Overview

overview

10

Static

static

1

URLScan

urlscan

https://github.com/D...

windows10-2004-x64

10

Resubmissions

22/02/2025, 14:27

250222-rsqtesyqg1 10

Analysis

  • max time kernel
    104s
  • max time network
    113s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/02/2025, 14:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/Spyware/The%20Worst%20Of%20All!!!!!!

Score
10/10
chimeradiscoveryransomwarespywarestealer

Malware Config

Signatures

  • Chimera 64 IoCs

    Ransomware which infects local and network files, often distributed via Dropbox links.

    ransomwarechimera
  • Chimera Ransomware Loader DLL 1 IoCs

    Drops/unpacks executable file which resembles Chimera's Loader.dll.

    ransomware
  • Chimera family
    chimera
  • Renames multiple (3272) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 27 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 48 IoCs
    adwarespyware
  • Modifies registry class 1 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 36 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/Spyware/The%20Worst%20Of%20All!!!!!!
    1⤵
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1308
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8122c46f8,0x7ff8122c4708,0x7ff8122c4718
      2⤵
        PID:4764
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,391786624734418137,804861999554231997,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
        2⤵
          PID:464
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,391786624734418137,804861999554231997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
          2⤵
          • Downloads MZ/PE file
          • Suspicious behavior: EnumeratesProcesses
          PID:832
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,391786624734418137,804861999554231997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
          2⤵
            PID:4516
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,391786624734418137,804861999554231997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
            2⤵
              PID:4060
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,391786624734418137,804861999554231997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
              2⤵
                PID:868
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,391786624734418137,804861999554231997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:8
                2⤵
                  PID:5092
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,391786624734418137,804861999554231997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1300
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,391786624734418137,804861999554231997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
                  2⤵
                    PID:5024
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,391786624734418137,804861999554231997,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
                    2⤵
                      PID:1512
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,391786624734418137,804861999554231997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
                      2⤵
                        PID:2488
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,391786624734418137,804861999554231997,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
                        2⤵
                          PID:2620
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2112,391786624734418137,804861999554231997,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5740 /prefetch:8
                          2⤵
                            PID:1536
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,391786624734418137,804861999554231997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
                            2⤵
                              PID:1524
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2112,391786624734418137,804861999554231997,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6572 /prefetch:8
                              2⤵
                                PID:4836
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,391786624734418137,804861999554231997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4736
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:1796
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:872
                                • C:\Windows\System32\rundll32.exe
                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                  1⤵
                                    PID:2584
                                  • C:\Users\Admin\Downloads\HawkEye.exe
                                    "C:\Users\Admin\Downloads\HawkEye.exe"
                                    1⤵
                                    • Chimera
                                    • Executes dropped EXE
                                    • Drops desktop.ini file(s)
                                    • Drops file in Program Files directory
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1556
                                    • C:\Program Files\Internet Explorer\iexplore.exe
                                      "C:\Program Files\Internet Explorer\iexplore.exe" -k "C:\Users\Admin\Music\YOUR_FILES_ARE_ENCRYPTED.HTML"
                                      2⤵
                                      • Modifies Internet Explorer settings
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of SetWindowsHookEx
                                      PID:4064
                                      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4064 CREDAT:17410 /prefetch:2
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        • Modifies Internet Explorer settings
                                        • Suspicious use of SetWindowsHookEx
                                        PID:4392
                                  • C:\Windows\system32\OpenWith.exe
                                    C:\Windows\system32\OpenWith.exe -Embedding
                                    1⤵
                                    • Modifies registry class
                                    • Suspicious use of SetWindowsHookEx
                                    PID:3672

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Program Files\Java\jdk-1.8\jre\lib\YOUR_FILES_ARE_ENCRYPTED.HTML
                                    Filesize

                                    4KB

                                    MD5

                                    f9bf0e735686c2a171097b559563a7a4

                                    SHA1

                                    0c11c64a1096f85e2b2470df5629774a9df061ec

                                    SHA256

                                    8739c7ff5920265c144265730bb29c32362aea7a68c84c110614edd68a93b039

                                    SHA512

                                    d9618c639bf3d5990e9f4a52c9e6f2c3456e493b17762f44121fa18ba2e0bcbfe338abf86fa06b5189d8060a84592e45734f6fd7c350d24500bfad419bcf0192

                                    Download Submit

                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\31976568FBE31D20174C3FAC50D34698_2224EF112EEB7D5CE6B913D61620C791
                                    Filesize

                                    471B

                                    MD5

                                    5cbd901780b6d224383817afe25882bc

                                    SHA1

                                    8f442dc89f846e55f528904f6be4b02239dbe441

                                    SHA256

                                    0c13026cc40b047aa046c572b43e032ab2a50682d404f4f11f9e4994090034e0

                                    SHA512

                                    86ec52e24bd854fb1fbe64b86666da43b75a0cc4b06a92f7248188140be7a7944663b12774c88385ee561c5051092ec28fa4635e2964f2abc902ff9c2fe742e1

                                    Download Submit

                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\31976568FBE31D20174C3FAC50D34698_2224EF112EEB7D5CE6B913D61620C791
                                    Filesize

                                    400B

                                    MD5

                                    52a1ed03e0f468367a99a7723bfef97e

                                    SHA1

                                    d09d347b0b12cd261dceef1478d8ef06cccad54e

                                    SHA256

                                    d5aa031963c3c1249684f73045d52a296c73c9e9272bf72eac9d4cb5ba4271b6

                                    SHA512

                                    91ceea1210eccc417d7eb978d8b65021fb0c1a40c05339ffb391adf25d58a4b21d0c0801e6cbc4f5067d7aab72640ed600c3c4b78b3ea49c3a15a7b39534861c

                                    Download Submit

                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
                                    Filesize

                                    4KB

                                    MD5

                                    da597791be3b6e732f0bc8b20e38ee62

                                    SHA1

                                    1125c45d285c360542027d7554a5c442288974de

                                    SHA256

                                    5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

                                    SHA512

                                    d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                    Filesize

                                    152B

                                    MD5

                                    25f87986bcd72dd045d9b8618fb48592

                                    SHA1

                                    c2d9b4ec955b8840027ff6fd6c1f636578fef7b5

                                    SHA256

                                    d8b542281740c12609279f2549f85d3c94e6e49a3a2a4b9698c93cca2dce486c

                                    SHA512

                                    0c8a0d1a3b0d4b30773b8519a3d6e63d92973733da818ca9838599a9639e18df18ce31ebf56f46f6bbb7d89d10c726f4d73781e154d115a6068a3be7dd12b314

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                    Filesize

                                    152B

                                    MD5

                                    94bd9c36e88be77b106069e32ac8d934

                                    SHA1

                                    32bd157b84cde4eaf93360112d707056fc5b0b86

                                    SHA256

                                    8f49a43a08e2984636b172a777d5b3880e6e82ad25b427fef3f05b7b4f5c5b27

                                    SHA512

                                    7d4933fae6a279cc330fde4ae9425f66478c166684a30cec9c5c3f295289cf83cbdf604b8958f6db64b0a4b1566db102fbcbdcdb6eca008d86d9a9c8b252ff16

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                    Filesize

                                    1KB

                                    MD5

                                    6a7d444a38dc93877878a9c14fe62229

                                    SHA1

                                    5271a8f4ecc2c81c55515c0ea777ef7e14aaca6d

                                    SHA256

                                    8b008ebff7310d4a88f9a8d64886cedff642f85213cb96dbf94b8124b91462cf

                                    SHA512

                                    6ea0f1b8bd32c5a8629aa581f324eb12448db4e3b332bb46161f4862ec45afb0a1c0b17985ea5ec76db38062deafd4dff07270c001b90e18ccdfebb73268c988

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                    Filesize

                                    579B

                                    MD5

                                    0a8a7c3dafeb4ad3d8cb846fc95b8f1c

                                    SHA1

                                    69e2b994e6882e1e783410dae53181984050fa13

                                    SHA256

                                    a88495f2c1c26c6c1d5690a29289467c8bb8a94bf6f4801d2c14da1456773f90

                                    SHA512

                                    2e59b4cd4cf6f86537aae4ae88e56e21abcff5070c5c1d1d2105a8e863523c80740438cc36b2b57672bc7bb7fb9387896135afcce534edfd4697fecf61031a5c

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                    Filesize

                                    6KB

                                    MD5

                                    5f5aeabca9cdc6d403638b989bb37583

                                    SHA1

                                    6ca329dc530e964888b256fe31f41d0e98d76269

                                    SHA256

                                    717c32263ae35d7b94086ab911adf9e8cb3ce0630fc305c55d1b8fa161563cb5

                                    SHA512

                                    1516ea5931517e20e0b31db7ab8505d1d36d661431d32f12179fe11fa354a21a416c1c5aed4480abeed821ecf37836bf33f2b8ba9e36c25bdfe57de575535155

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                    Filesize

                                    6KB

                                    MD5

                                    9ef2598b20dccd8d2040dd57607b6d1e

                                    SHA1

                                    5194da8839dfb82d41459c0ba628739bb000fa68

                                    SHA256

                                    103a337cb03834d493acc5c1c6c6d8deaa82d5160d334332b66edd09d4a4e04a

                                    SHA512

                                    5347dad550b681a83c92655c687e6856ae4ffec7c263accc2c19510b6fee2155f9d103382309f3ccc625da28dbcf83652d9b69ae31863c95ab6003c955e31a2f

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                    Filesize

                                    6KB

                                    MD5

                                    69d91e76aa6b037c69f4f8196fdebcaf

                                    SHA1

                                    e425f396afe44158e713c548c57824142cfbe9a4

                                    SHA256

                                    98e50f0623e1d53caa6e5216137dba2c92750d84d3f05dac7695f80404afd378

                                    SHA512

                                    8a00a53bbf8ea614fe53626249147faa9b521c4e06520a5954a2972fa8d3ee6347203717b526cde769a41c12ccd9d53b1a3d6ef1e4373eba08c36bd144d582aa

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                    Filesize

                                    1022B

                                    MD5

                                    7658a031a06c0ca6001de6ef396a7ac6

                                    SHA1

                                    a37ad98f5bd4637ed6e92d16a7215822d226c73e

                                    SHA256

                                    2cd555a64f48f8030fd9a4f09875dea4d47e8ba6d6d35a5f2d93463eb73eba5d

                                    SHA512

                                    2e3352beccbac352d55c0e771d81061a19a98d2a781748482aa22ec1c85f9b368d10ca2bfed60f1460df18f25aa66c08f08126b2b2a5a0b45b2654d8d6cea3e7

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                    Filesize

                                    1018B

                                    MD5

                                    d6889a2109cd4dfa4e5ed6304d7eb7e6

                                    SHA1

                                    38607913629e172c0c9b29f54edc7dbe341c83a3

                                    SHA256

                                    fad59f10761444bff6ef8b52b85d72545507c6e9b84594a9b3816b28d77eaf81

                                    SHA512

                                    e72bcb6713faeadc212e334aefc9782410deb38e648681a1235570497b11fa9105967a4a9d515c53b3dbb38ca3c87b0ae3441ffcf93f96ec3dcc4dae8fea4ba9

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5868e6.TMP
                                    Filesize

                                    854B

                                    MD5

                                    3af3953fd9d9f501005166fb1ed98582

                                    SHA1

                                    bdddaf96e849f0cbab68d9e6957347e7e8fc68dd

                                    SHA256

                                    ade78fa7503c38ff152f6714e00353ebd8cd48f812d536127f0208279c54eac0

                                    SHA512

                                    c0c5ca1296c6b90da67bcdcc8edc620767897749b9b43e2580c492940c18c6ee03d54dacb95ec2401fe5859b5bd29666e3abe00a364e324a780ff8313f3c3aca

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                    Filesize

                                    16B

                                    MD5

                                    46295cac801e5d4857d09837238a6394

                                    SHA1

                                    44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                    SHA256

                                    0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                    SHA512

                                    8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                    Filesize

                                    16B

                                    MD5

                                    206702161f94c5cd39fadd03f4014d98

                                    SHA1

                                    bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                    SHA256

                                    1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                    SHA512

                                    0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                    Filesize

                                    11KB

                                    MD5

                                    426d85dbba5538979da3b8448196cecc

                                    SHA1

                                    165098955aee965bed15c65a7e382bca14b72882

                                    SHA256

                                    8aff82ef56ce82e78f7e8e3451f86d867178e1e82578b20e506453b81d8beb2a

                                    SHA512

                                    5e71febe59f41debf0a1e7affc98b54591540d14050b86b3a94d3d8f6d5498db6c9e81ca679314f204ab141f6f49efe45723dab3abde175b596b70cba97529ff

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                    Filesize

                                    11KB

                                    MD5

                                    e25fa8626928c804d8db8377e33d4836

                                    SHA1

                                    f8379850bfc0d6a4a88758b947d44886aed03f7b

                                    SHA256

                                    9912955bd0725ea8b04e630a1b7f304388e11c129b31d112b170cdb93c2a0b44

                                    SHA512

                                    8ad9169ab9af82683281d8eae9e116e950ba04e85f9217878b39c15f5baedc67ae51c586f31e7ea7ca0ccf3890835c76ae517818691d9eab6e6790ca06dad6d9

                                    Download Submit

                                  • C:\Users\Admin\Downloads\Unconfirmed 963888.crdownload
                                    Filesize

                                    232KB

                                    MD5

                                    60fabd1a2509b59831876d5e2aa71a6b

                                    SHA1

                                    8b91f3c4f721cb04cc4974fc91056f397ae78faa

                                    SHA256

                                    1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838

                                    SHA512

                                    3e842a7d47b32942adb936cae13293eddf1a6b860abcfe7422d0fb73098264cc95656b5c6d9980fad1bf8b5c277cd846c26acaba1bef441582caf34eb1e5295a

                                    Download Submit

                                  • memory/1556-227-0x0000000004E40000-0x0000000004E5A000-memory.dmp

                                    Filesize

                                    104KB

                                    Download

                                  • memory/1556-222-0x0000000010000000-0x0000000010010000-memory.dmp

                                    Filesize

                                    64KB

                                    Download