blakcsee_stealer | hxxps://mylolandryeobl[.]github[.]io/[.]github/serum-vst-plugin

Analysis

user interaction
yes
max time kernel
295s
max time network
289s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/08/2026, 21:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://mylolandryeobl.github.io/.github/serum-vst-plugin
Sample260812-1dl2css1ft

Score

10^/10

discovery blakcsee_stealer stealer

Malware Config

Extracted

Family

blakcsee_stealer

2.26.126.50

Signatures

Family: BlakcSeeStealer
BlakcSeeStealer is a Windows stealer written in C++.
stealer blakcsee_stealer

Looks up external IP address via web service 1 TTPs 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
111	api.ipify.org
112	api.ipify.org
113	ip-api.com
115	api.ipify.org
117	api.ipify.org
128	api.ipify.org
130	api.ipify.org

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 3512 set thread context of 2612	3512	serum-vst-plugin-1.56.9.exe	133
PID 3304 set thread context of 3708	3304	serum-vst-plugin-1.56.9.exe	136
PID 3612 set thread context of 756	3612	serum-vst-plugin-1.56.9.exe	153
PID 1976 set thread context of 2792	1976	serum-vst-plugin-1.56.9.exe	167
PID 4496 set thread context of 3940	4496	serum-vst-plugin-1.56.9.exe	178

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4796	msedge.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ServiceModelReg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ServiceModelReg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ServiceModelReg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ServiceModelReg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ServiceModelReg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ServiceModelReg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ServiceModelReg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ServiceModelReg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ServiceModelReg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ServiceModelReg.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310439407384050"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{234BAA88-6B18-481A-8B83-A7956B63B5CE}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 3952	1068	msedge.exe	86
PID 1068 wrote to memory of 4052	1068	msedge.exe	87
PID 1068 wrote to memory of 4796	1068	msedge.exe	88
PID 1068 wrote to memory of 4052	1068	msedge.exe	87
PID 1068 wrote to memory of 4052	1068	msedge.exe	87
PID 1068 wrote to memory of 1536	1068	msedge.exe	89
PID 1068 wrote to memory of 1536	1068	msedge.exe	89
PID 1068 wrote to memory of 1212	1068	msedge.exe	91
PID 1068 wrote to memory of 1212	1068	msedge.exe	91
PID 1068 wrote to memory of 1212	1068	msedge.exe	91
PID 1068 wrote to memory of 4996	1068	msedge.exe	92
PID 1068 wrote to memory of 4996	1068	msedge.exe	92
PID 1068 wrote to memory of 4996	1068	msedge.exe	92
PID 1068 wrote to memory of 4916	1068	msedge.exe	93
PID 1068 wrote to memory of 4916	1068	msedge.exe	93
PID 1068 wrote to memory of 4916	1068	msedge.exe	93
PID 1068 wrote to memory of 1308	1068	msedge.exe	94
PID 1068 wrote to memory of 1308	1068	msedge.exe	94
PID 1068 wrote to memory of 1308	1068	msedge.exe	94
PID 1068 wrote to memory of 1760	1068	msedge.exe	98
PID 1068 wrote to memory of 1760	1068	msedge.exe	98
PID 1068 wrote to memory of 1760	1068	msedge.exe	98
PID 1068 wrote to memory of 4284	1068	msedge.exe	99
PID 1068 wrote to memory of 4592	1068	msedge.exe	100
PID 1068 wrote to memory of 4284	1068	msedge.exe	99
PID 1068 wrote to memory of 4592	1068	msedge.exe	100
PID 1068 wrote to memory of 4928	1068	msedge.exe	102
PID 1068 wrote to memory of 672	1068	msedge.exe	103
PID 1068 wrote to memory of 672	1068	msedge.exe	103
PID 1068 wrote to memory of 672	1068	msedge.exe	103
PID 1068 wrote to memory of 2412	1068	msedge.exe	106
PID 1068 wrote to memory of 2412	1068	msedge.exe	106
PID 1068 wrote to memory of 2412	1068	msedge.exe	106
PID 1068 wrote to memory of 1476	1068	msedge.exe	109
PID 1068 wrote to memory of 2344	1068	msedge.exe	110
PID 1068 wrote to memory of 1476	1068	msedge.exe	109
PID 1068 wrote to memory of 2344	1068	msedge.exe	110
PID 1068 wrote to memory of 2344	1068	msedge.exe	110
PID 1068 wrote to memory of 3376	1068	msedge.exe	115
PID 1068 wrote to memory of 4004	1068	msedge.exe	116
PID 1068 wrote to memory of 4828	1068	msedge.exe	117
PID 1068 wrote to memory of 3080	1068	msedge.exe	119
PID 1068 wrote to memory of 3956	1068	msedge.exe	120
PID 1068 wrote to memory of 3956	1068	msedge.exe	120
PID 1068 wrote to memory of 4204	1068	msedge.exe	121
PID 1068 wrote to memory of 4204	1068	msedge.exe	121
PID 3512 wrote to memory of 2612	3512	serum-vst-plugin-1.56.9.exe	133
PID 3512 wrote to memory of 2612	3512	serum-vst-plugin-1.56.9.exe	133
PID 3512 wrote to memory of 2612	3512	serum-vst-plugin-1.56.9.exe	133
PID 3512 wrote to memory of 2612	3512	serum-vst-plugin-1.56.9.exe	133
PID 3512 wrote to memory of 2612	3512	serum-vst-plugin-1.56.9.exe	133
PID 3512 wrote to memory of 2612	3512	serum-vst-plugin-1.56.9.exe	133
PID 3512 wrote to memory of 2612	3512	serum-vst-plugin-1.56.9.exe	133
PID 3512 wrote to memory of 2612	3512	serum-vst-plugin-1.56.9.exe	133
PID 3304 wrote to memory of 3708	3304	serum-vst-plugin-1.56.9.exe	136
PID 3304 wrote to memory of 3708	3304	serum-vst-plugin-1.56.9.exe	136
PID 3304 wrote to memory of 3708	3304	serum-vst-plugin-1.56.9.exe	136
PID 3304 wrote to memory of 3708	3304	serum-vst-plugin-1.56.9.exe	136
PID 3304 wrote to memory of 3708	3304	serum-vst-plugin-1.56.9.exe	136
PID 3304 wrote to memory of 3708	3304	serum-vst-plugin-1.56.9.exe	136
PID 3304 wrote to memory of 3708	3304	serum-vst-plugin-1.56.9.exe	136
PID 3304 wrote to memory of 3708	3304	serum-vst-plugin-1.56.9.exe	136
PID 2612 wrote to memory of 1212	2612	ServiceModelReg.exe	137
PID 2612 wrote to memory of 1212	2612	ServiceModelReg.exe	137

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mylolandryeobl.github.io/.github/serum-vst-plugin
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x218,0x7ffd7390c188,0x7ffd7390c194,0x7ffd7390c1a0
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,10198938544142074901,15572625776730586991,262144 --field-trial-handle=2256,i,4808299575742013733,7313239481877443133,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,10972211681642261694,5626672147841969079,524288 --field-trial-handle=2256,i,4808299575742013733,7313239481877443133,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2636,i,17486487618276824670,14785397338602333445,524288 --field-trial-handle=2256,i,4808299575742013733,7313239481877443133,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,4266047248697573043,11364836007698039291,2097152 --field-trial-handle=2256,i,4808299575742013733,7313239481877443133,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,14855810597780539216,2791249474071335833,2097152 --field-trial-handle=2256,i,4808299575742013733,7313239481877443133,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,4977096015501171526,6284117790737124354,2097152 --field-trial-handle=2256,i,4808299575742013733,7313239481877443133,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,6647353826007545162,17710171090986403566,2097152 --field-trial-handle=2256,i,4808299575742013733,7313239481877443133,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:2
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5148,i,2504280247326352744,16428428007573497637,2097152 --field-trial-handle=2256,i,4808299575742013733,7313239481877443133,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,117203491621126376,231767398546470215,524288 --field-trial-handle=2256,i,4808299575742013733,7313239481877443133,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,11555804125813276162,9913701817590150877,524288 --field-trial-handle=2256,i,4808299575742013733,7313239481877443133,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,17425805607411243895,15093972190170870953,524288 --field-trial-handle=2256,i,4808299575742013733,7313239481877443133,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,17425805607411243895,15093972190170870953,524288 --field-trial-handle=2256,i,4808299575742013733,7313239481877443133,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6264,i,2554855357792476193,5616644664015887675,2097152 --field-trial-handle=2256,i,4808299575742013733,7313239481877443133,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6408,i,10996591995340950418,8174156378523493268,2097152 --field-trial-handle=2256,i,4808299575742013733,7313239481877443133,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4128,i,3085001594197189502,4148424327197976137,524288 --field-trial-handle=2256,i,4808299575742013733,7313239481877443133,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4416,i,4972054235456952071,13846851832980726500,2097152 --field-trial-handle=2256,i,4808299575742013733,7313239481877443133,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,13374434393329043653,386030390277429371,524288 --field-trial-handle=2256,i,4808299575742013733,7313239481877443133,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,720101356869478906,7832290741421946134,524288 --field-trial-handle=2256,i,4808299575742013733,7313239481877443133,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4136,i,2329578247283811753,657419946316544302,524288 --field-trial-handle=2256,i,4808299575742013733,7313239481877443133,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,16381929242485848727,7581322038354530558,524288 --field-trial-handle=2256,i,4808299575742013733,7313239481877443133,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,11633003789240239909,11973182825870109576,524288 --field-trial-handle=2256,i,4808299575742013733,7313239481877443133,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,10759875622764538452,9791963069049738711,524288 --field-trial-handle=2256,i,4808299575742013733,7313239481877443133,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:4204

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3760

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2768

C:\Users\Admin\Downloads\serum-vst-plugin-1.56.9\serum-vst-plugin-1.56.9.exe
"C:\Users\Admin\Downloads\serum-vst-plugin-1.56.9\serum-vst-plugin-1.56.9.exe" C:\Users\Admin\Downloads\serum-vst-plugin-1.56.9\gitconfig.com.txt
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:1212
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:2116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4360

C:\Users\Admin\Downloads\serum-vst-plugin-1.56.9\serum-vst-plugin-1.56.9.exe
"C:\Users\Admin\Downloads\serum-vst-plugin-1.56.9\serum-vst-plugin-1.56.9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
  2⤵
  - Checks processor information in registry
  PID:3708
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:2684
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:3812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4460

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4980

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2524

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4688

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2352

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3432

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3284

C:\Users\Admin\Downloads\serum-vst-plugin-1.56.9\serum-vst-plugin-1.56.9.exe
"C:\Users\Admin\Downloads\serum-vst-plugin-1.56.9\serum-vst-plugin-1.56.9.exe"
1⤵
- Suspicious use of SetThreadContext
PID:3612
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
  2⤵
  - Checks processor information in registry
  PID:756
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:2844
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4252

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:468

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4480

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4104

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2312

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4688

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3320

C:\Users\Admin\Downloads\serum-vst-plugin-1.56.9\serum-vst-plugin-1.56.9.exe
"C:\Users\Admin\Downloads\serum-vst-plugin-1.56.9\serum-vst-plugin-1.56.9.exe" C:\Users\Admin\Downloads\serum-vst-plugin-1.56.9\Inn_License.txt
1⤵
- Suspicious use of SetThreadContext
PID:1976
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
  2⤵
  - Checks processor information in registry
  PID:2792
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:2108
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:4384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4420

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2764

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2072

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:648

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4380

C:\Users\Admin\Downloads\serum-vst-plugin-1.56.9\serum-vst-plugin-1.56.9.exe
"C:\Users\Admin\Downloads\serum-vst-plugin-1.56.9\serum-vst-plugin-1.56.9.exe"
1⤵
- Suspicious use of SetThreadContext
PID:4496
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
  2⤵
  - Checks processor information in registry
  PID:3940
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:4876
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:1092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:2912

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1940

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2468

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1552

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 32bf1b617bd8d18265f0d11cf99eec090aa2694dbb53c3da5caf49d2f1e33cb2
MD5 10e5b35470c7a39fbd7d3b627e249421
SHA1 3059194c0ee599421700132692b90a8fd9219970
SHA512 1ae07043bc2b853568d51be6c373c00a136adf68a7e741bb325b984c6c6075d2f1bbc6a6031e2e16eda1becea6ca3d9a362c33691d4afce8a5cdd67bc1ce70a1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7E:fwUQC5VwBIiElEd2K57P7E
TLSH
T18BB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7106bd8464410ed07a1528468db73f01d2e8d96acaf761311fa2a07f1b8f36a8
MD5 3249757ef79c753e9db3333e5b59eab1
SHA1 80c3f8a9097c516ee1b2589aef26259f8e88b6e3
SHA512 44f1587a26f978713c011eb961be65a6580edeca11415742ed7080cf681d94af0e8d7540db897a1573815c24ed394706791fc9a50ae4906ed9aa3c25357c402e
TLSH
T15BD0A77071463425F31A11719412E374A759441375779241E0114D0E6B3942456DA2D6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9e54688716dd79b41e498ce1417dab446e9e6e7b7718bb9dbf08dd150823233e
MD5 f9a3b355e615d704432e97ba12256755
SHA1 4e9fe66ebfb284e1039625e30f2f7124a2901311
SHA512 ce08bbcfa5f3463e9cae63a418eec137bd0d6d9c6487288165313616aa4f057e9706955d77c0f013e9c676e8d5d547a6f80b3af1b62e4f4666d1b95bdc4ea591
TLSH
T153614D9D02FA01D0F360D73DE2F1964534B584AA1BA77EA931600BBEAD02B23462FC1C
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1f1712f6eba52501b64d9962a7088866566fab511e394c1847c93fc470f448e
MD5 e485fbc16d1e1fc07afbdd88c308b136
SHA1 6664cf4d755b2d332c91cd52a43de472d8ddc93f
SHA512 b6788345687339bea5d52d0cd40a22949f14097e1fb88b0358cd22393fd8f6ccfc4ff9382520c53469cfd622a4aa15638275b56b151411514601a2209eed8ba2
SSDEEP 3:MsEllllkEthXllkl2zE/lq5/:/M/xT02z95/
TLSH
T1004404047FC00407C5001170C155C3515371F55407535FC335510C335CCD7404C04004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 521a1769c58d77f0978fbcffc06238529d40b86ad4074273be5eb7bf0f6db838
MD5 e62594f40773ae0a0c4db0f1cd4b2d5f
SHA1 bd47e5c81643145803e05455e3d4a9388c933b5c
SHA512 78845f9c6072e7ea6f67793bf43fedbe06cfc1c4cd4bf8e09eaa23d3407b21c2966c40a816e34399ab146c1a15fa0ee5726d93224cf25efd37ada80d32a1599d
SSDEEP 96:g6mmt9GLIU+bGz83uy3+u4tgp4DLjGQLBze9z3gajBHMsDEuspU0wbtqrOQpPfRb:g6mOWf+G83uy3Ct7XBBKEuH7DXspU3if
TLSH
T1E414645F5B642325CD7C41B578E744E29D7EF03FCB6366CA683104A0CEE2692902D8AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 19B
SHA256 ab5c71347d95f319781df230012713c7819ac0d69373e8c9a7302cae3f9a04b7
MD5 0407b455f23e3655661ba46a574cfca4
SHA1 855cb7cc8eac30458b4207614d046cb09ee3a591
SHA512 3020f7c87dc5201589fa43e03b1591ed8beb64523b37eb3736557f3ab7d654980fb42284115a69d91de44204cefab751b60466c0ef677608467de43d41bfb939
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 cbd74e50950cdd7c876dda87ea373fe26572ccd940385e1794133de722fb4631
MD5 ca9c703a6e62c60994c0cd33c9cc8577
SHA1 c518619a96e5620be9ab2778cb65fbe35b041e4c
SHA512 18578a9450ac8a1286f63b2e5f6a6b7d2c7571fd4599810555318f17bb1c018597b6c53b566a93cab8eba89c36606a87cb238560bcbd6006cbae1e9ffa8a7c40
TLSH
T105E0D86459EDC35A9B44A187D3346709C7B03407F6C9FE061F08AD40B526E04EB921D5
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 6101144fedd6f017013497b9879521f35a8426760526c256cecafd36835a2daf
MD5 6b7d2aeb277c49cb30d1617063527392
SHA1 4f9684ec35f4f27c1d3ee7f0a41530a17965c7dd
SHA512 22ded51ecfc46b9208be190881fa6ff8765fcb3b21fdef31ae915dbbc2fd99a6148cbb577719c23c2a6a49564aa239bf14eda14d1d071744fcd6f2b9bcefe2e2
SSDEEP 48:TtLopFMatSaw/auUOt8BMo4wAYmFRoAwH:9eMatUaAKePpwAA
TLSH
T14E922E4E1F346211D0F48BB3DCD485672F7C211D93633A9D9E5020F38D929ABF5450A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7cc975e4989f9fc8daaf21c4ca4162a89c70a5c1aa75f492d1a8ca7abf6e2e4b
MD5 2ad60ebf8195d11561100b4983087063
SHA1 ba61c9d8fb3209359c54da4e70237e6b49154530
SHA512 8422dc3f909cf370c87f032939d8cc87367d4ed0cc66df44171eb34b534d5a243bf29807146eff24ddb94545abd724e0867938893186f130bc0980e49cdaf352
TLSH
T1A351D0F7C3E5866DC91116F0AA146F2BCE2D0A1442283C1AC9D8EF57A7E3471F14159F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c4f7b8e0e1d516f5bbbfb4e89dcde68cd2847c7f5f98b17810b5cf528b16da52
MD5 a9158f79d175153bf77ed54be21370cb
SHA1 86a6beec2b54847b9a33e41f6a0d5019ffc6c08c
SHA512 223907b5edb7303248d727c5229d5fb5280c6ee3562a43bee6d1c24a33f689f008110a4c8ff2d63c1b3df8851a548dbdf76178c227a1170f2c0086df045440a6
TLSH
T14C51D0F7C3E5866DC91116F0AA146F2BCE2D0A1442283C1AC9D8EF57A7E3471F14159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a650dec6740ba2ebbe1906eff8689b618225f6cfc69a25658252d7778e504d05
MD5 b502b3d90fb3fef789d27ad34c55319e
SHA1 2dfcfdcfeb258a5140aed4a76a45fed429ee0a89
SHA512 6c8a8d931cf4dfa951b6086a67b6461e5f317afbed1f1ca890c6d4c5b8c2a48e92a619f88fdecf315016beae20d404c1fd2d36c4db67a0145fa293680e8dbde6
SSDEEP 192:sxZOjaROyM/jK1Ml8Mkf/fgsdRVIdpYlblfLHW6+WNM77kfk/YHSMIfIgrJ:sxZOja4Mf/fgsdRm0HbU//P9
TLSH
T11752E7466634A977CCDBD21AF981BF53D7F5146292940E44AEFC8A1C01E6BED6203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 8f0c676641192a988c96fdc465e0bf2daae62e99a23e2416a49991e563ad680b
MD5 1b61dc0b3cf7bcdf09d10efa82691658
SHA1 b5c1755f99ded153dd52bb1e72b858413f04c5f0
SHA512 f360e0b7fe9781a6e072353e5d6e1206e1ddb38af3dfe40107a958671a438b04286c736c4922f5faa369f7be683cdf1b6553c7e950e47909ea666dd9cb5b4143
SSDEEP 192:sxZOjaROyM/jK1Ml8g9f/fgsGWpVo3HlIdpSlblfLHW6+WNM77zAfkv+mk/Ynh35:sxZOja4Df/fgsGWvoXW6HbUXE/dc
TLSH
T15B62D656A634697BCCDBD21EF981BF53D7F5146291900E44AEFC8A1C01E6BED6203C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8fb96df9ba3159468646332fbe382d9106383d023f83610e019f33c3063f5270
MD5 4fd7e0e17821cf5e315aa998bc2d62cc
SHA1 c5aed559a681e3a9484af5fc003e63d0ffd8d73a
SHA512 c1c123f66433bab06954e4ca175a5245eb271cdd382648896de6bfe4acf77667b11273bcbb32a675fcfedd12d2a247961e8d6cc79f52cedc34145dffae7b7400
SSDEEP 192:sxZOjaROyM/jK1Ml8M9f/fgssRVIdpYlblfLHW6+WNM77kfk/YHSMIfIg5GJ:sxZOja41f/fgssRm0HbU//PU
TLSH
T12852E746AA346977CCCBD21AF981BF53D7F5146292940E44AEFC8A1C01E6BED6203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 761db62ac644f7720a40a86e990a5c1137dd8668e74a0c92cb4a54ac1904346b
MD5 f54d513c11d231cabade4b54d52c2f1b
SHA1 e194784cf488469f3095f00316be15c3dacde1c7
SHA512 77cbf221f1e05968bd549fc660563470cf731077653167212688a4fc87ce52fe0f546f3a99f6d98f9400b52565f4ef8248de0d0cccf66f89bd1a4935d11f9e87
SSDEEP 768:FQUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RZroVn0S:FQUZYTMWvg0Pou1ja7eLZmRSWS
TLSH
T101D20A2F680CCB7E4F844E9DEC266F963ED801CB5A584D544BEA884C03CB6EF512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f0d640b64e984eb702e05b0475872598865a779800b123588343432dbce47023
MD5 98e85238b8ca925cf5e06b2d29c612bc
SHA1 120ac20485a65cc2cc31d1044d4c54d28661aaa2
SHA512 999f21efa8c3913b5e62e9c700ee8ebbc7a56d7640e6142bbe55afe7616119a4812ecf63ab145f191b284db102f9d96e3f8437d3151d6395fa49cfe17630e924
SSDEEP 48:KA1ItK2AITINKUUobyVDIVKUswo6IPKjN:KA1eK2AITaKUUOmD6KUsb68KjN
TLSH
T10591446232BA12053C3E6A1C92D4C75FAE4176637014A82B7FAC41B18E67E218DFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 4548b4b6c452c2774437ebf708c996ea083f6287ce36199f9b4eb0692aaee5f8
MD5 4d31538511be8870e528680e99d8b7ef
SHA1 05eda3f78975bb2d1d8b85ea8474d7f9cc4017e9
SHA512 14806dddab8b81b7127f47195dced1bd6a823adcfd78566c1f3f97bdf8d2fe27b62a78b928cb20ad4b202500ead3ffa44bbb7f0140369aa5a538ed034183d743
SSDEEP 192:P+xW9VfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxQfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T17424640A7B747001EDE6D9725CB080771A3CB1ADCF22A6915DB254698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

534ef12e-4644-4706-aa9a-8c03045a5c39.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\534ef12e-4644-4706-aa9a-8c03045a5c39.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 a9922229d7cff8a718d007d45f7f2183dbcbfb8d3c34c0bfd3fa45eb2ec9a1f7
MD5 6a17b3dd19d7e1d75055bdc9fb7dfc24
SHA1 7ab49bb8e18f7138f8de914d6400642e78b43ebb
SHA512 61d0dc8c9ef066c552b30236cb8316d4a3bcada8ab2732df5b711c438abbef0db8bdac1750abb14b3b21045b5255b1684fb2ab2c2b45dc354276a23ce99dad86
SSDEEP 384:I3yFaeO8WsNn3EzfYAtnnzX5od+t8s1MAXW+9yEIeS8G:I3IzhWpwsbOsPW+91pg
TLSH
T1F0926CB2A834BC3B9DA6F056F4573653AFF4406FDAC92F9085ED1F1C02C9199131AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 c8956b3093b62b28ba9c1776c36c9a743cc68f7f38493d918e7c299ad6070287
MD5 6b6c33c22095addb732d0052bc81afd8
SHA1 8a288de9e22d007086f5ff487d08c79751e19ddc
SHA512 fbbf0fd8c27afb26cb8cbdd7fab1882facdfef6186b978a42daef2da5423ff43bc4559a4197ebea650269be7fc6220763c7f458e4b705f40672d753acbdd17c8
SSDEEP 768:fF43Izh6mwgxw2bOsPXstSxO9aDfa91pg:G3IUJApDS6
TLSH
T154F29FF184D35DB6C5ADABC7A73DAD025ABCC07BB4855918B3E4692DEC4A0BFD301811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 9f786b6ac035d9cda7d4ceea282e903cfcfde314d242edb3a97147698f287e0d
MD5 2ee09b5cf57d9d3c51e13745ad1fddde
SHA1 871b651796b850e1f2d72896492984b79539a71c
SHA512 8639ba2a5ed4098c048ca585130134dd4068b0ee9c1637495dfb5d574729aaf9a451a3bdd3015b5d0b0b89304221b1a3c5e369873257c1df4a0dff608584a6eb
SSDEEP 384:EiFZ3yFaeO8SzsN58TUNTUlIluEzfYAtBnzX5od+t8s1MAXK+9yEIeS8G:fFZ3Izh6IwgxwKbOsPK+91pg
TLSH
T145C23BF244D3983AD9AEA743A77D2D129EBCC06BF5856A50B3D8191CCD851BFD306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e0a8ca50210427074ca68032d9baccb54863fc97168739eb5fb4937e0ff720ea
MD5 1db2e0ce375752fb5703d58ab13ecdd8
SHA1 47e5738aed4599f0b84b7c3bb83f65fc192afc85
SHA512 c0e5184231ce5705a805d6045d47978e7215de868b12b7fc70fbc1fc52e667b78c93bd5a26743c1fcb8ad0887ef2ed7f21773ce0e4f166171699a0702cfb377b
SSDEEP 192:yONx61VWQmiUy0tgGX5Obd+jFjzors1yRjL/ah3YtU6:yONx6WvgGX5od+t8s1MuqtU6
TLSH
T15702C835A9687C7B8EE2BE49B48737135FE4206BEA556F84C6EC1F1C009765C2306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 d397d1416882d7594819fc1911d493bc01ca23e21aa1860aee27ba6279ed4ad5
MD5 2c4093ad6b774df412cdf8e33a3eadef
SHA1 8b96282f300f2ba85f5b1b7a540c0c4f2a6fdeb8
SHA512 90acf1ba19211373085713f92ce6d573cbb60ea03aa0cdd0df069daef387fbdfa2caaf8a71df60a396b292cf1da39d9df3f31ccf7728f2ff1caef1c0447e51c9
SSDEEP 384:43yFaeO8WsNnuEzfYAtnnzX5od+t8s1MAXW+9yEIeS8G:43IzhWawsbOsPW+91pg
TLSH
T11E926CB2A434BC2B9DA6F056F4563653AFF4406FDAC92F9086ED1F1C02C9299531AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fb9b14f4feef95de69edeb213443ce53828680584d348a9cdc23945553e0c5d4
MD5 e7619d69f99b11755473573d96ea5e70
SHA1 2e6a60c13576de07a3b891fe94a5362bc580e565
SHA512 69e3de3dd9eba435b12f5e3e99c1ca55a01081eacd029ddf8c424110e8e3039975983dd46197baf3d478afe30f262c1c4565290f4008dde08768dffa9f841b6c
SSDEEP 192:bONi61tWQmiUyrtVGX5Obd+jFjzors1yRjAX6kl1jJpqPU6:bONi6eoVGX5od+t8s1MAXn+U6
TLSH
T1B8120932A468BC6B5DE2B555B48B32135FE95167EB897F80D6EC1B1C00DF69C130AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 d99772bd6be1a841bbef6ce8c754db8a06de7158db5bb660f0273f9a2d8a9d6c
MD5 02d700a893e8de6cf5b1ce37cba12dbf
SHA1 5e2982646a20bf36aca923f677ec0ed54f30e9ed
SHA512 6b867cb57a21328af37af9ea240a9dca35aa6ee52d179f522d4881854f5cfd00c759a07ee98448fee49a4604c222e4424d224f5de0d08217709c0707a730ba6e
SSDEEP 768:fF43Izh6mwgxwRbOsPXstSxO9aDfa91pg:G3IUKApDS6
TLSH
T1A3F28EF184D35DBAC5ADABC7A73DAD025ABCC07BB4855918B3E4692DEC4A0BFD301811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d0b5e852df462a7fe1dfe63fa78156e5f11d82e584cb8125560b323e90186bb6
MD5 29184cef4ae323510322cd6f7a12977b
SHA1 f937e8cdb1dc4ee9b04edd4e7a70b621072dc0ed
SHA512 35fceb49eb59a697c9683b1b8318cd2804aaa76fde716f177ff371050a95af5b456f0aa2eed397f1a7846f6896d17834a598558d2022e02c7d1337de43c91558
TLSH
T168413A58B6E91148B3B37F5AABF7A86E48BEB9772E06D05D00110E4F0627F40C9A1737
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\CA_96.44.154.224_2026-08-12 22_36_02_b9e6d1be-5eff-4596-940c-57922ad6c7c4\decrypt_browser\Admin\Google Chrome\Default\Login Data
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserInformation.txt

Path C:\Users\Admin\AppData\Local\Temp\CA_96.44.154.224_2026-08-12 22_36_03_b9e6d1be-5eff-4596-940c-57922ad6c7c4\UserInformation.txt
Size 615B
SHA256 4dfaa830474863e0595b7736501afa8f58f147fb7eab562cfcedbd903edc6278
MD5 7c071486381abf9db323a27bda1530a8
SHA1 d315538935ef435a73734b1f398b7b5e2ebe6929
SHA512 30f9b32738f3ac5c7ab79e0dbf05710e0222dd52890adafa2db6476bd5fef71119b26f7fe5f320259bea956dfb1214f6a91dcaba1e92e560a4768291b1e3f2d4
TLSH
T12AF00225DF4829087F6FDAA03254E807D5D180F2518E803852CF8EE46AE78186FBD044
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\CA_96.44.154.224_2026-08-12 22_36_03_b9e6d1be-5eff-4596-940c-57922ad6c7c4\decrypt_browser\Admin\Extensions\Google Chrome\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\CA_96.44.154.224_2026-08-12 22_36_03_b9e6d1be-5eff-4596-940c-57922ad6c7c4\decrypt_browser\Admin\Extensions\Google Chrome\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

MountApprove.xlsx

Path C:\Users\Admin\AppData\Local\Temp\CA_96.44.154.224_2026-08-12 22_36_06_b9e6d1be-5eff-4596-940c-57922ad6c7c4\Filegraber\Admin\Desktop\MountApprove.xlsx
Size 12KB
SHA256 50e519a4963fe3dd4cdfff6145da4b8a21fb473aed064e83c215bb9e3070c48f
MD5 c7afa56c7092b9d1d1f005136fe5beb5
SHA1 4b59baaca4b8c05861f682d8d17e9486a2ba65a5
SHA512 654abe68fdad4ec070f406f6fd4aca39f7b02c6fd469f1930984511ec9a3468ce8d01d5150bea76577bd829d15718e39afae63ce8c6bf70ff1a83db389c1954d
SSDEEP 192:wc8mVVb3UuBtASHj5iaFUlbVvevUqzQXpS0mB/XJ/NfMTF78aoHd:wc3H3VBCiUlM9z6p+P1YGao9
TLSH
T158428C9C9CA0681EC36BC87ED05E00D5F55C2482CB87A4993558F8EF26D12B7429F29F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompareConvertTo.xlsx

Path C:\Users\Admin\AppData\Local\Temp\CA_96.44.154.224_2026-08-12 22_36_06_b9e6d1be-5eff-4596-940c-57922ad6c7c4\Filegraber\Admin\Documents\CompareConvertTo.xlsx
Size 962KB
SHA256 f27fac35503e437410955b27f30dae2e3b1c05c39dc0c2fe37614d3bed78fd63
MD5 3fa0798c1731e4f6df1dbd024afe08e7
SHA1 f3db633cb2735af3e171d2f912a0f5118421e299
SHA512 830c0fc77dc85ccf255697fd2348db4b4d69300a7d6984c1975b8d1a127a3966a601fd3e6aae2114c578c5a9613c9c478ed57bf527c5941560fcdee174cf7879
SSDEEP 24576:Y4Vrq/CDcNkkhj4EuAsVY80ewvf/zQH9ZLfwqoFGp:ZOGolorV+Vvf/kory
TLSH
T1FC253389B1056E42261D4600CF796A6032E96F7C04B31EC14A5EE67FCDBE2127E6D8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EditRead.xlsx

Path C:\Users\Admin\AppData\Local\Temp\CA_96.44.154.224_2026-08-12 22_36_06_b9e6d1be-5eff-4596-940c-57922ad6c7c4\Filegraber\Admin\Documents\EditRead.xlsx
Size 9KB
SHA256 d003b8264693ddfb5c382743988741317789b89f5d3a11e03b4a5f334185aa05
MD5 b6e5f9751beda28a96a39b15d54980be
SHA1 154883a18c5d89b25b0c37c2ddb71c6e5bb7cfc3
SHA512 ed5cf8bba6302663e64b9c217b235b06af32304c5f696c2fed08e44828e760e4ce9c190a39a86857165aa5c665ef7fdb1fe8128225be0592acbf8704e9103ab8
SSDEEP 192:wc8mVvXr+eMb3U5DYWxyapRJaFUlbVvevUqzQXpS0uS35zaox6:wc3V7S3aDYayi8UlM9z6p2S35aox6
TLSH
T16E126E15E5665839C3379DBD824E80E5A64CB0906B55798AF860E35F17422A3038F2FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PingShow.docx

Path C:\Users\Admin\AppData\Local\Temp\CA_96.44.154.224_2026-08-12 22_36_06_b9e6d1be-5eff-4596-940c-57922ad6c7c4\Filegraber\Admin\Documents\PingShow.docx
Size 13KB
SHA256 dc9f09af9b3711d9ba269294a718e06da096eb6b1e699ea9b3544ecd69c1855b
MD5 7c0bd3fef4be267a0e692e3424c9b8d4
SHA1 75dd48999590f28a789133ab1bff44a3ade908e9
SHA512 ee399157012fa1e5adf40150b18222a79b265dda4508d0d863f8e4faadd8938ec3d2361bdb474fe37067c54951f51f4cb322cc8a8e5aee91ff66f8b622152a1e
SSDEEP 192:CtYqy7g1Q+lVcDXsRanVHCCNxtpgoZ22NN6mLNkeTWNGFHBE0QhaVKPc:ady7XsRYdNxt/ZtNN6jIFH3QhaVKPc
TLSH
T1F752C038D656B420E9138B3CA06A61F6F14C1052794BB19B30DFE7CE8393B56279B9C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RenameSet.txt

Path C:\Users\Admin\AppData\Local\Temp\CA_96.44.154.224_2026-08-12 22_36_06_b9e6d1be-5eff-4596-940c-57922ad6c7c4\Filegraber\Admin\Documents\RenameSet.txt
Size 1.0MB
SHA256 237261cc2816367b8820d76927abc5d9d12d788d7b4d203599388bee99d02733
MD5 cf18d1ecf7567c03d68501c77270f5d3
SHA1 f129df6b2a8d197d50cc8f9fa8799c9ee9ce6723
SHA512 ee6b5bb50d399f77d28b064aa44e86de79dee31f55fd29e7060aa8cb93c67d01a18c3d09473c7d81c567421dc49c2272cd3cd0c9ccacdb2040ba10cf1a86562f
SSDEEP 24576:ztX+inle+J4qQNsANHtg67KXlRo5AbJEelVUA0Fd1TlGmw0IM:ztXjNW5NXB+60o5AbzroGZ0N
TLSH
T1A32533CE6865C4EEB9B9DA48BCB0EDFF0FF10079992D4F185FB907690C46B195C0A846
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResizeReset.xlsx

Path C:\Users\Admin\AppData\Local\Temp\CA_96.44.154.224_2026-08-12 22_36_06_b9e6d1be-5eff-4596-940c-57922ad6c7c4\Filegraber\Admin\Documents\ResizeReset.xlsx
Size 12KB
SHA256 8d05d664a5a03cad957f18b9ea44cc11c9fd9757b068c041cf4d648d89c59098
MD5 a07f7345cfdd978f08ec71ab7789cbba
SHA1 73e1c5bb4d492da08913be8712630181b9b9a15a
SHA512 45894b1c437f65620e5192fddd2f04e64dd59ba97f4059f9540370732b0f5b7c1c510d822f63796c1df79c443eafefdfbbfb7d7c21e4532bce20a31282656b23
SSDEEP 192:wc8mVYjNcUiC7b3UlTes2/WJMugmraFUlbVvevUqzQXpS09oEI5ZzgR2H3asRaoQ:wc3GjH3ahJJkUlM9z6pVeasRaoQ
TLSH
T14A429F85C0208DABC26310FA507764D6FB4E50C29B1274497A68F5FB678129772DE3CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RestoreApprove.docx

Path C:\Users\Admin\AppData\Local\Temp\CA_96.44.154.224_2026-08-12 22_36_06_b9e6d1be-5eff-4596-940c-57922ad6c7c4\Filegraber\Admin\Documents\RestoreApprove.docx
Size 17KB
SHA256 a867e91c96d7df73a2c31d1963663a5e0a2e29acbadd79bdaad46f8d9105a643
MD5 18134a810194fdab7ff212ce736f0ceb
SHA1 abb226ddcf6e366fd63afa6cb1df9f00f5d3e4c9
SHA512 490a50553ed84e9d0231597d9a6cbf7b5b1a5c919fdf67200cb870ebeb71acb3cff821460011f3d8b59307cf2bc930f37690f39a6a3b32f10fb5f48809fb8052
SSDEEP 384:aQfdrr7gbjfVhHrG0iB9gR2iHhn2dNxt/ZtNNqIFH3AGjGXL:3n7UjuDgR2iHZyxllNqItjQ
TLSH
T1C882C034CA867821E5B3CD3C901E17F0E12E9113B642AC9630EDB7CEB26FA91234F549
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnprotectClear.txt

Path C:\Users\Admin\AppData\Local\Temp\CA_96.44.154.224_2026-08-12 22_36_06_b9e6d1be-5eff-4596-940c-57922ad6c7c4\Filegraber\Admin\Documents\UnprotectClear.txt
Size 1005KB
SHA256 cf270e67fc9eadb2f1a4c6fdebc40eb3eeab0a3515f9afc8d1a4ec07e3641af9
MD5 b71fb7d1c1fec5249977b7bccab8e75d
SHA1 5a1bbe8d76a0f6b3ab4df0529b1d73b50206da6c
SHA512 378a9f83b6020230ec5aec26acfd9a921b484cca3c61e6fb58763a9c9f8c586aa9a30a69fcbe1c62cfe3784c46d7c75e31c9c193b73503bcf12c4cd530680dfa
SSDEEP 24576:invSNvQPl7tfw0zrTTVzwNNuEjsox7QoYB9H9h5lb:in6N4Pnw0zHRGzsIsB9hvb
TLSH
T1D625338156DC9904968C36BC3EB72D871EA8D6077DF52347FC80222E639D26D907DB2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RecoveryStore.{6FBDA017-4F32-11F1-AF66-56FD763ABF24}.dat

Path C:\Users\Admin\AppData\Local\Temp\CA_96.44.154.224_2026-08-12 22_36_06_b9e6d1be-5eff-4596-940c-57922ad6c7c4\Filegraber\Admin\Lists\RecoveryStore.{6FBDA017-4F32-11F1-AF66-56FD763ABF24}.dat
Size 4KB
SHA256 c4bcd974cd86ded8bebaf37558ec1b62058a5519cadac11476f4866b0e786a10
MD5 a6190b97b771891926e35092c62e0be7
SHA1 dd025fdc6e73f8e04c237a280d2611b88c3a9f1d
SHA512 54cca20b9409451a6ac0b8cb15551c5161a24ed490227d92b8d8c6f1da1fbfa4b603a7007ce6e4a4641126eb5d93e742754c2642798f09252092cbd972276a47
SSDEEP 12:rlfFA5crEgm8Gj76FA5ADrEgmf+IaCyoqw9lTqa6nAyKC9lTqa6nAy1AQQ:rwcG8EUGv/99lWsC9lWE
TLSH
T10891F261F294D502E2558F77CCE2C6853B37FD61AF01E34775A1330F1A72782D942822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WaitBackup.jpeg

Path C:\Users\Admin\AppData\Local\Temp\CA_96.44.154.224_2026-08-12 22_36_06_b9e6d1be-5eff-4596-940c-57922ad6c7c4\Filegraber\Admin\Lists\WaitBackup.jpeg
Size 236KB
SHA256 4e4bbbc5ebe7702d8556ef7ff606556bacca74b85e3666e1bb46b91d95d2f884
MD5 6cb57d9b06c6746aa4fafc6edc058a15
SHA1 9bccf96c561277d880e4cf8bf30043e024bf54a5
SHA512 12d7dd1a588f993f67b3c08b90341c93ea7c4004bf107b0c76e5ffb6d037f0ab74ac92b5970f6ecdd6cc9bde0e2881d78f997b178b5a47f0fbe817e0cd8906ef
SSDEEP 6144:K0VLK0JSE4AtX/Kmr1JElh5OrItaas8Ah9w1YrT:TL9yAl/Km2KIUlBh8YP
TLSH
T17E34125C630B63E1A814EE1DB102EB20F01FC5AADBACBFA243A59DF0660C5476D3B05D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_file_paths.txt

Path C:\Users\Admin\AppData\Local\Temp\CA_96.44.154.224_2026-08-12 22_36_06_b9e6d1be-5eff-4596-940c-57922ad6c7c4\Filegraber\Admin\Lists\_file_paths.txt
Size 264B
SHA256 9afa36b6aed628ac0703596c03e5c62d62f1e248659dd7df42965204d211672a
MD5 3b7ce0435de537e09ceae38224bee66b
SHA1 f493607e6642552d785c3f729753985f76c52360
SHA512 8aacc762a3c6cb7d36ea4300637eee1fe9a4066c8cc7ad7358207fcffe1ee015d19a149cd3da0310a6e0d033f89ef6f72ef677188f1b5db08caab645185ff91c
TLSH
T183D02B042486F73A818A6C231034F1CCB54B0E0EE591F325FB04158067CBE0D7143946
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\CA_96.44.154.224_2026-08-12 22_36_06_b9e6d1be-5eff-4596-940c-57922ad6c7c4\decrypt_browser\Admin\Extensions\Google Chrome\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\000003.log
Size 68B
SHA256 d96b3d82465808c49ce3c948745074d143504d00f44a9ff3b26a42f0c88e1f61
MD5 f67672c18281ad476bb09676baee42c4
SHA1 fb4e31c9a39545d822b2f18b0b87ca465e7768c9
SHA512 ff37752848af570cb284f5fb65837472ddf9941992fffceb049a70c36d858c37e4e87016176b4e62d0eda63c235ca742411947d50d163cbc7823c50a734f0898
TLSH
T10CA002A3BB121111D502D9B8701067969726C521024B55D1450901355AC9694351A199
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\CA_96.44.154.224_2026-08-12 22_36_06_b9e6d1be-5eff-4596-940c-57922ad6c7c4\decrypt_browser\Admin\Extensions\Google Chrome\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\LOG
Size 401B
SHA256 6a87646857258bc3d4b110de6f36cf7cf43f7912e2b01f8b132803c93ad2e641
MD5 3950f156e331236beab6c0fefc6013bd
SHA1 ec748cb040e8a9a764823e58dbb051b68cb64163
SHA512 d13e2b4be6ff7a59b25442e3a61190f24ebb0297f657d756ef460c103fb2528c1dddffcda16e1182e1f4f9e18021925399815341fd13f50763be5de379bce67b
TLSH
T1B0E0229D388EDA6E2489947AC3A4AB4FDFE0384EA3CD2956878EDA140096209D3C0659
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Temp\CA_96.44.154.224_2026-08-12 22_36_06_b9e6d1be-5eff-4596-940c-57922ad6c7c4\decrypt_browser\Admin\Extensions\Google Chrome\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\LOG.old
Size 363B
SHA256 a11edee99e26b517389c73a2cc76e614bb70d6c898d71447014c8e33c0c746ca
MD5 a546fdee1725661b4b805a53f7500aef
SHA1 a259e9d5b43fcb13fd7e44922044f4a8f88ce282
SHA512 13cac56066182c93c9744e2ceac92edc70681879a9c652efb63a013e69e5f7950fb8229d384592e0284d8afc714cd337512e4938ba71f63942d69f5a989040c0
TLSH
T159E06849BCCB895E188890FAC7215B0FCFE0600DA2D53A578F8ACC2400A695C83C0656
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Local\Temp\CA_96.44.154.224_2026-08-12 22_36_06_b9e6d1be-5eff-4596-940c-57922ad6c7c4\decrypt_browser\Admin\Extensions\Mozilla Firefox\2d5mkwou.default-release\extensions.json
Size 14KB
SHA256 6df5659e4c23bc936c3250ca70d1d9ec9770789d38fd83f7182ac1af71d01311
MD5 a0cb6eee118aee20d46582597b3b50c1
SHA1 ae5f659fd736bf05aea8513cf4ec5f25ee75056e
SHA512 6103a9bb2f67200c1f66491c2549e572d9bd16a5730b83ac9ea8c61803f1f12bd1abf00de928b1032a72a7c7a27d6ae731d4adc6466b8581289cafa5e8c79c6d
SSDEEP 384:HkI4vYUmldvL8dhW894z/96ozL4HHL4P/L4HdL4HsL4HC:EI4gRfoXV4J684L474d4G4i
TLSH
T1AB62531545149EB8298F978BAA367E02C37D473B60845C78F4DD8FC842FA5B902FB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Local\Temp\CA_96.44.154.224_2026-08-12 22_36_06_b9e6d1be-5eff-4596-940c-57922ad6c7c4\decrypt_browser\Admin\Extensions\Mozilla Firefox\2d5mkwou.default-release\prefs.js
Size 6KB
SHA256 a3beec81de595a90d073f38bde225bd9f1f734e1f7b76c6d9f43618153f404ee
MD5 383f00c1e8774bcc245eef373322a583
SHA1 e5a5597a1f2c1492e7bc57cfe58a5a4faccf44f5
SHA512 95aa28e15d4e81f99c7b72b639244c4908ee4ea8bc65bf0eba06f6af1daeac02dcd26fdd9b57c67cbc9395e614a2f391d30467ea0a6d78a109e4cb307c642ae1
SSDEEP 96:xHrUTUmqGq6fzUL1zS7DSSlfdv9jHnpRHNWyS9JODBw88n8L4cnuFNj:1BR6fzUL6DSSH9NWBrODBw88Jr
TLSH
T151E11E789508CB6F74B676ACAC6488716AB2013BB7BF68D350B594C4051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Temp\CA_96.44.154.224_2026-08-12 22_36_06_b9e6d1be-5eff-4596-940c-57922ad6c7c4\decrypt_browser\Admin\Google Chrome\Default\History
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\CA_96.44.154.224_2026-08-12 22_36_06_b9e6d1be-5eff-4596-940c-57922ad6c7c4\decrypt_browser\Admin\Google Chrome\Default\Local Storage\leveldb\LOG
Size 329B
SHA256 f860adef4dcd5097a32e1d54b19a4785bae493cac9d451021d89361f3fbc8581
MD5 8d308d1a257f44e6bdfcd429a349b4db
SHA1 bbc4033b41c9e551c639177a15e841828c5d2abe
SHA512 8ac66c0e81c1dba958540b5bc0b2bd609b9ddb2cf4cdb7233edadffdec116b59bd31b75211f09fefd8885978a15f59ab766f609a8a7135dc61fa01e2c49a2781
TLSH
T14FE020E0248DC59D554482674368770EDFF03909E6CD39010F45F55470C4008D3C1AC5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Temp\CA_96.44.154.224_2026-08-12 22_36_06_b9e6d1be-5eff-4596-940c-57922ad6c7c4\decrypt_browser\Admin\Google Chrome\Default\Local Storage\leveldb\LOG.old
Size 289B
SHA256 6b846db3fe3a0e1a7d1204055915db842d933ad293ef43ae7ad2367aaced3f3e
MD5 24d8c491c335c92525c09aa335378077
SHA1 8399054cf91fbee567a81fa50ab03437b79ff2e7
SHA512 5f0e5d128fa7e551f8a0eb6204bdf92e7d8729c5198c238e9a661230ce8348e27e4cbf45dfd0f66aa3bdd1711090cdb80ad050b98333a8b13dd412a1977cb49a
TLSH
T112D0CD2195CAC56F0654C4AA5331770DCFF4104DD7DD2B464FCBE408B0CA40CA6D53EA
MD5 SHA1 SHA512 TLSH

Submit Download

Network_Cookies

Path C:\Users\Admin\AppData\Local\Temp\CA_96.44.154.224_2026-08-12 22_36_06_b9e6d1be-5eff-4596-940c-57922ad6c7c4\decrypt_browser\Admin\Google Chrome\Default\Network_Cookies
Size 20KB
SHA256 14a0bc757774e23b0649234b862ff83cc92ca88d3bb2f998619e5c0a9176a0b5
MD5 5981b2cace9996f09dbb2072f8a118b4
SHA1 517dcb08f66c36303514ca204655b0d3937fad6e
SHA512 634800ac5d15e752c0dc60d1c4f03c503ccc5487401b2a73e8925e04037117cfd4f1e999ccfbdf5bcef008cc3d4f48ffec697f328b81b423bf58dff741511a1c
SSDEEP 24:TLyW91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBQNd5czQEdyhkX+UPJivJj:TeW9aw/aHLopFMavU1iBQNHjEMkQvh
TLSH
T1D992EF8E2F343620C4F48733EEC2056B2EBC211D9313AA99EE5054F28DD659BF9095A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\CA_96.44.154.224_2026-08-12 22_36_06_b9e6d1be-5eff-4596-940c-57922ad6c7c4\decrypt_browser\Admin\Google Chrome\Default\Preferences
Size 13KB
SHA256 5cbe141ca4542160b6ff7c175d0ad670c9f6edda5baa9478b6a3dd266f60425d
MD5 b92456091bc96f64f0112d13f8990b87
SHA1 0f3d7b4f47f6fa4cd5d7b8d48e59c131dda60585
SHA512 4c5a7e59753829bf58a01ec01f85d702446aa3c748f4b45cd56cda81de3805cab1a56db295a676c6b6677c5f436104851a38cfc49b1778417d1b1d92601b3134
SSDEEP 192:wR+M/3zBRv72ympAPRp2/95Hsb+WNn+l2pxkkJiQrneDIeylPyIsnAUge:wR+MlBQUXo7wU2vkk3Bte
TLSH
T1FB52D61EA924657B5CDBC21AF9227753EBF5107626D02E44EAFC8B2C09E75CC321742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Temp\CA_96.44.154.224_2026-08-12 22_36_06_b9e6d1be-5eff-4596-940c-57922ad6c7c4\decrypt_browser\Admin\Google Chrome\Default\Web Data
Size 138KB
SHA256 571d574ad4378fe909fed1f4c7ae210b180e511c727d91aa4b5dfc036c699ae8
MD5 dc4f4d463b1c67707f927b72c0f042ce
SHA1 382b802cf3ae4b520bd3430ff502e8feebd5c446
SHA512 c1ceda188b537c3d68113beb0945878279c0d262d493f90529e846cb939b2dd0c9d9a42436386864fb7e46f580dc709576bc578b069d257f7413bab940e65ed3
SSDEEP 192:9B+XuvBnl3JsueMEGvIW1/rcP2OhpX6QAdqEVumawkh:zeuvBnhJsueMEGvIW1DcP2OvUfVumanh
TLSH
T116D3874B3A743102EDE59A722CE051BB5E3CB17D8F55A5D4287620588EF2863A23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\CA_96.44.154.224_2026-08-12 22_36_06_b9e6d1be-5eff-4596-940c-57922ad6c7c4\decrypt_browser\Admin\Google Chrome\Local State
Size 115KB
SHA256 5f7a87bba1b1f7970c25218219c4d23b7fa06ed8b65c74bef896179cb381742a
MD5 9677e65124b8fa50df542f1e648a5c00
SHA1 f66035e5d2fa989d2b0b9c9650ca535f1c9e0be5
SHA512 91d929478025fdc7f652b63f034618e0b0ca527beba97106c3675be6764e9fe4e100a14a5afcd54b6d69233ab35759b8947598bcd797d22991d01df2b04446d3
SSDEEP 1536:UZwUQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICk:rqfd7NtZL8cHQRZEQ6SpsP
TLSH
T1D0C30237EBC21F339E92CB64B9530FD697B644A59034D301EA7D77AF6C8389164428AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Temp\CA_96.44.154.224_2026-08-12 22_36_06_b9e6d1be-5eff-4596-940c-57922ad6c7c4\decrypt_browser\Admin\Microsoft Edge\Default\Local Storage\leveldb\LOG.old
Size 331B
SHA256 59c9057531758cb7e6c38fb36f9441763fa556d162c2b26380ed5d3bc7a79c9b
MD5 e69574a6a33ab92b47600b253521f10d
SHA1 8c6dbf969a564df6c0655621855c81d5fc914c5c
SHA512 37b782ce79ba41d7caee05599b8e8b541e7690af3358ac51b02cd55f0bd1cf1691d6fecda3abe355e47ea905e18211b536117e8322f185d747b3d421a6186559
TLSH
T1B5E0D8B445DDC56FA6A4A1CB4358BB0CD7E0344BE6C82B451B4CD959B001044E3859C5
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\CA_96.44.154.224_2026-08-12 22_36_06_b9e6d1be-5eff-4596-940c-57922ad6c7c4\decrypt_browser\Admin\Microsoft Edge\Default\Login Data
Size 56KB
SHA256 a36a4989ed48954499586d6551e61d6bccfc7bee269b4eab0bb836e394c24c7c
MD5 f92de240ae86100670164298edba43f2
SHA1 5d9ede7e7743e75344ee7f996456693f82896e5d
SHA512 2e6b9cbd04baf609d91a0583d742b19c5dc6dd7b334349fac1a71563c140075408fe881388e1fff72f5c1c0124d0603d54d35f5039c544ee9c1350b4e1684c21
SSDEEP 96:/kS/KLPeymOoizhGNOnfmG38tmvJHbn8MouB6w9fUPnP:B4oizhGNOnDV77Iw9fK
TLSH
T15E43651F1B682802C8698632BCB194F36F7CA13E8F639E922CB044359D75852B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookies.sqlite

Path C:\Users\Admin\AppData\Local\Temp\CA_96.44.154.224_2026-08-12 22_36_06_b9e6d1be-5eff-4596-940c-57922ad6c7c4\decrypt_browser\Admin\Mozilla Firefox\2d5mkwou.default-release\cookies.sqlite
Size 96KB
SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
MD5 6066c07e98c96795ecd876aa92fe10f8
SHA1 f73cbd7b307c53aaae38677d6513b1baa729ac9f
SHA512 7d76207c1c6334aa98f79c325118adf03a5ba36b1e2412803fd3e654a9d3630c775f32a98855c46342eba00d4a8496a3ded3686e74beaac9c216beee37aa5cb7
SSDEEP 12:DQnD+23Fmdmc/OPVJXfPNn43etRRfYR5O8atLwxeYaNcDakMG/lO:DQnS232mNVpP965RayKN0MG/lO
TLSH
T192A3DD826B781395C44701B2FCB0565E0D3CA23849272B55AC39B0B30CD6A438A329FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

key4.db

Path C:\Users\Admin\AppData\Local\Temp\CA_96.44.154.224_2026-08-12 22_36_06_b9e6d1be-5eff-4596-940c-57922ad6c7c4\decrypt_browser\Admin\Mozilla Firefox\2d5mkwou.default-release\key4.db
Size 288KB
SHA256 dbb214ef12c779d014afeb8914e4958ab5f5c215ae7c41804525a8dcd60edad0
MD5 aa1a70a28ec9bf822e6714d52fb4e0ff
SHA1 41a1b38173af27663fc8989ed8e44e767e55ffb7
SHA512 2db797e3a6170ee94081fc360e280fd04fe9efb7b882266ddcac0aca40758cf9f78debe00bcbc579b4438d2f6d356cc637a0ebf449a84c4e9756e72c8c2dfee5
SSDEEP 192:fva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vadd9+Cax:f1zkVmvQhyn+Zoz67fd9Tax
TLSH
T14254AF02EDC4B10AD71E7430CA455EF33A01AB0853915E2BDBBC1E3E5E7164DBAAD5C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

places.sqlite

Path C:\Users\Admin\AppData\Local\Temp\CA_96.44.154.224_2026-08-12 22_36_06_b9e6d1be-5eff-4596-940c-57922ad6c7c4\decrypt_browser\Admin\Mozilla Firefox\2d5mkwou.default-release\places.sqlite
Size 5.0MB
SHA256 d7b31d834cba515ffef6f0e4e65e5043394c828462561bf6f0f90b8a289e644c
MD5 48a6d56c9b913786e536ed25f7a7be2e
SHA1 f258411e88ba9584b6db3c242ecce4a9bef41508
SHA512 b01ffb4fa304f7d6ff94e7dbf4fdf58113ab832856e0b220fdb40c417becfb54a734ab60e6f75fcecc659b5b640f0d1ddf1c425f6256e8fc069c0cd9e7f47c02
SSDEEP 96:D4k1e/wAaF8M9Te9kjQruHtZroSzPFRPRYoa5Af22iV7qIsFw2iwRI7c2xfXsZ8g:M8rJQaXoMXp0VW9FxWHg7snuQXT/Zm
TLSH
T1D836111F7A202150C4EAA232ADE35F19183F74169A3776933EA4256D4DD0723B92DCFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sends.log

Path C:\Users\Admin\AppData\Local\Temp\sends.log
Size 809B
SHA256 062a63bea09f197e2a2ca25b8e97cdd47d28e99bb4e9eec378e0cb494f6c580c
MD5 32d486288e30c502e25c8a7af2c4e662
SHA1 b73860fda0a9afe6ff0e0b30ff4f744d25fba0bf
SHA512 123a6d768781c99b56faefc3d99b60d5b33f4d7f5eb46b27f0b31dc0bbf7ae4449cd0bcda06c82084d0188a59ceecdc4f73112a696fdb0e4a0eda6c64451cef0
TLSH
T1CC018E0A0C8139DACF1291B555916AD78B206186F77BA06032B70A28FFBE463DB535ED
MD5 SHA1 SHA512 TLSH

Submit Download

sends.log

Path C:\Users\Admin\AppData\Local\Temp\sends.log
Size 2KB
SHA256 bafd45c9ee15db6bfd301f255be64f6b20cbda04e3f427c4a4c0a7418c60b7bc
MD5 daa373069f36b2efdbc8c6dc1b192835
SHA1 58a73dc0d7181b034688c17ca360ea2c9369e32b
SHA512 fef404223a9116edcc251761b7f51671ffac980db37bcb68bd46672cc11e58d08fe63f31cc7431c6f3fecee763908a1f0baec1c13cf3f859c11cf812fa3807e1
TLSH
T1D7514A0B1C9439D7CF00D29581506ED74B15A2CBA7BAA17136B70A2DBBBA023D7835ED
MD5 SHA1 SHA512 TLSH

Submit Download

sends.log

Path C:\Users\Admin\AppData\Local\Temp\sends.log
Size 5KB
SHA256 70828862f6191310299bb5f75541c3759ca6dbe31ea81a33049170df7eb2d8a5
MD5 be06e17176bbde30b7054f43b0b0d2c9
SHA1 e5b6946be9fdca829dfbb74b10eef7b5e2124e5a
SHA512 ec419a504175d1fc198266ecd9b8838c04544ecac598ee380453f77d3c5744a60c4d74f607e67a660f5b41de517529692f148243085ca6b889fd92af5416aaa6
SSDEEP 48:z6tNX52lgb6tNX52nQvJ1Oqh62l2NtD5t2sIyFjJwz6tNR42muEFvc2lQEw2mv9+:2L5sTL5rzOqksIbjJfl4ZcsGe+KtDX3
TLSH
T1CCC1570B1D9435C3CB10D25481607ED78B14B2CB97A9A1B036B7066DBBBB427DB466EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sends.log

Path C:\Users\Admin\AppData\Local\Temp\sends.log
Size 6KB
SHA256 45514b1769bd72342e7dc55d387ae292776737c805899f4ba0f9621ce951fb51
MD5 ea4f5fdc993e9277c45bb7f1690ed94e
SHA1 8468906d273df981e95efbedcc7540848ffde3a3
SHA512 e7ecf82d4b10b791717d58f8bad119c02cf09a4005e0a9b31eeadc1c1ff927c2abd3379eed597cc29a4492807c4d96a0e72341be12ab73390ec3154eb8d8eea4
SSDEEP 96:2L5sTL5rzOqksIbjJfl4ZcsGe+KtDXmJsFiRo0dw:jzOqIm2U5wdw
TLSH
T15AE19A0B1D8435C3CB10D25582207ED78F14A2CB97AAA1B036B7066D7BBB427DB536EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sends.log

Path C:\Users\Admin\AppData\Local\Temp\sends.log
Size 9KB
SHA256 a35dcab38a5e20bea1db83a2152fac86bf25a5e08df3f9f48a0120f23f5e4403
MD5 d89ed16f2d56fc60b7eb3cb6ec2e5bd3
SHA1 c88f090c2c4660ff72ea795b72bc49f4c8bd9ce1
SHA512 897be64dcaf1d3cd108ed08f6865fe285ecc0716196f9b301af5ccc94e5b1ad1bba89e0dd36f6c90c49474c1c4dbbe96babc7ad8d860bb4aecad6c3d00f83438
SSDEEP 96:2L5sTL5rzOqksIbjJfl4ZcsGe+KtDXmJsFiRo0dfJYGgPX0wJh0Ox:jzOqIm2U5wdhYG+kwJ6Ox
TLSH
T11312BB0B1D9435C3CB10D24582207ED79F14A2CB97AAA1B036B7066D7BBB427DB536EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/756-470-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/756-747-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/756-463-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/756-462-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/756-461-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/756-460-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/756-465-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/756-466-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/756-467-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/756-468-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/756-471-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/756-472-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/756-469-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/756-459-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/756-464-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/2612-374-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/2612-385-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/2612-376-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/2612-373-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/2612-725-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/2612-387-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/2612-386-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/2612-384-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/2612-383-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/2612-382-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/2612-380-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/2612-379-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/2612-378-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/2612-375-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/2612-377-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/2612-381-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/2792-741-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/2792-742-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/2792-736-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/2792-731-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/2792-732-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/2792-733-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/2792-734-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/2792-737-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/2792-738-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/2792-739-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/2792-740-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/2792-735-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/2792-744-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/2792-743-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/3708-391-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/3708-401-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/3708-728-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/3708-389-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/3708-392-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/3708-395-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/3708-398-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/3708-399-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/3708-400-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/3708-390-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/3708-397-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/3708-394-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/3708-402-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/3708-393-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/3708-396-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/3940-815-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/3940-818-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/3940-819-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/3940-817-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads