dbcb033cbdb7f37d6d61709c455b10e6f9f9e8ffd0b9856153c6e24bf4c6359d

Analysis

max time kernel
900s
max time network
664s
platform
windows11-21h2_x64
resource
win11-20260911-de
resource tags

arch:x64arch:x86image:win11-20260911-delocale:de-deos:windows11-21h2-x64systemwindows
submitted
13/11/2026, 17:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BetaBrowser.exe
Size 236.1MB
Sample261113-wbk9tset21
SHA256 dbcb033cbdb7f37d6d61709c455b10e6f9f9e8ffd0b9856153c6e24bf4c6359d
MD5 316e6aa6f6fccf406383ebf9b5177fe7
SHA1 fc7c729b5e466a99d83962197faaaf7659d86176
SHA512 7e695961da4d4ea66b4df0efa8bee46be0df26c109c3713ed52317ab4519b7105b3b699f6727720eeec207b7cebf807d59a9f861b4f435d6471d7d3b590644ca
SSDEEP 1572864:MBY5OoZ73UqOSxkM3ct/0TEwfu5DI/JXW+mGEEVw3iH7mjS9CZ8cOIWsYRar0L58:MoqqP/blRsw
TLSH
T1D8C88C03F29641D9C05DC1798B5A9633FE71B8494B24A3DF2B5447922F76EE82B3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4888	BetaBrowser.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2060_766274767\manifest.json	BetaBrowser.exe
File created	C:\Windows\SystemTemp\scoped_dir2060_339671675\image.ico	BetaBrowser.exe
File created	C:\Windows\SystemTemp\scoped_dir2060_1754125474\image.ico	BetaBrowser.exe
File created	C:\Windows\SystemTemp\scoped_dir2060_1131048432\image.ico	BetaBrowser.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2060_766274767\_platform_specific\win_x64\widevinecdm.dll	BetaBrowser.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2060_766274767\LICENSE	BetaBrowser.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2060_766274767\_metadata\verified_contents.json	BetaBrowser.exe
File created	C:\Windows\SystemTemp\chromium_chrome_url_fetcher_2060_1951875398\oimompecagnajdejgnnjijobebaeigek_4.10.3112.0_win64_a5xadnsxzavp7cn4ay5kc6gq6u.crx3	BetaBrowser.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2060_766274767\_platform_specific\win_x64\widevinecdm.dll.sig	BetaBrowser.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BetaBrowser.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BetaBrowser.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BetaBrowser.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BetaBrowser.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	BetaBrowser.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	BetaBrowser.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
6076	reg.exe
2656	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4888	BetaBrowser.exe
4888	BetaBrowser.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2060	BetaBrowser.exe
Token: SeCreatePagefilePrivilege	2060	BetaBrowser.exe
Token: SeShutdownPrivilege	2060	BetaBrowser.exe
Token: SeCreatePagefilePrivilege	2060	BetaBrowser.exe
Token: SeShutdownPrivilege	2060	BetaBrowser.exe
Token: SeCreatePagefilePrivilege	2060	BetaBrowser.exe
Token: SeShutdownPrivilege	2060	BetaBrowser.exe
Token: SeCreatePagefilePrivilege	2060	BetaBrowser.exe
Token: SeShutdownPrivilege	2060	BetaBrowser.exe
Token: SeCreatePagefilePrivilege	2060	BetaBrowser.exe
Token: SeShutdownPrivilege	2060	BetaBrowser.exe
Token: SeCreatePagefilePrivilege	2060	BetaBrowser.exe
Token: SeShutdownPrivilege	2060	BetaBrowser.exe
Token: SeCreatePagefilePrivilege	2060	BetaBrowser.exe
Token: SeShutdownPrivilege	2060	BetaBrowser.exe
Token: SeCreatePagefilePrivilege	2060	BetaBrowser.exe
Token: SeShutdownPrivilege	2060	BetaBrowser.exe
Token: SeCreatePagefilePrivilege	2060	BetaBrowser.exe
Token: SeShutdownPrivilege	2060	BetaBrowser.exe
Token: SeCreatePagefilePrivilege	2060	BetaBrowser.exe
Token: SeShutdownPrivilege	2060	BetaBrowser.exe
Token: SeCreatePagefilePrivilege	2060	BetaBrowser.exe
Token: SeShutdownPrivilege	2060	BetaBrowser.exe
Token: SeCreatePagefilePrivilege	2060	BetaBrowser.exe
Token: SeShutdownPrivilege	2060	BetaBrowser.exe
Token: SeCreatePagefilePrivilege	2060	BetaBrowser.exe
Token: SeShutdownPrivilege	2060	BetaBrowser.exe
Token: SeCreatePagefilePrivilege	2060	BetaBrowser.exe
Token: SeShutdownPrivilege	2060	BetaBrowser.exe
Token: SeCreatePagefilePrivilege	2060	BetaBrowser.exe
Token: SeShutdownPrivilege	2060	BetaBrowser.exe
Token: SeCreatePagefilePrivilege	2060	BetaBrowser.exe
Token: SeShutdownPrivilege	2060	BetaBrowser.exe
Token: SeCreatePagefilePrivilege	2060	BetaBrowser.exe
Token: SeShutdownPrivilege	2060	BetaBrowser.exe
Token: SeCreatePagefilePrivilege	2060	BetaBrowser.exe
Token: SeShutdownPrivilege	2060	BetaBrowser.exe
Token: SeCreatePagefilePrivilege	2060	BetaBrowser.exe
Token: SeShutdownPrivilege	2060	BetaBrowser.exe
Token: SeCreatePagefilePrivilege	2060	BetaBrowser.exe
Token: SeShutdownPrivilege	2060	BetaBrowser.exe
Token: SeCreatePagefilePrivilege	2060	BetaBrowser.exe
Token: SeShutdownPrivilege	2060	BetaBrowser.exe
Token: SeCreatePagefilePrivilege	2060	BetaBrowser.exe
Token: SeShutdownPrivilege	2060	BetaBrowser.exe
Token: SeCreatePagefilePrivilege	2060	BetaBrowser.exe
Token: SeShutdownPrivilege	2060	BetaBrowser.exe
Token: SeCreatePagefilePrivilege	2060	BetaBrowser.exe
Token: SeShutdownPrivilege	2060	BetaBrowser.exe
Token: SeCreatePagefilePrivilege	2060	BetaBrowser.exe
Token: SeShutdownPrivilege	2060	BetaBrowser.exe
Token: SeCreatePagefilePrivilege	2060	BetaBrowser.exe
Token: SeShutdownPrivilege	2060	BetaBrowser.exe
Token: SeCreatePagefilePrivilege	2060	BetaBrowser.exe
Token: SeShutdownPrivilege	2060	BetaBrowser.exe
Token: SeCreatePagefilePrivilege	2060	BetaBrowser.exe
Token: SeShutdownPrivilege	2060	BetaBrowser.exe
Token: SeCreatePagefilePrivilege	2060	BetaBrowser.exe
Token: SeShutdownPrivilege	2060	BetaBrowser.exe
Token: SeCreatePagefilePrivilege	2060	BetaBrowser.exe
Token: SeShutdownPrivilege	2060	BetaBrowser.exe
Token: SeCreatePagefilePrivilege	2060	BetaBrowser.exe
Token: SeShutdownPrivilege	2060	BetaBrowser.exe
Token: SeCreatePagefilePrivilege	2060	BetaBrowser.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 3584	2060	BetaBrowser.exe	78
PID 2060 wrote to memory of 5140	2060	BetaBrowser.exe	79
PID 2060 wrote to memory of 6076	2060	BetaBrowser.exe	80
PID 2060 wrote to memory of 1956	2060	BetaBrowser.exe	81
PID 2060 wrote to memory of 2656	2060	BetaBrowser.exe	83
PID 2060 wrote to memory of 5372	2060	BetaBrowser.exe	85
PID 2060 wrote to memory of 4888	2060	BetaBrowser.exe	86

C:\Users\Admin\AppData\Local\Temp\BetaBrowser.exe
"C:\Users\Admin\AppData\Local\Temp\BetaBrowser.exe"
1⤵
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Users\Admin\AppData\Local\Temp\BetaBrowser.exe
  "C:\Users\Admin\AppData\Local\Temp\BetaBrowser.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\BetaBrowser" --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1904,i,1691605538960518731,11499686899429218087,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1908,i,7590516571360693597,2657099666464417106,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:3584
- C:\Users\Admin\AppData\Local\Temp\BetaBrowser.exe
  "C:\Users\Admin\AppData\Local\Temp\BetaBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\BetaBrowser" --bypasscsp-schemes=crx --field-trial-handle=1904,i,1691605538960518731,11499686899429218087,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1908,i,7590516571360693597,2657099666464417106,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2156 /prefetch:11
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:5140
- C:\Windows\system32\reg.exe
  reg.exe query HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall /s
  2⤵
  - Modifies registry key
  PID:6076
- C:\Users\Admin\AppData\Local\Temp\BetaBrowser.exe
  "C:\Users\Admin\AppData\Local\Temp\BetaBrowser.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\BetaBrowser" --bypasscsp-schemes=crx --app-user-model-id=de.betabrowser.app --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --mse-audio-buffer-size-limit-mb=40 --mse-video-buffer-size-limit-mb=400 --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --launch-time-ticks=549707436 --field-trial-handle=1904,i,1691605538960518731,11499686899429218087,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1908,i,7590516571360693597,2657099666464417106,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2460 /prefetch:1
  2⤵
  PID:1956
- C:\Windows\system32\reg.exe
  reg.exe query HKCU\Software\Clients\StartMenuInternet\BetaBrowser
  2⤵
  - Modifies registry key
  PID:2656
- C:\Users\Admin\AppData\Local\Temp\BetaBrowser.exe
  "C:\Users\Admin\AppData\Local\Temp\BetaBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Roaming\BetaBrowser" --bypasscsp-schemes=crx --field-trial-handle=1904,i,1691605538960518731,11499686899429218087,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1908,i,7590516571360693597,2657099666464417106,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3496 /prefetch:14
  2⤵
  PID:5372
- C:\Users\Admin\AppData\Local\Temp\BetaBrowser.exe
  "C:\Users\Admin\AppData\Local\Temp\BetaBrowser.exe" --type=gpu-process --disable-gpu-sandbox --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\BetaBrowser" --gpu-preferences=WAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAAAAAAAAAAAADgAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAADAAAAAEAAAAAAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=d3d11-warp-webgl --field-trial-handle=1904,i,1691605538960518731,11499686899429218087,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1908,i,7590516571360693597,2657099666464417106,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=2796 /prefetch:10
  2⤵
  - Network Service Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

temp-index

Path C:\Users\Admin\AppData\Roaming\BetaBrowser\Code Cache\js\index-dir\temp-index
Size 48B
SHA256 0af65e9178e251015b6b1a74757eaea9c32df8e7a62d68802f7530f6f1f9e0b4
MD5 04b9138c82c2330d8a46cb4923697676
SHA1 49af0379dde1d32272c9aa8e9d7e9629df67e843
SHA512 15dd4a2c9e795c2507ee684c81255aa1c47d14b4b472662cde8ef0412ee85a95ddd34a39df66ec2a6f43dba3ac0935eabf82d6aa568e5b8a724a8a3f6509bebd
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\BetaBrowser\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\BetaBrowser\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\BetaBrowser\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\BetaBrowser\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\BetaBrowser\Local State
Size 717B
SHA256 36840bb25c86c3d7721d9e27f0ee84e52cd316a2b26b812d07317c0b77c31e01
MD5 04d2141293921b827bedfc3d00cd9912
SHA1 d8a752b84ace5bc859c4704491f87b8c5286da93
SHA512 8e86025383540c9c144c87cb301293576387074dbaef999dc7b552ed6f84ecb80e1c2cd1cb7ebd55c2ad4449802d6f806bec0e3a6941fdad3e901f47afcba0de
TLSH
T19A0188F74C3DC8E2BE750E990E47B1314ED0269B164607C858FC084580DE4E5FB0553B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State00dc057c-2d61-4d91-a0ca-baff332cb4a9.tmp

Path C:\Users\Admin\AppData\Roaming\BetaBrowser\Local State00dc057c-2d61-4d91-a0ca-baff332cb4a9.tmp
Size 717B
SHA256 3cfd0f39a74b8e30b7274c6a1e286ee9e30dfd7ab529c334429c517d8ed65208
MD5 2006b16caf40e0a3241d024b62ff2ad5
SHA1 19ac1ecb1a320bf3a0b947d7df6af7c6a25886de
SHA512 40267234b25ba08a25724449b96d7297f8abc1acc2dec166f352e653b7f4676a7cd61c19c1de7772dcfd45a125aa0e8389dfb12a474572a93e767c74445d1ab8
TLSH
T15F0144BB4C7DC9E2BE790E990E4666320EA4625B028502C848EC044540EE4EABA09936
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\BetaBrowser\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\BetaBrowser\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State7bd578a8-245f-41a0-a5d9-78fd5c8d8208.tmp

Path C:\Users\Admin\AppData\Roaming\BetaBrowser\Network\Network Persistent State7bd578a8-245f-41a0-a5d9-78fd5c8d8208.tmp
Size 476B
SHA256 f3ee39028f858c784db376c215db511b5250ebd2615873c71162644765803a80
MD5 0f0d158ad1af2f26176b7dfa7b68a994
SHA1 951457b682a96ed23da6dd96257ff5407b63dc8b
SHA512 ffb9ff1df04db7451289e972080fb4eb35127aac31c580461a41031aba2f645cfa7a0d88860bb66c7a29139f24ebc207ccf25b2ad6fa0fa2aebf38a04f11d5a3
TLSH
T1F9F0DCA6C6D905BE8A4213F05E357823C1BE1809421C3C12C9E4EB8E87F043E151544F
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\BetaBrowser\WidevineCdm\4.10.3112.0\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\BetaBrowser\WidevineCdm\4.10.3112.0\manifest.json
Size 1005B
SHA256 1cc15465230ffb75fd028ee3b2189c8774f56bc7dee8dd17b952e6ca92144004
MD5 58954048e70c81669675d4f87ab50af1
SHA1 8ab675ea31801bbb91c33fd381f4c202bfd7882e
SHA512 f9b8c236c9404936b93ba92550c21a0344b657c42cd98e091cda32e33fed860d59ac0cb97451ca61b2d8e6a943a983ded569b1d7ecd541e832e3ca87b39ecbd0
TLSH
T161115E00DD384DD326D4B6A21CC6580957661DAF5CC27E54379E161D4F1C8AB927376C
MD5 SHA1 SHA512 TLSH

Submit Download

1090c5d6881985c042370d506e15f1db1d0a88bfb7e9602a9202fac421098eb3

Path C:\Users\Admin\AppData\Roaming\BetaBrowser\component_crx_cache\1090c5d6881985c042370d506e15f1db1d0a88bfb7e9602a9202fac421098eb3
Size 21.9MB
SHA256 1090c5d6881985c042370d506e15f1db1d0a88bfb7e9602a9202fac421098eb3
MD5 322a050bc53af9aad7a659054354862d
SHA1 44dec61c400db851b57e4e2645fb253609db7d1d
SHA512 ae8624becb7619dd9602f416203c54096ae0e23c4c2574c8069e633f9682b0b9bf5bbb95e94fca6610b9581746d5ed648fd41c47d762b174bd5d632937df6689
SSDEEP 393216:vKuarWwW0LmrEr38dudevJCJU2kpq1gL2aVRHA:wWCmz0dwJIkpqCs
TLSH
T16337E14AE35310E9E81ECDF4866E9A62E4343C4E03319BEF17D47A355A727C42A39F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verified_contents.json

Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2060_766274767\_metadata\verified_contents.json
Size 1KB
SHA256 a6ce8c1d0d27c54034e67a83270bf3fd2bdfcc45ffc4b9084357169c00c90f77
MD5 42b331a107b7320d16f115eb7872b3c5
SHA1 3438a81f13c76becc7eb8bf0a7881088e5ad358b
SHA512 afc9393c7a63ec8d95c708eab601ab76887e4600a03b10f3c8c6e6c78c1c48d8b8bc6f059f8f38e66f1e54c5040656b75b6d46b91a795f76dbb5d3c6ac59b333
TLSH
T12F31B7414DD5369EA14E42245AB873AB9F0E71B372C8A51DA9C5900CF4F914ACBD308F
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2060_766274767\_platform_specific\win_x64\widevinecdm.dll
Size 21.9MB
SHA256 7b44e84403fbb3faee15ca2d56eb8432fdf4eb68812c4460abdd20972528e825
MD5 5614c2225ece73a37e47894ff3c19aa3
SHA1 df3aadd22db3b5841fe488c985365269709b4b27
SHA512 8b8e55347a7a496cfe52222670781654ada20accf21f3e2dd88847e0a7a00cb083609a5f3907bcc1f927c1227de20373a744028466663c5389ad286a46fc3286
SSDEEP 393216:SKuarWwW0LmrEr38dudevJCJU2kpq1gL2aVRHy:dWCmz0dwJIkpqCW
TLSH
T1CC37E14AE35350E9E81ECDF4826E9A62E4343C4E03319BEF17D47A355A727C42A39F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2060_766274767\_platform_specific\win_x64\widevinecdm.dll.sig
Size 1KB
SHA256 f9f160cb5ca37ef81a3aa80eeb7fef8b302e18c82d92c34f42503e0ab085ada5
MD5 a0dd5d559b24af4590e5cae3ac11a0fd
SHA1 04b83b414c36ab24fd27fe432a690de636bd2996
SHA512 2d69ea26916ed156f214c17d57c158cb680f1119849b8dd1f7315fd3fa6981c9d6ec2026b494d8e2e70e969205f063979287265a94e73704fe392884e8b4e4ac
TLSH
T1DE21E9DD697012242880793E5FEDF016FD3325C2AA3014FF456B65C2BCE376018C462E
MD5 SHA1 SHA512 TLSH

Submit Download

image.ico

Path C:\Windows\SystemTemp\scoped_dir2060_1754125474\image.ico
Size 107KB
SHA256 2986e62d120af0389aebe2a4912e4b3bdc3c6192700fed85e454620be977751e
MD5 3c019b52e276d88a2b491e64de579876
SHA1 4253a7058f8de58c214a5c7bfbabad137bd3a587
SHA512 ec4bf4029aeccb02ed2cdf975e342f55bcdca4bf2afc46a6f4146fa51c7bf18531c463e00a24686380eb78e1de6ae07ee868c282924ed5f009db4e6b12508dbc
SSDEEP 3072:nlIAaXdSSCBNfW8BaaSX/zIIpVJjxzbr+eKq7gcsC:lrGd7CBNf8B/3B+R8
TLSH
T170B302E3A7D0FD3CEC47339A17B91C22A9E7305518A00326D9416A725ACE4D863F8777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1956-32-0x00007FFCB8850000-0x00007FFCB8851000-memory.dmp

Download

memory/1956-34-0x00007FFCB8530000-0x00007FFCB8531000-memory.dmp

Download

memory/3584-151-0x0000027A89750000-0x0000027A8AFE8000-memory.dmp

Download

memory/3584-148-0x0000027A89750000-0x0000027A8AFE8000-memory.dmp

Download

memory/3584-213-0x0000027A89750000-0x0000027A8AFE8000-memory.dmp

Download

memory/4888-188-0x0000017F73FE0000-0x0000017F73FE1000-memory.dmp

Download

memory/4888-178-0x0000017F73FE0000-0x0000017F73FE1000-memory.dmp

Download

memory/4888-190-0x0000017F73FE0000-0x0000017F73FE1000-memory.dmp

Download

memory/4888-189-0x0000017F73FE0000-0x0000017F73FE1000-memory.dmp

Download

memory/4888-179-0x0000017F73FE0000-0x0000017F73FE1000-memory.dmp

Download

memory/4888-187-0x0000017F73FE0000-0x0000017F73FE1000-memory.dmp

Download

memory/4888-186-0x0000017F73FE0000-0x0000017F73FE1000-memory.dmp

Download

memory/4888-185-0x0000017F73FE0000-0x0000017F73FE1000-memory.dmp

Download

memory/4888-184-0x0000017F73FE0000-0x0000017F73FE1000-memory.dmp

Download

memory/4888-191-0x0000017F725E0000-0x0000017F73E78000-memory.dmp

Download

memory/4888-180-0x0000017F73FE0000-0x0000017F73FE1000-memory.dmp

Download