ef9845f43583b5fde2942be1c56f9417496b194370f76ea79207657f6b579a1332eaa4061efd20731c633d7932
SSDEEP 48:TeW9aw/aHLopFMavU1iBYHlJoa2pQhNHKE9kiaX:nPareMaZ+JPYQhc9R
TLSH
T12192118F1F347615C4F49772E6E1099B1E7D221C5327BEA8AE6404B3CC8269BB50A1E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 eebc6795b804458d3da87fb1e854282606e2f70f2cf7daba4e98e0b876e08aac
MD5 4dfcb10072dafb0287bb61d18f807a88
SHA1 334114ff9a933ceb0af22e77cefac39e63cf9ab4
SHA512 b5bd053008e629083da917e304e80ffc89a9c30bd83796a8fb16374e433d9b70c2ce6040e4548e5ba737613fbb040370ca07e71396775e7a19aeaffe08be30a7
TLSH
T161518DF7C3E8957D8A1156F8AB166F1FCE290928431D3D6AC8D46E1B93F2C71D11068E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 ba7a5e2d345a0c3a542f4963c1dec4345c7e9dfaa35b89c88f9d28c94d70985d
MD5 857e221b48af9117fa2e7fb66af5ac9c
SHA1 331f26180877a8fb97daaaaf0e5b7a20aa7cfff2
SHA512 0b53f6e293ac5d323dbac8da5e09b6ad6f52b0a2b07dcb91f585595a43ba45974e7228d9e8138cdba2e65016096cf26905e75c921e1ccc34e9d780190c15b732
TLSH
T1CEF059A7A63B747310BA54BB5D18BC09AAB7F831018169F4CE6A822D90825F71B33443
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 22ad938bb1538998a1043860a598cd6498fd7e96c7550aad1cdfeb0db2e32dc7
MD5 dfcc9459889a65813b9f92cfcee203da
SHA1 928795c09adce7ea3fac9dcd76b1201f67259249
SHA512 59d04168066cd088dba530486477ba935d599be3be7e4aff2b4a0e74b520027443932102d2b62a7ed9f8b44f6ea7e013f88a39e71f2b7233621d617eb7aae171
TLSH
T15BA0025822C22D8ACC948570BC43465073388C306D05D6138ED7E0658C5754C8141028
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 b28cf80b92411365cbc3941655f84ab2fad324d4c6dd1ecff9450a8a974c063e
MD5 7a69e8c3fa0b18b4989f8d847000ac72
SHA1 996ae5a1a0a536dfc8f03b6b1f183583986b1669
SHA512 48e5276385f308d3585402b29503c043859e1f6acd62440f3b2143147e92bfe85810535902d2ae5ac1f8bcd45d32c7c768123486b58fe7bbfb85ea0590779150
SSDEEP 96:gC0d+cAOIt5aDVmufj7jcbRDotok5gCDNB6/dGyv95S0hbb2Jv4a:gC0LA/TE57cDUDDTUweS0hbKl
TLSH
T10CA10971B8A95EB75DB5C544F9827E83CF78A127A9226F80D8DC1F0C10E71EC1382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 2b697eddcb2b07f8539bfb3652953b0a60b5fe79caaa7bafd3e57283f337ae14
MD5 941e2ecafe7396f8e97c401afcc3b3af
SHA1 31446a30ef45517406a817809c058cb4d0f8977b
SHA512 222c47ab976196c3e2f6ff28796c492c670705750f2050ae0b523f8bda0f71b8f87e5338b508def4ce9eccd960b940f81d1f8e67bc05678f8080d5f069521c97
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
TLSH
T1B3B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 208bba336676124e42b306b51f65aacab01aad650000cbb7cdc708611db2523c
MD5 5be8b96a3ec62fe7d485765ac9ab08a4
SHA1 77ede8f4a059c534e361a03d66af1fce1a6abb42
SHA512 c3d1c8f1dc07a07d954caaca225a8393cef3b316837ee3cadc10138e2cfb0b8cabd57f0e83180e8d26b9af8a065611c81f331e4ec1016e852750de3ec85d6850
TLSH
T1B9612DD2A3A10AE2E7358EBF84E1F45737F8CC5A81B32E0474935E746462FE0A2D5163
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5992ff.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5992ff.TMP
Size 3KB
SHA256 8ef19debbccf3128345d9d6c28357d211f25b3bb72f89743d6cae5657bc2f55f
MD5 56f2c916fd827eef040209ba1619b0d0
SHA1 37151b2e263c658ab7d56854c34f06f3e71eefb6
SHA512 89f6e4b9d2b51cab43e1e53a91f678ba64c1552f7911bafca9148b9cdd4188713892c782a112dc41a98aed5d720fc59fa8336fec2f9f3aa5963c93ed5f487efd
TLSH
T17A612ED2A3A10AE2E7354EBB84E1F49B37F4CC5A81B31E0474835E746462FE0A2D5163
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 4KB
SHA256 85482d322508a7117c671663f24aadb92229dc59649bdf51e2d4b1b30661afb6
MD5 ddd239875cb8be71e29acf8a749b2bc1
SHA1 1d6486f58e5730887d866511644c8c10d38d9511
SHA512 4c607270cd8cfb0e5b1d6795057ebddfa7b91c0259e2ff176f2ab82dd3f6f00feb457582b2b2fa21cd03e76c18a1bf3f3f308df25efcea8f9aae6641582cef65
SSDEEP 96:LxvTIQap36C7MI2V4GfNWgmONDQXn8wTtocX62YD:lvPk7MI2V4GcgmONDQX8MtocKVD
TLSH
T1F8910BBAEFE5D8687686C0A5344364212DDD71FB369C72B76C84081AC5D988C7E58FB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3581ae7baff2a537ef0ba6e12af5a92b7738631a1c76e6389447350a4f0fab0f
MD5 07d91972bcb02c09eb8beecb7e945ba8
SHA1 bc50636ad3aa0817211d73b6d240d9ec67c1e74b
SHA512 0ab6253a2ac79d51780e2f79c74cb91562771a511804b9c3dfb16de2573d762794caf115bd9ca2e53dd0b8e5bfc2bcc462f0eba1aefc332f928302fb370d323e
SSDEEP 192:sxRA/yM/jK1Ml8wC9/fusW2prQ5ezoA8pi/g6+WNIYnYUwhZGBIgD5cJ:sxRA589/fusW2ii/5I5f6O
TLSH
T1BB52D815AA34AD7BCCDBD20DFA55BF93D6F81463A1901E44AAFC8A0C04E76DD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 618d426812f77c3506df078eacc2a486171e4c441ec57375281e90189cec64c2
MD5 6fbf671d6a08284a9857a018feffd95e
SHA1 5d7e98bd3d6cbdfe786c0b1bb830842a9e16c2ce
SHA512 e927a4c5784aaaee7a24d9c9b28d6aa7c43e55c0e42faf11da82f97a6d66b6941b7718a52fd43b3e6fdae1042eca1b9c92483b25a0e41c35a9e1a7298e7222b2
SSDEEP 192:sxRL/yM/jK1Ml8wC9/fush2prQ5ezoA8pi/g6+WNIYnYUwhZGBIgVcJ:sxRL589/fush2ii/5I5f6e
TLSH
T15852E9156A34AD7BCCDBD20DFA55BF93D6F81563A1901E44AAFC8A0C04E7ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 bbb74df68ba3d7d20fbee2b8451554b36bc4dd8dd92ef49d506cb2e206b8d4cb
MD5 d3a50028110a210525005c31919723b4
SHA1 151d6964b0e72084dbcd9813cbb14d55f6b82a2a
SHA512 48d6d47313c154670798b2349e6674aaa8627cdd26bbdf63e9944fba09dcb87ae59b65a14e1fd310c9cac2c4069f3c4fd962b8026a27c1aef777fd4bf9c07a8c
SSDEEP 768:wGedPg7pLuL7X6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OVIu4YGroS08u5G:wGedPsE7X6WgoufDMu1jatVY990
TLSH
T17AE2EB3B680CCB7E4F444EDDE829BE9BADE801CB5AD88D5447EA840C03C67EB55164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 09392683f4c97d4e81b93d2b94db4068619305feb55916ce6098fae67ebfe361
MD5 a887d814d28cdd6219bca0f588112962
SHA1 2151666ef7f1a3e5eb9ffcce789412046967270a
SHA512 88b072178d0265b6233f04ecb660c95aecd8fd6833c897a14ff4d2ee875797802c1ed7708feab9a2ecf8d6743fb4734424687bfda6cffcb8411a4455dc13e8a4
SSDEEP 96:KRdqjXNn7vWj4mgfvK4+gBvcldQzLkHm7KmgIIOW4tVgGOK47g0OcOGlkFRmKiwn:CdqjXNn7Oj4XfV+gBkldQzLkHm7KmgI5
TLSH
T10F918345707A0284387E7A1881698D6FD6813473304EF97B37A901E60FABE464EFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 d65f2342dd7b819ef4ad5643e76b9f153f2f0948c8843abda0c832bc96c8ad2b
MD5 473651db183408f19277afeb8ce4ecff
SHA1 a7e312d1f39ab306b45be525127545d8a2d0dd46
SHA512 2c90844037124ba612593c39fea476b4acc679b490eab13ae9b75689c164374a161ee75da70c9cf8cbaf39eaeb7925ac02a3e3a4c8224e66e15cf54eaf3f753f
SSDEEP 384:DNrRZyCSDnxTICUMEhIKyll7svbFKfk7:xFZJSDnisyI1l7svbF9
TLSH
T18944740A7B747001EDE6D9721CB080771E3C716D8F22A6916DB254698EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 edf3fde91c7f3daa18573b93b57680bab34bfb3811b3295522f515c5452fe0cc
MD5 b28caaea78c1dc06f45a717821f52812
SHA1 1a44cff07780d4249a38a964d2b0d2456dbf606b
SHA512 18353d05b493290b7fa6dd2e3637d299b68631139a0f501be7c893a2f73fd2a0c7b55a5279784176cf25456887ea30b3dd68b1f5adf61b1c3cfe3c051158c85c
SSDEEP 768:6rv+4UNbds3rwDZIO0tNzc4ReyIsXFeVH1S5D:6bsbS39tc44bsVEH1Y
TLSH
T1BD03CF32AC789977ACF69686B50B36533EF8911B82D81F94C5EE2F0C464B1DD131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 815ec0c98d58420b86000caec387e392c87c8a8fdf05684d0012e9a0b21bfd4a
MD5 83fce190fecf288d225ad16d32de510f
SHA1 41195f002246912553469b0701d66affeb6cf2a4
SHA512 23206e6f696cc1bd5b75d84ade99e64dddb725a5b03f9306f8c2a6e75a38a6c26b58908b419893167e87aa2310e53d0c68161a921da7cb191d385f7d4452f843
SSDEEP 768:Erv+4UNbds3jBeDZIO00hePNzc4ReyIsPeeVH1S5F:EbsbS3jGatc44bsmEH1W
TLSH
T13813CF32AC789973ACF69686B50735537EF8911B82C81E94C4DE5F4C4A8B1DD131F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 23998645b893a7b43638068c002705cd4acaf3c7ee89dab7307c4862e2499f82
MD5 6dd6d91acdc2cfc2841b94ee86c4fc33
SHA1 75e6845787ffc632a441254abf2c193e2b94d657
SHA512 b14bb37df041e143774706ffd3f8ad4fd1f41b0acc27042374d186352d2d4b551f68001d07b6ec9a99018c5f4496e8f2af24477aa9e3331f728f94d85c02bbcb
SSDEEP 768:Qrv+4UNbds3+IDZIO00heENzc4ReyIs2eeVH1S5D:QbsbS3LDtc44bsJEH1Y
TLSH
T1BB03C032A8789977ACF69A86F04735533EF8921B81C81E94C4EE5F4C4A8B1DD135B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a856eb0c-304e-4d69-9688-3fcc02684193.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a856eb0c-304e-4d69-9688-3fcc02684193.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

961a7896-75a2-4932-a5ee-8a28bd73e08a.tmp

Path C:\Users\Admin\AppData\Local\Temp\961a7896-75a2-4932-a5ee-8a28bd73e08a.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5576_1230420180\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4976-10-0x0000000140000000-0x0000000140061000-memory.dmp

Download

memory/4976-5-0x0000000140000000-0x0000000140061000-memory.dmp

Download

memory/4976-0-0x0000000140000000-0x0000000140061000-memory.dmp

Download

memory/4976-590-0x0000000140000000-0x0000000140061000-memory.dmp

Download

memory/4976-591-0x0000000140000000-0x0000000140061000-memory.dmp

Download

memory/4976-1-0x0000000140000000-0x0000000140061000-memory.dmp

Download

memory/4976-4-0x0000000140000000-0x0000000140061000-memory.dmp

Download

memory/4976-594-0x0000000140000000-0x0000000140061000-memory.dmp

Download

memory/4976-595-0x0000000140000000-0x0000000140061000-memory.dmp

Download