dee578bbc597cdf0f900303b2efdcfce071b5d98327755b066d07837593e876b

Analysis

max time kernel
148s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 03:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_4a4745d8c673db82e2c203141fe0fd10_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Size 16.8MB
Sample260707-ej7z5aev7q
SHA256 dee578bbc597cdf0f900303b2efdcfce071b5d98327755b066d07837593e876b
MD5 4a4745d8c673db82e2c203141fe0fd10
SHA1 82b19c347df77cd569fcca6c9bc2b684753bf9f9
SHA512 6c642d8615dc711a49a57b131e986ffc64df9b47e3b2a8ff48a35b2b4bfa40777c3006ef59e1d797555f49895028b9962da8503947fae688beab428b3c0aa50a
SSDEEP 196608:6qUyDWsqsr28jedA2eZZu+enwDXrr28jedA2ezE7cX/o7c:JDWlsr28++ew3r28n
TLSH
T191078C47ECA545E8C0AAD2318A269253BB717C484B3523D73F60F7782F76BD0AA79740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4416	ChupaLand Launcher 3F55.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\mk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1943617716\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\sq\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_2007105294\smart_switch_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_2007105294\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_2007105294\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_2007105294\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1260861523\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1590832537\_locales\gl\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	ChupaLand Launcher 3F55.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	ChupaLand Launcher 3F55.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3944	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278703732549607"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{B5624A18-DF42-414A-9212-E7523308A55D}	msedge.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	ChupaLand Launcher 3F55.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2564	msedge.exe
2564	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2276	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 4416	536	2026-07-06_4a4745d8c673db82e2c203141fe0fd10_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	85
PID 4416 wrote to memory of 5824	4416	ChupaLand Launcher 3F55.exe	86
PID 5824 wrote to memory of 2276	5824	rundll32.exe	87
PID 2276 wrote to memory of 2348	2276	msedge.exe	88
PID 2276 wrote to memory of 3944	2276	msedge.exe	90
PID 2276 wrote to memory of 896	2276	msedge.exe	91
PID 2276 wrote to memory of 896	2276	msedge.exe	91
PID 2276 wrote to memory of 896	2276	msedge.exe	91
PID 2276 wrote to memory of 5896	2276	msedge.exe	92
PID 2276 wrote to memory of 5896	2276	msedge.exe	92
PID 2276 wrote to memory of 3596	2276	msedge.exe	93
PID 2276 wrote to memory of 3596	2276	msedge.exe	93
PID 2276 wrote to memory of 3596	2276	msedge.exe	93
PID 2276 wrote to memory of 4900	2276	msedge.exe	94
PID 2276 wrote to memory of 4900	2276	msedge.exe	94
PID 2276 wrote to memory of 4900	2276	msedge.exe	94
PID 2276 wrote to memory of 1828	2276	msedge.exe	101
PID 2276 wrote to memory of 4304	2276	msedge.exe	102
PID 2276 wrote to memory of 1828	2276	msedge.exe	101
PID 2276 wrote to memory of 4304	2276	msedge.exe	102
PID 2276 wrote to memory of 1676	2276	msedge.exe	104
PID 2276 wrote to memory of 3964	2276	msedge.exe	115
PID 2276 wrote to memory of 6012	2276	msedge.exe	116
PID 2276 wrote to memory of 1844	2276	msedge.exe	117
PID 2276 wrote to memory of 3228	2276	msedge.exe	119
PID 2276 wrote to memory of 3228	2276	msedge.exe	119
PID 2276 wrote to memory of 5404	2276	msedge.exe	120
PID 2276 wrote to memory of 5404	2276	msedge.exe	120
PID 2276 wrote to memory of 5708	2276	msedge.exe	130
PID 2276 wrote to memory of 5708	2276	msedge.exe	130
PID 2276 wrote to memory of 5600	2276	msedge.exe	134
PID 2276 wrote to memory of 5600	2276	msedge.exe	134
PID 2276 wrote to memory of 4424	2276	msedge.exe	136
PID 2276 wrote to memory of 4424	2276	msedge.exe	136
PID 2276 wrote to memory of 2564	2276	msedge.exe	137
PID 2276 wrote to memory of 5192	2276	msedge.exe	138
PID 2276 wrote to memory of 5192	2276	msedge.exe	138

C:\Users\Admin\AppData\Local\Temp\2026-07-06_4a4745d8c673db82e2c203141fe0fd10_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_4a4745d8c673db82e2c203141fe0fd10_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:536
- C:\Users\Admin\AppData\Local\ChupaLand\launcher-core\ChupaLand Launcher 3F55.exe
  "C:\Users\Admin\AppData\Local\ChupaLand\launcher-core\ChupaLand Launcher 3F55.exe"
  2⤵
  - Executes dropped EXE
  - Modifies trusted root certificate store through registry
  - Modifies system certificate store
  - Suspicious use of WriteProcessMemory
  PID:4416
- - C:\Windows\system32\rundll32.exe
    rundll32.exe url.dll,FileProtocolHandler http://127.0.0.1:49888
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://127.0.0.1:49888/
      4⤵
      Drops file in Program Files directory
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2276
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ffc75a9c188,0x7ffc75a9c194,0x7ffc75a9c1a0
        5⤵
        
        PID:2348
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,9401095178070778773,290926018703196953,524288 --field-trial-handle=2348,i,6209747673208097074,14223888235887466941,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:3944
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1900,i,649759286916333441,10318433064046570084,262144 --field-trial-handle=2348,i,6209747673208097074,14223888235887466941,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
        5⤵
        
        PID:896
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,3029132377405075408,13690597402408102665,524288 --field-trial-handle=2348,i,6209747673208097074,14223888235887466941,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:8
        5⤵
        
        PID:5896
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,8850769968211887629,17546103149303629342,2097152 --field-trial-handle=2348,i,6209747673208097074,14223888235887466941,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
        5⤵
        
        PID:3596
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,12975408448076816724,13701668013280726358,2097152 --field-trial-handle=2348,i,6209747673208097074,14223888235887466941,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
        5⤵
        
        PID:4900
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,13466762188539652301,9354570358487907217,524288 --field-trial-handle=2348,i,6209747673208097074,14223888235887466941,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:8
        5⤵
        
        PID:1828
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,11041549035458690468,5493564564819830515,524288 --field-trial-handle=2348,i,6209747673208097074,14223888235887466941,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:8
        5⤵
        
        PID:4304
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,15852958345079242183,5906895714265757371,524288 --field-trial-handle=2348,i,6209747673208097074,14223888235887466941,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:8
        5⤵
        
        PID:2832
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,15852958345079242183,5906895714265757371,524288 --field-trial-handle=2348,i,6209747673208097074,14223888235887466941,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:8
        5⤵
        
        PID:1676
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,8207964003620244068,6703143100858667103,524288 --field-trial-handle=2348,i,6209747673208097074,14223888235887466941,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
        5⤵
        
        PID:3964
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,17443241450532961332,5049275190695172733,524288 --field-trial-handle=2348,i,6209747673208097074,14223888235887466941,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
        5⤵
        
        PID:6012
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,3486067744284026563,5200834730068636337,524288 --field-trial-handle=2348,i,6209747673208097074,14223888235887466941,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
        5⤵
        
        PID:1844
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,13130043766481146732,2000360271225883166,524288 --field-trial-handle=2348,i,6209747673208097074,14223888235887466941,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:8
        5⤵
        
        PID:3228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,305729204038591013,5195053819188340517,524288 --field-trial-handle=2348,i,6209747673208097074,14223888235887466941,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
        5⤵
        
        PID:5404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,6958690154310315188,17729463394514714828,524288 --field-trial-handle=2348,i,6209747673208097074,14223888235887466941,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
        5⤵
        
        PID:5708
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,11532827635731388681,17420203294751477906,524288 --field-trial-handle=2348,i,6209747673208097074,14223888235887466941,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:8
        5⤵
        
        PID:5600
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,10757971565020379503,17588880307012080204,524288 --field-trial-handle=2348,i,6209747673208097074,14223888235887466941,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
        5⤵
        
        PID:4424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5764,i,330780130529149965,16736644271564718762,262144 --field-trial-handle=2348,i,6209747673208097074,14223888235887466941,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,14998223749124333897,7827368007341787438,524288 --field-trial-handle=2348,i,6209747673208097074,14223888235887466941,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
        5⤵
        
        PID:5192

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1260861523\manifest.json
Size 53B
SHA256 b2574db59e08ca01a3df98d2fb2d691981bf8167321f9789caf4e456364a46fe
MD5 8a7fdbc8b7044c1062a9c2ae49afa19f
SHA1 0602a4bc23f1023beb5c2a90235ede1fb8b6df10
SHA512 51584c3507666262b06f6e31da984947d18da8fe44d1b47942a4483b47573596abcabfdb739a894ec18eed6686591916cf60d5999fe3a76f3f2e6d94b328b2c3
TLSH
T1C49002604414951716C10E5065F0B881D391A61995850D5D04451559029546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2276_1943617716\manifest.json
Size 117B
SHA256 2679e1e5c5fbbdca9b0c5081ca7128c4c4957ce8e19f4e34736e7e41c9992169
MD5 a23bac1859419c430c1ecd103062bc6b
SHA1 8b10462bae7480e44f62c02ade7d0b3c09e05246
SHA512 e348ae665d1a42202679290530e3f41b28d67fb669ae36f8ed00418dd584a6cf7fe5a1a7482c6c59cf06772752ec5b61372a9d1ccc04e22af06fc8f20ba64bbc
TLSH
T133B092B00C0AA13B228193A0ECB066C6D3F80218E8015B1E088032481F8817881362A1
MD5 SHA1 SHA512 TLSH

Submit Download

llm_user_input_extractor_config.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2276_2007105294\llm_user_input_extractor_config.json
Size 4KB
SHA256 2056ee7ed0e7adb69344c93a024158ee4e2332ecd50d183dbad7595c4d588ed9
MD5 7736ccfaf720ef9b0db919dd01c4bf8c
SHA1 24b48ec2dee093b8e4384ad1e25ad8f12af0831e
SHA512 f044ed3b6fee483d211328df83f26b98dfe47890c05409c65c7f7333fde1fc043cd1c05d18250e8ee8731f355c13b3a0aedc0e60b82a26c42a7f209a69ad4781
SSDEEP 96:a0y3Cmyjw2w61skd7GZrlWqPZ96vOim87Ai:wyOy7k5rx0WVS1
TLSH
T11F91DF3BD8A15C2B00F3B225B87A7642F534A35B27C05C5B7A7C5A1C8FB6D312582F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2276_2007105294\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

ChupaLand Launcher 3F55.exe

Path C:\Users\Admin\AppData\Local\ChupaLand\launcher-core\ChupaLand Launcher 3F55.exe
Size 8.6MB
SHA256 4346ee9a61f2758a8a530c41d35b0971aec7122f66e189aae2689a3d8952c969
MD5 9c5ec91916cdfc3d9fc63627fb6b47cb
SHA1 7e2e1e816554c8c7d38c74911f08211553737f35
SHA512 e66b4e3fa86bd492541577e93b8b75d6a38e362f84874d4a43f21c2eca8f7eb49c7cb86455389cc3e2b8526d4d859eb51ebb6c2de9711166c53e94a79fe7635b
SSDEEP 98304:8DvpXu+entnUETvXrLPGdTya54ZHPD3edAgfkNT+6ZdNStw257q/:8Zu+enfDXrr28jedA2ezE7c
TLSH
T180968D47EC9545E8C4AED2308A269293BA717C484F3433D73B60F7692F76BD0AAB5704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2dca6b2ab0bf5f7331a465d827a0c5475afd75585392f8630e09e5c96069ae87
MD5 292bbfb12377bb0e886d2d5285059f8f
SHA1 e63bbc4d984050b6628e52374e41494f3355fcb6
SHA512 c379b6da94e5be0cc0fdb73001b9356f10b0a411c488268b88ed77dae4fa66708b24dd0b13f360f22b13a9cd300d0c5682e39fb6846ea40b630a85d711773bfb
TLSH
T1BAE02B66D861EC270CFD4B19B1498647E74513172B518A5F3B3D82088FF163645C685C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1ab3a4f5c00e6f2d2f36798d140063a6e8ebdab8921facf1d4cd55380f5169d7
MD5 4197db0cd033ec2b612078e49029fa6f
SHA1 3aebf3946db094c1e90ec98849b9edb09238d329
SHA512 d08a2b5b563de95d9df1aa6b7b5b869f5f0bb2ad88323fc91b2e81cec4a6ad169a78d40fea19613aa108bb3693b660b3355936c8eb6523938d0d92feb6b191c4
TLSH
T19641B0F383F8856E8A1195F0AA187E1BCE2D0515432C7D9A85E4AF2BD3F3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f331f68d059b4a7dea417e44165bbb9bc82f5912f33f5a01bc78714fbcfeee55
MD5 65336b46aef484e23aa3158a7de2f2cc
SHA1 12d759f38028ecc331ac62400833f27adbe27d2e
SHA512 3a06dbf62b80f5a25df4b0b11037c2c28b427e092403a7c1940230f1d2f43eb40896ba0256fd09f32a4584ba6d6b36457425f9a62b684064089651724c92c4f1
SSDEEP 192:sxZ0RQyMqZjK1Ml8Mie/fgssqXGaZdIaRuvhzodpT+HW6+WN22r/Yv+ux1E+OIgx:sxZ0dqe/fgssqWazIKYKyHb3/AEFjl
TLSH
T18362091AAA2459778CD7D219FA457B53D6F9016392904E48AAFCCF0C05E7BEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 59325cfe6499b47471b2e5a271a7afca03356b3618feae1c7899c9c8ebeb6cca
MD5 dc57058a379c76bfb3c0d3dade9d312b
SHA1 880226e09cdcecaf791eecbfbdaea663127197e0
SHA512 12c26cbcaae1fbe06193367c882666fd38c7a585538f1bf8a662f8c8815eb1e86a6a58a33cba250e86ab5f26be9a4c75ee0000faf389ef466d43c6e05bf6d465
SSDEEP 192:sxZ0RQyMqZjK1Ml8UQ7ie/fgsrXmZdIaRuvhzodpT+HW6+WN22r/YvRxNE+OIg5+:sxZ0dq+e/fgsr2zIKYKyHb3/iEFlC
TLSH
T11C72F91AAA345D778CD7D21AFA457B53D6F5016392904E48AAFC8F0C05E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 26a0ca76324ef512afe427ae7e7477d98400de2853d24f491b0ba05375400256
MD5 c621327c7d23023eb246ca7edfc6912a
SHA1 c866605a674da328b27fe9e0039b3efcf503111e
SHA512 ae24459aa7c356f333a373791d5f3095ed7a71ecb567cb840013b433c19844e1a8eff89070ccf25516056fa385062fe330ea45b5655a3f77a689fdb5be313d0b
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVvysy10LlG:eY8Od/HEnFhWvFvmXu1jabt10Lm2NurR
TLSH
T18CF2EB3B6C0CCB7E4F844E9CEC2A7F8A6DE802CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 5031414ddf0a1aea63724a2a875d774277f328895d95d34f84215525f7e453fc
MD5 ecbb61b5de6018b31d1bf872fb2bac12
SHA1 d0433a6a0203957207de54700c802b0a7ce32d33
SHA512 0da70473ced8b800070f51e8e113fb9c9b6a9a5ea7c06cd63c777be09d6d6caf9b0d101722ae0cb1ab8b2521d8eb38512e8b94c464d752dbf16d99b677f7b418
SSDEEP 192:05ppxnY753RNBvRJJdt7p5J9rL91fItpfd9c+:0LppY93PBZJPtN53rRm
TLSH
T121B27C5A713E0212397E298CB39696364F4135A37058E4AF7FB814A54F27E224CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.17\data.txt
Size 149KB
SHA256 fac5ec341b2f4b9c98a8bd7ec852589ee81e4938812666568752f36ae4f115ab
MD5 37f7815ef32ef7a6d94bf74fff24d177
SHA1 7f89ad80f67aad3ff68cbb27b15bc2ec7abe1bee
SHA512 843a7845f7c020a7d111b8dffd1482625fab9eb15afabff99e2cada1533d1a90c33807c208e536b4062cd4356ca9b19ca648f98b8c708d840d5d52378af13e03
SSDEEP 3072:SPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEhRUnf3WzARDcgGfQUX:+X1aI5aZoKzMJ07Nh6n/vDcgMQ+
TLSH
T1CFE3F1148DC44FDDDEA8291C90FD0F2D23A0C6AD857BA5CAE323BD49BFA79045727185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 4a7c775a145a7660d8115f6765393537565876621a4250b5a2ca31961db37703
MD5 c06b7a6cec0ba948f3e36da97d7d3c2d
SHA1 50f642815df4516f0a7c1117a191d6b9c0108c97
SHA512 82b3f2a285726f10648994e241c7833c861fa8013d1730db47e578589f613f97edb911c6390c9cbfa8b6f12a47e1c7047b28960b352d77b8dfb15ef78e705352
SSDEEP 384:nOiF1tNn/s3n9Sz43sNL8TUNTUlI47qQckCrI+MpvBftG0oDti/7cLtZqp6OObjd:lF1j+9J36wgZk6ajG02I7mj29MF
TLSH
T17DE2A1F598D78A76D89E4B9BA73E2E069EFCC16375881988B7D45D0CCC821BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 73b408ff51b684622a41eeee45f9011335406bdb55bd63bfd930000a19b4674b
MD5 056602c8d973cb110ec7767464d36b91
SHA1 f36e49630f43de20d8f3ac80131626b9022fd03a
SHA512 eeabb9dc997b012dae863758d3597f616832063de77929e434736133d815f36ed84ee43521e8963d35f8a1fd29400a7ea30cce2a78d08b4342902c8aa9af8719
SSDEEP 384:nsiF1tNn/s3n9Sk3sNL8TUNTUlI47qQckCrI0MpvBftG0oDti/7cLiZqp6OObjIi:XF1j+9V36wgZkYajG02I7bj29MF
TLSH
T13AD24B36DC64DAABEDE78F99B70A3A17EEE0017785C85AC8D9D95E0D01871AC0307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 857cba404785e30d6044c4881542f8d91021e7a9a229b7d0aab73e9084b78b25
MD5 f9292c6503ffc6f035fa92f336d66d65
SHA1 6f81d2efada057e75518c02b5c3accb658259516
SHA512 7db75e91397f0bd6a3d3e12b036c712451868039ade1f695524be9f2bc4cd3436f06ed0aaa5905e9b6a43c4472aca12627d646f248a9b74492f4fdafcc9b1134
SSDEEP 384:np+iF9CcmyWCs3sN78TUNTUlIm2QckCr9lZKpvBftG0oDti/7vZ1pje4KV8p0+Hr:pVFccps3GwgbkUTkjG02I7vNI8p0or
TLSH
T186B25B36EC68CABBECE74F99F70E6A07DEE0512785DC99E4DAD81D0D109719C130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 74d490e0bffb2c803245954abd50732b92069f42ca265e2f46b0773ea8d9b969
MD5 bc8dbc97029834c5a34fe5b431b81990
SHA1 29855f18d8a036c3b221f7ef2b3ffd84b2c73486
SHA512 8198ddaceeb4d6f9bbb00899a016ccb658f1347c29f9c3858bf30e7920d409fe928106011850ef4ada9e9376a0a1321bcadb27fb8f25949e1d9807823181d627
SSDEEP 384:npMiF9CcmyWCs3sNv8TUNTUlIm2QckCr9SsppvBftG0oDti/7cLqZqp6e4KV8p0K:p3Fccps3KwgbkUnXjG02I7JjI8p0or
TLSH
T10DC25C35EC68CEABECE78F99E70A7607DEE0417385DC59E4DAD85E0D109719C130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 8ae2b7be73530d1f518b984050e4aae34d1fe5c675e51899cfdae05db9435610
MD5 88b6f9316818f7430779f98f8fc1b98f
SHA1 073c82b2ad4204688c0db21ca68bba6fe492a398
SHA512 18c42f53b41bd4cf5dbbb832fa1a8a7ec8ec57cdcc53651c986d218cad5082975e39a993ec1eada7af139b702a2378d326901f64028c573d32648d0998693463
SSDEEP 384:npkiF1tNn/s3n9Sk3sNL8TUNTUlI47qQckCrI0MpvBftG0oDti/7cLiZqp6OObjd:p/F1j+9V36wgZkYajG02I7bj29MF
TLSH
T135D24B36DC64DAABEDE78F99B70A3A17EEE0017785C85AC8D9D95E0D01871AC0307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.7.1.2\typosquatting_list.pb
Size 668KB
SHA256 285655c896535d1813cc24522c142e3348d708ae63455f8d1ad51f90ed77cb60
MD5 f9dc9c29f4d276cc9218b52a6f01e2ab
SHA1 3d8491a6660f3906ea1078a4e588724065d42285
SHA512 99cf104ef889dd5815d2e246fb22e9c34eab91a88e22366de1ef226e4b4529fe85c84bc625fa32b7abcb7a4d27d06f244c55f8962cb563e20846a934a3b383ca
SSDEEP 6144:r5Wr6UixEWj7u3yL6jqiSfD8F7UESNOHZO3V6Bq8SAt:1Wr6UixEFCoSfDRT3V6Bq8SAt
TLSH
T13CE4D6B9DFC00154DB78112D20BE71D8181412A580E9EFEAFE7C855F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 461182d8b44211000a624dcf2ac5f3f2a25e692fb24eb8461113d88df3bbb9c4
MD5 790b11be84f94b746dbd23ed92010e81
SHA1 d3f6aaf75ac75e0a1c4decb8b7d8e992a21e7438
SHA512 b7d796bfeceb77c2665c6139cf729632f1a946df8646b807b73825ba4bfa90b65e1dd583364f1b34c14008537f3c035530edcf109494959de389fd7f7d6ddf05
TLSH
T1723101E15C381AE1C4BD0EBFB49739FC84E8D72AF1A470796888E994076D94D648143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 010830992c40f7118a6e1433c7ee83c85a0a58817ecfd35673be45d101badb28
MD5 2c06746ae2218cafc31ff3c8ee5ccde7
SHA1 d900a99d7932fc44a7c39e9c82fd193159f296ec
SHA512 df2bc21265b8a326aa5a1c936f3ab7f60983e9af06d931349364273db309cfd60a8e26b51cf998accda4c5539124c5f20df797f744d1e8f46d2e378a6e9a4853
TLSH
T1A93123E25D381AD1C4BD0EBEB48738FC84E8D62AF19430792888D9944729A1D654103F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 779dd4ce9cd370354bf5e84af11ea7b9027771372fdb4f4f63a423a46f8adfb4
MD5 2eeb95b1b8191c416328b9f00b98cc14
SHA1 b67b4b96ed17544a0a8eeb4f4ec85fdfb84036ae
SHA512 6798202b6f1560a7fdc3e31a52f4008a8c4fb109c1ac4d0774c0b3d93d460d4d3a2ffddddd690b9484caa1d966efb07612912e1267b738a3cce908ffc6719a7d
TLSH
T19F3145E15D381AD1C4BD0EBFB49775FC84E8D62AF1A0307D6888E994472D90D704143F
MD5 SHA1 SHA512 TLSH

Submit Download

f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 9ba64fdf12690bc24af750ffc8e144edc5fda28e40b47c6637e36760d82fc03a
MD5 b0d6f081a0ecbbc24e15755ca2fb45ea
SHA1 92ee094a6b43e98dd7623b28cbb7fcb000238278
SHA512 8252bfe20cf5e10b6bc5333ccffb4a04e1081c086c5d0829e42bfdb5244de2fdc17055e3dda4c6ab82361d61e7c8e22b872e1bdd79d193206eb97be324035628
TLSH
T1A4C02B0F187E08C48C06903AA40D0A5B06E0394020101176847F780000B421CC30096B
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 86842ab5de6c51aae11e7f29f69b4494749fc0233c3521ee2bb8227472de7092
MD5 14a8e3c0af9667e431f66517059af468
SHA1 7d0208f5df245e9c2af7b04e8e771842c4171adb
SHA512 0f0eb7f4d1b77c31fc5209466a239bb44c82d6709948ab5257ebc999c4c8f2ea165cc5a80a42fbf45b9f305f7dc3f08ca3d26b6c51942a2442638f244a0fd1dc
TLSH
T13A41295DB6F91108B3B76F56ABF6686E887FB8772F06805E00110E4F0A22B44D9B1737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1676-188-0x000001F4494E0000-0x000001F44A4E0000-memory.dmp

Download