d7f99e89d03a4c664ac78b468801d4b9323828bb92e9b8cbfe08a715038e9701

Analysis

max time kernel
39s
max time network
36s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d7f99e89d03a4c664ac78b468801d4b9323828bb92e9b8cbfe08a715038e9701.exe
Size 1.1MB
Sample261027-dctngsce64
SHA256 d7f99e89d03a4c664ac78b468801d4b9323828bb92e9b8cbfe08a715038e9701
MD5 3b710c7d5a83e1f9c5eb63ec8103e34b
SHA1 ace4c23248a544c9c9562d485df0cba8d981be32
SHA512 98e760af619d779bd01a90a2e4d9a5b47c41a5654242acdfcd0037696a6c551ea63b57c52814de6acf8072b60bc92d8cb7f3d1640f3cbd74763e7d42875dc208
SSDEEP 24576:hwF16QLDtJmKISH0AEVL41M7DA2aO0H3U:hAfzi6+/ri
TLSH
T152454CB6B7D30BBBF85A0C7006851F30A85D74E351F21DCA16BF1909AA8D9C55AF2E70
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery spyware

Malware Config

Signatures

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 42 IoCs

description	pid	Process	procid_target
PID 3264 set thread context of 5364	3264	Explorer.EXE	90
PID 3264 set thread context of 5364	3264	Explorer.EXE	90
PID 3264 set thread context of 5364	3264	Explorer.EXE	90
PID 3264 set thread context of 5612	3264	Explorer.EXE	91
PID 3264 set thread context of 5364	3264	Explorer.EXE	90
PID 3264 set thread context of 5612	3264	Explorer.EXE	91
PID 3264 set thread context of 5364	3264	Explorer.EXE	90
PID 3264 set thread context of 5612	3264	Explorer.EXE	91
PID 3264 set thread context of 5612	3264	Explorer.EXE	91
PID 3264 set thread context of 5364	3264	Explorer.EXE	90
PID 3264 set thread context of 5612	3264	Explorer.EXE	91
PID 3264 set thread context of 5364	3264	Explorer.EXE	90
PID 3264 set thread context of 5612	3264	Explorer.EXE	91
PID 3264 set thread context of 5364	3264	Explorer.EXE	90
PID 3264 set thread context of 5364	3264	Explorer.EXE	90
PID 3264 set thread context of 5364	3264	Explorer.EXE	90
PID 3264 set thread context of 5612	3264	Explorer.EXE	91
PID 3264 set thread context of 5612	3264	Explorer.EXE	91
PID 3264 set thread context of 5364	3264	Explorer.EXE	90
PID 3264 set thread context of 5364	3264	Explorer.EXE	90
PID 3264 set thread context of 5612	3264	Explorer.EXE	91
PID 3264 set thread context of 5612	3264	Explorer.EXE	91
PID 3264 set thread context of 5364	3264	Explorer.EXE	90
PID 3264 set thread context of 5364	3264	Explorer.EXE	90
PID 3264 set thread context of 5364	3264	Explorer.EXE	90
PID 3264 set thread context of 5364	3264	Explorer.EXE	90
PID 3264 set thread context of 5364	3264	Explorer.EXE	90
PID 3264 set thread context of 5612	3264	Explorer.EXE	91
PID 3264 set thread context of 5612	3264	Explorer.EXE	91
PID 3264 set thread context of 5364	3264	Explorer.EXE	90
PID 3264 set thread context of 5612	3264	Explorer.EXE	91
PID 3264 set thread context of 5612	3264	Explorer.EXE	91
PID 3264 set thread context of 5612	3264	Explorer.EXE	91
PID 3264 set thread context of 5612	3264	Explorer.EXE	91
PID 3264 set thread context of 5612	3264	Explorer.EXE	91
PID 3264 set thread context of 5612	3264	Explorer.EXE	91
PID 3264 set thread context of 5364	3264	Explorer.EXE	90
PID 3264 set thread context of 5364	3264	Explorer.EXE	90
PID 3264 set thread context of 5364	3264	Explorer.EXE	90
PID 3264 set thread context of 5364	3264	Explorer.EXE	90
PID 3264 set thread context of 5364	3264	Explorer.EXE	90
PID 3264 set thread context of 5364	3264	Explorer.EXE	90

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\nodejs\mccaidsuysaarry.txt	d7f99e89d03a4c664ac78b468801d4b9323828bb92e9b8cbfe08a715038e9701.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1752	msedge.exe
5808	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
5612	chrome.exe
5612	chrome.exe
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3264	Explorer.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5364	msedge.exe
5364	msedge.exe
5612	chrome.exe
5612	chrome.exe
5612	chrome.exe
5612	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5612	chrome.exe
Token: SeCreatePagefilePrivilege	5612	chrome.exe
Token: SeShutdownPrivilege	5612	chrome.exe
Token: SeCreatePagefilePrivilege	5612	chrome.exe
Token: SeShutdownPrivilege	5612	chrome.exe
Token: SeCreatePagefilePrivilege	5612	chrome.exe
Token: SeShutdownPrivilege	5612	chrome.exe
Token: SeCreatePagefilePrivilege	5612	chrome.exe
Token: SeShutdownPrivilege	5612	chrome.exe
Token: SeCreatePagefilePrivilege	5612	chrome.exe
Token: SeShutdownPrivilege	5612	chrome.exe
Token: SeCreatePagefilePrivilege	5612	chrome.exe
Token: SeShutdownPrivilege	5612	chrome.exe
Token: SeCreatePagefilePrivilege	5612	chrome.exe
Token: SeShutdownPrivilege	5612	chrome.exe
Token: SeCreatePagefilePrivilege	5612	chrome.exe
Token: SeShutdownPrivilege	5612	chrome.exe
Token: SeCreatePagefilePrivilege	5612	chrome.exe
Token: SeShutdownPrivilege	5612	chrome.exe
Token: SeCreatePagefilePrivilege	5612	chrome.exe
Token: SeShutdownPrivilege	5612	chrome.exe
Token: SeCreatePagefilePrivilege	5612	chrome.exe
Token: SeShutdownPrivilege	5612	chrome.exe
Token: SeCreatePagefilePrivilege	5612	chrome.exe
Token: SeShutdownPrivilege	5612	chrome.exe
Token: SeCreatePagefilePrivilege	5612	chrome.exe
Token: SeShutdownPrivilege	5612	chrome.exe
Token: SeCreatePagefilePrivilege	5612	chrome.exe
Token: SeShutdownPrivilege	5612	chrome.exe
Token: SeCreatePagefilePrivilege	5612	chrome.exe
Token: SeShutdownPrivilege	5612	chrome.exe
Token: SeCreatePagefilePrivilege	5612	chrome.exe
Token: SeShutdownPrivilege	5612	chrome.exe
Token: SeCreatePagefilePrivilege	5612	chrome.exe
Token: SeShutdownPrivilege	5612	chrome.exe
Token: SeCreatePagefilePrivilege	5612	chrome.exe
Token: SeShutdownPrivilege	5612	chrome.exe
Token: SeCreatePagefilePrivilege	5612	chrome.exe
Token: SeShutdownPrivilege	5612	chrome.exe
Token: SeCreatePagefilePrivilege	5612	chrome.exe
Token: SeShutdownPrivilege	5612	chrome.exe
Token: SeCreatePagefilePrivilege	5612	chrome.exe
Token: SeShutdownPrivilege	5612	chrome.exe
Token: SeCreatePagefilePrivilege	5612	chrome.exe
Token: SeShutdownPrivilege	5612	chrome.exe
Token: SeCreatePagefilePrivilege	5612	chrome.exe
Token: SeShutdownPrivilege	5612	chrome.exe
Token: SeCreatePagefilePrivilege	5612	chrome.exe
Token: SeShutdownPrivilege	5612	chrome.exe
Token: SeCreatePagefilePrivilege	5612	chrome.exe
Token: SeShutdownPrivilege	5612	chrome.exe
Token: SeCreatePagefilePrivilege	5612	chrome.exe
Token: SeShutdownPrivilege	5612	chrome.exe
Token: SeCreatePagefilePrivilege	5612	chrome.exe
Token: SeShutdownPrivilege	5612	chrome.exe
Token: SeCreatePagefilePrivilege	5612	chrome.exe
Token: SeShutdownPrivilege	5612	chrome.exe
Token: SeCreatePagefilePrivilege	5612	chrome.exe
Token: SeShutdownPrivilege	5612	chrome.exe
Token: SeCreatePagefilePrivilege	5612	chrome.exe
Token: SeShutdownPrivilege	5612	chrome.exe
Token: SeCreatePagefilePrivilege	5612	chrome.exe
Token: SeShutdownPrivilege	5612	chrome.exe
Token: SeCreatePagefilePrivilege	5612	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
2876	d7f99e89d03a4c664ac78b468801d4b9323828bb92e9b8cbfe08a715038e9701.exe
5364	msedge.exe
5612	chrome.exe
5612	chrome.exe
5612	chrome.exe
5612	chrome.exe
5612	chrome.exe
5612	chrome.exe
5612	chrome.exe
5612	chrome.exe
5612	chrome.exe
5612	chrome.exe
5612	chrome.exe
5612	chrome.exe
5612	chrome.exe
5612	chrome.exe
5612	chrome.exe
5612	chrome.exe
5612	chrome.exe
5612	chrome.exe
5612	chrome.exe
5612	chrome.exe
5612	chrome.exe
5612	chrome.exe
5612	chrome.exe
5612	chrome.exe
5612	chrome.exe
5612	chrome.exe
5612	chrome.exe
5612	chrome.exe
5612	chrome.exe
5612	chrome.exe
5612	chrome.exe
5612	chrome.exe
5612	chrome.exe
5612	chrome.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 3264	2876	d7f99e89d03a4c664ac78b468801d4b9323828bb92e9b8cbfe08a715038e9701.exe	55
PID 5612 wrote to memory of 3424	5612	chrome.exe	92
PID 5364 wrote to memory of 5068	5364	msedge.exe	93
PID 5612 wrote to memory of 4040	5612	chrome.exe	94
PID 5612 wrote to memory of 4040	5612	chrome.exe	94
PID 5612 wrote to memory of 5808	5612	chrome.exe	95
PID 5364 wrote to memory of 1752	5364	msedge.exe	96
PID 5612 wrote to memory of 3276	5612	chrome.exe	97
PID 5612 wrote to memory of 3276	5612	chrome.exe	97
PID 5364 wrote to memory of 3156	5364	msedge.exe	98
PID 5364 wrote to memory of 1248	5364	msedge.exe	99
PID 5364 wrote to memory of 3156	5364	msedge.exe	98
PID 5364 wrote to memory of 3156	5364	msedge.exe	98
PID 5364 wrote to memory of 1248	5364	msedge.exe	99
PID 5364 wrote to memory of 3396	5364	msedge.exe	101
PID 5364 wrote to memory of 3396	5364	msedge.exe	101
PID 5364 wrote to memory of 3396	5364	msedge.exe	101
PID 5364 wrote to memory of 4048	5364	msedge.exe	102
PID 5364 wrote to memory of 4048	5364	msedge.exe	102
PID 5364 wrote to memory of 4048	5364	msedge.exe	102
PID 5612 wrote to memory of 4420	5612	chrome.exe	104
PID 5612 wrote to memory of 4420	5612	chrome.exe	104
PID 5612 wrote to memory of 5444	5612	chrome.exe	105
PID 5612 wrote to memory of 5444	5612	chrome.exe	105
PID 5612 wrote to memory of 400	5612	chrome.exe	106
PID 5612 wrote to memory of 400	5612	chrome.exe	106
PID 5612 wrote to memory of 816	5612	chrome.exe	107
PID 5612 wrote to memory of 816	5612	chrome.exe	107
PID 5612 wrote to memory of 2860	5612	chrome.exe	113
PID 5612 wrote to memory of 5168	5612	chrome.exe	121
PID 5612 wrote to memory of 5568	5612	chrome.exe	123
PID 5364 wrote to memory of 5676	5364	msedge.exe	122
PID 5612 wrote to memory of 1004	5612	chrome.exe	124
PID 5364 wrote to memory of 4260	5364	msedge.exe	125
PID 5364 wrote to memory of 1128	5364	msedge.exe	126

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:3264
- C:\Users\Admin\AppData\Local\Temp\d7f99e89d03a4c664ac78b468801d4b9323828bb92e9b8cbfe08a715038e9701.exe
  "C:\Users\Admin\AppData\Local\Temp\d7f99e89d03a4c664ac78b468801d4b9323828bb92e9b8cbfe08a715038e9701.exe"
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2cc,0x2d0,0x2d4,0x2c8,0x360,0x7ffe5565c188,0x7ffe5565c194,0x7ffe5565c1a0
    3⤵
    PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,16801532744825237146,7652101578276411673,524288 --field-trial-handle=2528,i,413421776522263572,18443933715281579620,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,5395079576796396528,5944451589741032443,262144 --field-trial-handle=2528,i,413421776522263572,18443933715281579620,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:2
    3⤵
    PID:3156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,355577004813573362,7782165868495977453,524288 --field-trial-handle=2528,i,413421776522263572,18443933715281579620,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:8
    3⤵
    PID:1248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,9242149902372482314,7819716830878519233,2097152 --field-trial-handle=2528,i,413421776522263572,18443933715281579620,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
    3⤵
    PID:3396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,14145917496089707121,5885072655783409740,2097152 --field-trial-handle=2528,i,413421776522263572,18443933715281579620,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:4048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,12747489427980354910,4806457226982282146,524288 --field-trial-handle=2528,i,413421776522263572,18443933715281579620,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:8
    3⤵
    PID:5676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=856,i,3955451925302017211,14893042524658499757,524288 --field-trial-handle=2528,i,413421776522263572,18443933715281579620,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:8
    3⤵
    PID:4260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,11425798949455707394,4041655729276824383,524288 --field-trial-handle=2528,i,413421776522263572,18443933715281579620,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:8
    3⤵
    PID:1128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5612
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe55d5c728,0x7ffe55d5c734,0x7ffe55d5c740
    3⤵
    PID:3424
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1748,i,9896009303803306463,17080682612137512055,262144 --field-trial-handle=2008,i,17272928221512696456,16741279191949184698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2004 /prefetch:2
    3⤵
    PID:4040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2284,i,17310409194797553425,16474239292226560621,524288 --field-trial-handle=2008,i,17272928221512696456,16741279191949184698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2324 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5808
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,547346102220495673,3898945980337774633,524288 --field-trial-handle=2008,i,17272928221512696456,16741279191949184698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2428 /prefetch:8
    3⤵
    PID:3276
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,13713409873763998513,6787015281910078038,2097152 --field-trial-handle=2008,i,17272928221512696456,16741279191949184698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3216 /prefetch:1
    3⤵
    PID:4420
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,11344325003131608198,17989441770436869070,2097152 --field-trial-handle=2008,i,17272928221512696456,16741279191949184698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3344 /prefetch:1
    3⤵
    PID:5444
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4216,i,12123216855964186364,3832454626277216555,2097152 --field-trial-handle=2008,i,17272928221512696456,16741279191949184698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4200 /prefetch:2
    3⤵
    PID:400
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4552,i,818898631365121910,7528134751721997230,2097152 --field-trial-handle=2008,i,17272928221512696456,16741279191949184698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4576 /prefetch:1
    3⤵
    PID:816
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,10696238447457008880,1059854199901755302,524288 --field-trial-handle=2008,i,17272928221512696456,16741279191949184698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5420 /prefetch:8
    3⤵
    PID:2860
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5932,i,8504308146862979521,2582511175622881548,524288 --field-trial-handle=2008,i,17272928221512696456,16741279191949184698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6004 /prefetch:8
    3⤵
    PID:5168
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5908,i,11347607148719727233,13764988900404865896,524288 --field-trial-handle=2008,i,17272928221512696456,16741279191949184698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5944 /prefetch:8
    3⤵
    PID:5568
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6000,i,11899264689464904111,3805672478727836717,524288 --field-trial-handle=2008,i,17272928221512696456,16741279191949184698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5988 /prefetch:8
    3⤵
    PID:1004

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3488

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

38636236-8c4e-44bf-b854-c156a1fe573e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\38636236-8c4e-44bf-b854-c156a1fe573e.tmp
Size 269KB
SHA256 2ff3748fef20e2f7c48e4856044f380fed9917b38302650117d37df6c1f8642e
MD5 bdc02e54b1b4769ed89eb9bf10dca749
SHA1 2a1c0e3fe63d2d788c31a221c13e7c78e17c76a8
SHA512 64c6d6b483d6d5db8c812eb40e89d8c19712f02ff72f58b909f465de47011ea2c8ecb98e8d4a1ccd289ba53a6506d5b260054b48b78b833aaec2691205c58d67
SSDEEP 6144:OEHhYbFusKYrxbyvK3uWEPx+hFD+7t56OD9ZfSApprB:RbsKcbyvyIxyFSXD9ZfS4f
TLSH
T1ED442326B250BC77C7FA9701E0077B05CE7A9DD981CA446542496ECBA09F94E0BF3DA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2fde0486-0346-46b6-bf84-0fadf1a40c44.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2fde0486-0346-46b6-bf84-0fadf1a40c44.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

60d7bf62-a73c-449f-ac76-1fb93f1afefd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\60d7bf62-a73c-449f-ac76-1fb93f1afefd.tmp
Size 12KB
SHA256 f66c57cd53ba6ea5ba6ce603e6d431cf1a15f41400c2a6a5dd8ab78db8b1122f
MD5 5e9693b249e93ffe8ae06c0dea200569
SHA1 3eb9766fa790e79148c424befad842c86b664cf2
SHA512 98d7256fe1c69bb2cb2554192b630590a644e57ef684d1b0647a7625a8cf520e03e3815f10afde87e946dfa9b09169be61744326020e3e26aa43b8c4396be949
SSDEEP 384:FbRblp4WXMS/zEI3/CUXtswbuP0G/AOK+9l8:znT20swJkKH
TLSH
T13F42812EFE10793B9CDBD329EA117A57D7F6202525852E80E6FC892C24E75CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

78c40e4c-130a-4221-beff-44d87ee79a52.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\78c40e4c-130a-4221-beff-44d87ee79a52.tmp
Size 414B
SHA256 2a68f1f23a1c1cbc1889604d56a97fd625c8cc71a73bf0a339d0b75300706e4b
MD5 0dc985f6a417c0494db7a81743d6010f
SHA1 346ca3eb01038f13f1df73b69c538f6d3e8467f3
SHA512 918f13bde3e44f84e34c2da72d2b3f2d83870dc54e83c84b0e742be8a296172d3dc5fbf0c97792ddd7f56de5066c8d53b08cea0886220a4ae1255135f1a25175
TLSH
T191E02BF6C822BC3728FD6B2D50104B87E74A17573681854F3A3C410D8FB4A3A02D685C
MD5 SHA1 SHA512 TLSH

Submit Download

5f3e5235-44f9-485d-a111-8c7aaf2ef5bd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\5f3e5235-44f9-485d-a111-8c7aaf2ef5bd.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

fa813c9ad67834ac_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\fa813c9ad67834ac_0
Size 136KB
SHA256 c5698af47ac5b1b1a942005fa54c2e61a3ae7019c833e6640b9f7bab424edf88
MD5 b40ea6ced73f43cdaf55c03d325bdcf8
SHA1 649fe36fcd06a6a9743320cf1f0a6a79213bb141
SHA512 4cdaaa781f0f9fc1440d35d2431dc9feef344a177a24a53f4e39006c4d3dcffb1bef2f306b6e130f50e132da430a170d90cca9337db5773afd801c8faae7d231
SSDEEP 3072:dR3MbbdKe2KTOtBth8CyOMGL2y6GDiwYxyrxygCpYE:dR3MLRRA2y6GDiwJxlCpYE
TLSH
T165D3D9CCF6A5B0124363A5F5402F000BB239B8BAE44C85A8F288D9E97D7556D8277F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 0fc5b6394f3947cca5d24d52157861358ff2c4ff4aa6c563b9d71ade58ae88d6
MD5 30e0bac420d3a79a0928f81ca3b440f6
SHA1 0d72f97efa9c8837b9394b832d22596c83c19c39
SHA512 fd36516afdfefe7a9c520b0f97be23762e45cd2013d750bd47f24ceb83370557040980db3cece30170ba745a2f847f7124440686bc6d03f7fe95a92377aab0e8
TLSH
T109B01206C0413311C0014371116090E433609F39D212238A52E00E1198361604027248
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 7fd737aca61dc3788c6a5487bf931d6f695d020347eab68e7db7d4f2ca0d6cff
MD5 58ff0e5320a55555e216837b58652330
SHA1 c291cbdfffa1ac1079c7e901b5bd632933615226
SHA512 0be353fc93dfd6e56028ab07ccc91fd4717421fdf34799a40f770af2a8a61062fe073de5d6594ba1d5b5e5b29b8154f1fe8d08abd07b745a7d773f474e517fe9
TLSH
T105B02200C0023222F08303F02A82C8C83030FF28CA03032282F00F22CC2A3308023030
MD5 SHA1 SHA512 TLSH

Submit Download

b9262e07-b0f8-428b-b3fb-2527cbe71951.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b9262e07-b0f8-428b-b3fb-2527cbe71951.tmp
Size 17KB
SHA256 2402969cd2ec72ea72b513389c43205a9ee2bceca1c456ef576613e3544e19a0
MD5 ef2f6beced6ed991eb5f4b124485b70c
SHA1 13ae98461b417e18835295fc68f98db326a5bad0
SHA512 5adbe06b2aba408c8975b2dfc7f1c8c160dc3367ebb5f8a049421cc510b871c0310b3c4cd24506c3615f6972ff559c98cb7cd22bc47816248c6501f19779082b
SSDEEP 384:tyjCjRyjH7KxkXqKf/pUZNCgVLH2Hfgslqq7pLuLceSzyjDXODRyjr+ErU3J6HG2:Ie0r7KxkXqKf/pUZNCgVLH2HfgsMq7pw
TLSH
T1A0720A77BC0C9A7B0F94C68CD8167E4FEDB5024B65D9886443FA983503D5BDA110A1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 eecb1938501f821ebbc9a9d8e0eb16cd5d375ad02a6f4ae4acfd84d197216cac
MD5 540ca8f2bb1a8cd72fd123b0ca0a4d26
SHA1 5dd96a2c52c640552e7ac6d6aaa02dbe369c0442
SHA512 35ef4475cdd09488f6bd73f44b8c31b3b808ab4d6a4694946ada597033e79972101e7fe61ff77e68492a88905d6eba7194a1bd9910e0c5cd9a12247c118c32cc
SSDEEP 3072:Uf+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:Uf+hFD+7t56OD9ZfSApprB
TLSH
T19ED31232AA91D8BBC9BC6141B157A300DE76ACED45DE3A09444A5F8EE05FD4C07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

857e8b81-b1ed-42cf-9541-19c64fbf6f7b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\857e8b81-b1ed-42cf-9541-19c64fbf6f7b.tmp
Size 25KB
SHA256 1fdefa28b73ef4cf4a47d5b7af411ff2b11f467d5f2ab791e5150657515ab6cd
MD5 9e530280c8170e8148070191ea6a8bfb
SHA1 b63c27481e379192c0d1a8195a088a17ec1e0784
SHA512 35ddc80542d63377be6a1ca23cd53e90f3c39adce549726b425705c3eba0ed5924f17b80d82013fb9c89c7e3ccfaefe0a3a825a1baa44e954a7949ab1c60c8ec
SSDEEP 384:nwiFiZcI63sNg8TUNTUlIm2aKMiBJx4wzfvBCT40HnuFUsa+VY1wgL/7Izaof:LFQ635wgcGPBCbOFUhguY
TLSH
T16FB24B36EC94DABBE8F68FD5A74A7603DEF0026395DC9AC4CAD91D1D108359D0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

24204f22-cf35-4962-9ccf-a7c7c65db7c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\24204f22-cf35-4962-9ccf-a7c7c65db7c4.tmp
Size 32KB
SHA256 62166509e0890efddeddd62322d02a9905e0b356891250f35aed2037faf6924d
MD5 cf7e2605f8d10a3eb82e2b79846b8fe1
SHA1 b0f6e97fc0f57d1f55dc83422161736d716b359d
SHA512 851106dc9aeb7773de6e0f1cd994ae02a95d001952309b5c4f0aa6563f19610d9b17cac80bc7a6ebc59517adfe5ac179b1fbb13062c929aeb0390badda8c0d96
SSDEEP 768:Px6r8sW7pLuLbG+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVm1qpLlvVajYrop:Px6r8s2EbG+WviyUKu1jaz1qpLd4jjoA
TLSH
T1E5E2E97B780CCF7E4FC05A9DDD1A7F8A6DA802CB9698C94087FA945C02C67EA51170DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2dee5744-baee-4853-aec9-47ab0027b720.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2dee5744-baee-4853-aec9-47ab0027b720.tmp
Size 13KB
SHA256 afee40830622d226e2e31a343420db5fc24d05a1186874cf569430cd63eb729d
MD5 afed3c73d6233fca31a07aebdd162a6b
SHA1 52e4390005599e2eaede8b89ef781b1bb974da98
SHA512 9115777ad59efbf2113391bf239d1f8d29026976292bcc855a1d282901eefa947cef62862afa14d3b2759be82f6ffb2be12f92872cecd7ac5ae2dba7581e22df
SSDEEP 384:sxZD2H4L/fY/sTOPqf76oDGnHbC/MSSyOtZ:syH+/frTGHb4MSMZ
TLSH
T13752D705AD28693B9CCBD319FA15BF52E3F9517294850F48AAFC8B1C14EB6CD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

805fa992-ce6a-48d4-804f-d7a2af167576.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\805fa992-ce6a-48d4-804f-d7a2af167576.tmp
Size 13KB
SHA256 743a14b7771a9a18bb7f268b9c4a4be27a461e481d18bb1570481c714be8c47b
MD5 ec6df237ee1b82f7668f09acd909560b
SHA1 c53927d34e58817fc6e2792000441395b224c45f
SHA512 3f7b18c8940bf84db9285ade6dc097538c4bcbceaa828d7712e56647f5ac9db974266dad6f2b87d601de911687f44cebfedaef2b5519e8a5bb7db4f4c42850cb
SSDEEP 384:sxZD2H4L/fY/szOPqf76oDGnHbC/MSSyjtZ:syH+/fLTGHb4MSpZ
TLSH
T14652D805AD28693B9CCBD319FA15BF52E3F9513294850E44AAFC8B1C14EB6CD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 094e740b0260a419dc3157fde9f730013ce1abe64a4d04cd1f629cd906819f9d
MD5 db4cddb45eeec8da29d1621be453df2e
SHA1 b78c36457f22dc61e80ea1fdddbedb5d05fdf8d2
SHA512 604986eebeaf4e175fa724b9bb8110fa6512e7e9978302b3863403c2c5a808033721eb2fd800c10ee213c28ddbf01c90dff78ba3b630db3058be728371439cde
TLSH
T1CF714E84A6A0E4ADFB9473B182CF18C6B56855BCEF922BF25C90F47C4D1F7A582780C0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 b088e24181da35a5faee4cfecc367d333548575fa2d502d41981bd1535215330
MD5 0902fd0b239576bb1c6d6d9ba2324c64
SHA1 ea4981799884758bef146f4d4fb005019c9da17e
SHA512 c4cdf88a904b810f730398b5cb3e68f700f6d903bec5115dc6a626c780b7618db1eb4e197c06481bb565b49f1e93c3e83c6368db611d7ef26134305e4a0e7924
TLSH
T19E510A859AA1C19DFB94B3B181CF218B797856BCEF825FF21DA4E8BC5C0EB1442390D4
MD5 SHA1 SHA512 TLSH

Submit Download

a769c2fb-7bc2-488f-9058-1f2773279a08.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a769c2fb-7bc2-488f-9058-1f2773279a08.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 336de8a18864170324a2660c84a23761577a6b7c5d25bb78592dcc42ef1da859
MD5 096e0936b4392e14b08a35869da74729
SHA1 234bc16267def929d21f71a7d4562d5bedfa043e
SHA512 5c428b3be8fc86a43ddc0ea6e4d453bc5996b6485df41aa4965e62ec7ecbc42ac14cfa8903d2251edbdc8ec390012ec60230dc247c726cd5c0a40a8f88e3fd83
TLSH
T168E0D8F72EB21828E87F97D5107254E4010678A4CD5C9C8F545BA287A0A1345B04AC69
MD5 SHA1 SHA512 TLSH

Submit Download

b0298e7a-40e2-492f-af3b-8f5fc9daa2eb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b0298e7a-40e2-492f-af3b-8f5fc9daa2eb.tmp
Size 24KB
SHA256 47cbeb39da8009ceb7307d6feb3f9501e060720fe3c26dcab96cb1bf8e5807ae
MD5 0329e5633f864fff53449e475f334696
SHA1 9ae7690572e99b44db3e258689b470f6d376457d
SHA512 ab6e37fe077c724dcacd2db9a2c97f24c4bd120ee2ff690c722d2befe126e0a7e02dcc936fbb7ee51f6de2e8f4b698a83b91e2d5426cd12f61a78cad40a6b454
SSDEEP 384:nG7iFiZcI63sNp38TUNTUlI48TgKMxLkCBVLGtKuwzfvBCT40Hnz0iVzrgL/7IzP:VFQ63Awg8wOBCbYiVzcK
TLSH
T1F6B23A31EC95DABBECEA8FC5B74A3643DEF41263999C9AC4D9D91D1C009369E0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b14a874d-6ffc-429d-83ec-daeb39742436.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b14a874d-6ffc-429d-83ec-daeb39742436.tmp
Size 25KB
SHA256 de0b07b382ad6f675a94de3b5cacc9cc53bd9d9ea317f913401646d9fabcad08
MD5 de25ef71d81f63d0c76d5233377a4a4e
SHA1 660cc892cb31819371df546ab8dc32ef00987054
SHA512 4ff993677e241287e46d50a01df59e182d54769bccad5f18e2e3d42dd68e93eab7c3728e425482338ff1d7abf1adb39402970ab05aa78d63ebeadd5d7644dcf9
SSDEEP 384:n47iFiZcI63sNd38TUNTUlIm2aKMezBoxtcwzfvBCT40Hnz0iVsa+VY1wgL/7IzP:fFQ63Qwgcn5BCbYiVhguY
TLSH
T104C24B36EC98D9BBE8EA8FD6B74A7643DEF0026395DC5AC4CAD91D1C009359D0707C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3264-27-0x0000000008880000-0x0000000008920000-memory.dmp

Download

memory/3264-25-0x0000000008880000-0x0000000008920000-memory.dmp

Download

memory/3264-11-0x0000000008880000-0x0000000008920000-memory.dmp

Download

memory/3264-8-0x0000000008880000-0x0000000008920000-memory.dmp

Download

memory/3264-16-0x0000000008880000-0x0000000008920000-memory.dmp

Download

memory/3264-10-0x0000000008880000-0x0000000008920000-memory.dmp

Download

memory/3264-15-0x0000000008880000-0x0000000008920000-memory.dmp

Download

memory/3264-17-0x0000000008880000-0x0000000008920000-memory.dmp

Download

memory/3264-18-0x0000000008880000-0x0000000008920000-memory.dmp

Download

memory/3264-19-0x0000000008880000-0x0000000008920000-memory.dmp

Download

memory/3264-20-0x0000000008880000-0x0000000008920000-memory.dmp

Download

memory/3264-21-0x0000000008880000-0x0000000008920000-memory.dmp

Download

memory/3264-23-0x0000000008880000-0x0000000008920000-memory.dmp

Download

memory/3264-30-0x0000000008880000-0x0000000008920000-memory.dmp

Download

memory/3264-216-0x0000000008880000-0x0000000008920000-memory.dmp

Download

memory/3264-26-0x0000000008880000-0x0000000008920000-memory.dmp

Download

memory/3264-1-0x0000000008880000-0x0000000008920000-memory.dmp

Download

memory/3264-28-0x0000000008880000-0x0000000008920000-memory.dmp

Download

memory/3264-29-0x0000000008880000-0x0000000008920000-memory.dmp

Download

memory/3264-9-0x0000000008880000-0x0000000008920000-memory.dmp

Download

memory/3264-13-0x0000000008880000-0x0000000008920000-memory.dmp

Download

memory/3264-0-0x0000000008880000-0x0000000008920000-memory.dmp

Download

memory/3264-2-0x0000000008880000-0x0000000008920000-memory.dmp

Download

memory/3264-3-0x0000000008880000-0x0000000008920000-memory.dmp

Download

memory/3264-4-0x0000000008880000-0x0000000008920000-memory.dmp

Download

memory/3264-5-0x0000000008880000-0x0000000008920000-memory.dmp

Download

memory/3264-6-0x0000000008880000-0x0000000008920000-memory.dmp

Download

memory/3264-7-0x0000000008880000-0x0000000008920000-memory.dmp

Download