hxxps://cdn[.]discordapp[.]com/attachments/1492839665236050060/1537316578159493160/ddos_engine[.]exe?ex=6a7e9922&is=6a7d47a2&hm=cb99500683f6e5b9d9abdce4e2bfb383c5ded1d15acdd16784c470cce41d003a&

Analysis

user interaction
yes
max time kernel
563s
max time network
572s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
13/08/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1492839665236050060/1537316578159493160/ddos_engine.exe?ex=6a7e9922&is=6a7d47a2&hm=cb99500683f6e5b9d9abdce4e2bfb383c5ded1d15acdd16784c470cce41d003a&
Sample260813-e3txls1hld

Score

8^/10

discovery execution persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
52	1732	msedge.exe

Executes dropped EXE 3 IoCs

pid	Process
4132	ddos_engine.exe
6112	ddos_engine.exe
2400	ddos_engine.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 11 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2236	cmd.exe
5220	cmd.exe
4388	cmd.exe
4560	cmd.exe
2212	cmd.exe
3064	cmd.exe
5696	cmd.exe
1436	cmd.exe
5248	cmd.exe
4844	cmd.exe
1332	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1732	msedge.exe
2968	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310689158194264"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4045429996-2364296335-1634900306-1000\{24DEB277-438B-444D-BB10-1FD9F1A32854}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
6092	msedge.exe
6092	msedge.exe
3676	chrome.exe
3676	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeCreatePagefilePrivilege	3676	chrome.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeCreatePagefilePrivilege	3676	chrome.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeCreatePagefilePrivilege	3676	chrome.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeCreatePagefilePrivilege	3676	chrome.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeCreatePagefilePrivilege	3676	chrome.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeCreatePagefilePrivilege	3676	chrome.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeCreatePagefilePrivilege	3676	chrome.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeCreatePagefilePrivilege	3676	chrome.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeCreatePagefilePrivilege	3676	chrome.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeCreatePagefilePrivilege	3676	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 5232	2140	msedge.exe	82
PID 2140 wrote to memory of 1732	2140	msedge.exe	83
PID 2140 wrote to memory of 1832	2140	msedge.exe	84
PID 2140 wrote to memory of 1832	2140	msedge.exe	84
PID 2140 wrote to memory of 1832	2140	msedge.exe	84
PID 2140 wrote to memory of 1644	2140	msedge.exe	85
PID 2140 wrote to memory of 1644	2140	msedge.exe	85
PID 2140 wrote to memory of 2448	2140	msedge.exe	87
PID 2140 wrote to memory of 4868	2140	msedge.exe	88
PID 2140 wrote to memory of 2448	2140	msedge.exe	87
PID 2140 wrote to memory of 2448	2140	msedge.exe	87
PID 2140 wrote to memory of 4868	2140	msedge.exe	88
PID 2140 wrote to memory of 4868	2140	msedge.exe	88
PID 2140 wrote to memory of 4984	2140	msedge.exe	91
PID 2140 wrote to memory of 1304	2140	msedge.exe	92
PID 2140 wrote to memory of 4984	2140	msedge.exe	91
PID 2140 wrote to memory of 1304	2140	msedge.exe	92
PID 2140 wrote to memory of 1416	2140	msedge.exe	94
PID 2140 wrote to memory of 4656	2140	msedge.exe	99
PID 2140 wrote to memory of 4304	2140	msedge.exe	98
PID 2140 wrote to memory of 4656	2140	msedge.exe	99
PID 2140 wrote to memory of 4656	2140	msedge.exe	99
PID 2140 wrote to memory of 4304	2140	msedge.exe	98
PID 2140 wrote to memory of 2700	2140	msedge.exe	100
PID 2140 wrote to memory of 4132	2140	msedge.exe	101
PID 2140 wrote to memory of 6112	2140	msedge.exe	104
PID 4132 wrote to memory of 4844	4132	ddos_engine.exe	106
PID 6112 wrote to memory of 1332	6112	ddos_engine.exe	107
PID 6112 wrote to memory of 4388	6112	ddos_engine.exe	108
PID 4132 wrote to memory of 4560	4132	ddos_engine.exe	109
PID 2140 wrote to memory of 4552	2140	msedge.exe	112
PID 2140 wrote to memory of 4752	2140	msedge.exe	113
PID 2140 wrote to memory of 5388	2140	msedge.exe	114
PID 6112 wrote to memory of 2236	6112	ddos_engine.exe	115
PID 2140 wrote to memory of 3476	2140	msedge.exe	120
PID 2140 wrote to memory of 3476	2140	msedge.exe	120
PID 2140 wrote to memory of 3476	2140	msedge.exe	120
PID 2140 wrote to memory of 2168	2140	msedge.exe	121
PID 2140 wrote to memory of 2168	2140	msedge.exe	121
PID 2140 wrote to memory of 2168	2140	msedge.exe	121
PID 2140 wrote to memory of 5144	2140	msedge.exe	122
PID 2140 wrote to memory of 912	2140	msedge.exe	125
PID 2140 wrote to memory of 912	2140	msedge.exe	125
PID 2140 wrote to memory of 2400	2140	msedge.exe	126
PID 2400 wrote to memory of 2212	2400	ddos_engine.exe	128
PID 2400 wrote to memory of 3064	2400	ddos_engine.exe	129
PID 2140 wrote to memory of 5336	2140	msedge.exe	134
PID 2140 wrote to memory of 5336	2140	msedge.exe	134
PID 2140 wrote to memory of 6092	2140	msedge.exe	135
PID 3676 wrote to memory of 5148	3676	chrome.exe	138
PID 3676 wrote to memory of 4444	3676	chrome.exe	139
PID 3676 wrote to memory of 4444	3676	chrome.exe	139
PID 3676 wrote to memory of 2968	3676	chrome.exe	140
PID 3676 wrote to memory of 1040	3676	chrome.exe	141
PID 3676 wrote to memory of 1040	3676	chrome.exe	141
PID 3676 wrote to memory of 5852	3676	chrome.exe	143
PID 3676 wrote to memory of 3824	3676	chrome.exe	144
PID 3676 wrote to memory of 5852	3676	chrome.exe	143
PID 3676 wrote to memory of 3824	3676	chrome.exe	144
PID 3676 wrote to memory of 788	3676	chrome.exe	145
PID 3676 wrote to memory of 788	3676	chrome.exe	145
PID 3676 wrote to memory of 5260	3676	chrome.exe	146
PID 3676 wrote to memory of 5260	3676	chrome.exe	146
PID 3676 wrote to memory of 5008	3676	chrome.exe	147

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1492839665236050060/1537316578159493160/ddos_engine.exe?ex=6a7e9922&is=6a7d47a2&hm=cb99500683f6e5b9d9abdce4e2bfb383c5ded1d15acdd16784c470cce41d003a&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x28c,0x7ffbbecec188,0x7ffbbecec194,0x7ffbbecec1a0
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,1880393315354857851,3244956306581266363,524288 --field-trial-handle=2224,i,8078991909781134766,3264058531282941062,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,3744510879454168146,6335129808938513824,262144 --field-trial-handle=2224,i,8078991909781134766,3264058531282941062,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,7373792890077197465,10302634258562920322,524288 --field-trial-handle=2224,i,8078991909781134766,3264058531282941062,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,11347799419502069698,10188765968167019557,2097152 --field-trial-handle=2224,i,8078991909781134766,3264058531282941062,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,789010812181935786,12782712379087490726,2097152 --field-trial-handle=2224,i,8078991909781134766,3264058531282941062,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,18197177404863310702,5161422704941165646,524288 --field-trial-handle=2224,i,8078991909781134766,3264058531282941062,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,2630408412643054221,9910353897099412000,524288 --field-trial-handle=2224,i,8078991909781134766,3264058531282941062,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,7726871539672848573,4864611881265895525,524288 --field-trial-handle=2224,i,8078991909781134766,3264058531282941062,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,7726871539672848573,4864611881265895525,524288 --field-trial-handle=2224,i,8078991909781134766,3264058531282941062,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,3662971271864975238,13172157161073174261,524288 --field-trial-handle=2224,i,8078991909781134766,3264058531282941062,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6152,i,2764465005232703125,1946323453429687001,2097152 --field-trial-handle=2224,i,8078991909781134766,3264058531282941062,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,4727614168114723630,1152178978166151662,524288 --field-trial-handle=2224,i,8078991909781134766,3264058531282941062,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:8
  2⤵
  PID:2700
- C:\Users\Admin\Downloads\ddos_engine.exe
  "C:\Users\Admin\Downloads\ddos_engine.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color 0C
    3⤵
    - Executes a command shell one-liner
    PID:4844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:4560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:5696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:5220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:1436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:5248
- C:\Users\Admin\Downloads\ddos_engine.exe
  "C:\Users\Admin\Downloads\ddos_engine.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:6112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color 0C
    3⤵
    - Executes a command shell one-liner
    PID:1332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:4388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,9658661302343407283,7616136576447235486,524288 --field-trial-handle=2224,i,8078991909781134766,3264058531282941062,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,16950851614721910848,12157023931981708329,524288 --field-trial-handle=2224,i,8078991909781134766,3264058531282941062,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:8
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6856,i,17765233030835454914,8126393315293629070,524288 --field-trial-handle=2224,i,8078991909781134766,3264058531282941062,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:8
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5292,i,18023281046279191746,12939395317324850446,2097152 --field-trial-handle=2224,i,8078991909781134766,3264058531282941062,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6696,i,4224966855276788869,16845094673518961504,2097152 --field-trial-handle=2224,i,8078991909781134766,3264058531282941062,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,10854987558427968092,8630404302000991588,524288 --field-trial-handle=2224,i,8078991909781134766,3264058531282941062,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,11164954971312493396,7588519851501853593,524288 --field-trial-handle=2224,i,8078991909781134766,3264058531282941062,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:912
- C:\Users\Admin\Downloads\ddos_engine.exe
  "C:\Users\Admin\Downloads\ddos_engine.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color 0C
    3⤵
    - Executes a command shell one-liner
    PID:2212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,11917105223854847338,1513879555888038580,524288 --field-trial-handle=2224,i,8078991909781134766,3264058531282941062,262144 --variations-seed-version --mojo-platform-channel-handle=1832 /prefetch:8
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6068,i,3795091509986017832,1700872221991637119,262144 --field-trial-handle=2224,i,8078991909781134766,3264058531282941062,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,5984392863217805911,6860614361611180154,524288 --field-trial-handle=2224,i,8078991909781134766,3264058531282941062,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:6352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,12790121701148378737,6365034786047162838,524288 --field-trial-handle=2224,i,8078991909781134766,3264058531282941062,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:6704

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2280

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffb9e86c728,0x7ffb9e86c734,0x7ffb9e86c740
  2⤵
  PID:5148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1748,i,9207232622860079875,16347329044459203482,262144 --field-trial-handle=2012,i,3025566054559985062,14921348630929950438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1636,i,5233744775722107732,15747470013255337884,524288 --field-trial-handle=2012,i,3025566054559985062,14921348630929950438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,7773083441625702618,1226556770083908476,524288 --field-trial-handle=2012,i,3025566054559985062,14921348630929950438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:1040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,5003461347157707187,12938624679710312179,2097152 --field-trial-handle=2012,i,3025566054559985062,14921348630929950438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:5852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,15127190458318422213,9563796152419217550,2097152 --field-trial-handle=2012,i,3025566054559985062,14921348630929950438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4432,i,3573881954763266605,2482817059534063586,2097152 --field-trial-handle=2012,i,3025566054559985062,14921348630929950438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4444 /prefetch:2
  2⤵
  PID:788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4736,i,16301091132239308486,1910120659449146678,2097152 --field-trial-handle=2012,i,3025566054559985062,14921348630929950438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4940,i,7852882831181981116,16793010177310755049,2097152 --field-trial-handle=2012,i,3025566054559985062,14921348630929950438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,17061747635553287769,17216295061852171122,524288 --field-trial-handle=2012,i,3025566054559985062,14921348630929950438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5596,i,4602189429670092186,14204463717595069322,2097152 --field-trial-handle=2012,i,3025566054559985062,14921348630929950438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:5908

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c15f8ba84237e0861df3edc40bc5691852a15aa91b008b2dc51fd1c66be34681
MD5 450c16ca851a2cdef9be39dd601ebd76
SHA1 d845451552b31a499fec8f25a64e6e3618c8ac5f
SHA512 df7b4406b9ea36a765858614f7a66f0aa888c90999cc5a30bd963ede3c51737bcfc4d08858d14bc5cc43cb6360820ba9baae378982bc18780b2d385edee33105
TLSH
T125E02BA6CD21AC6B1CFD0B5820504B8AE75413172A40894F7E3C811CDFB463A565581C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 820def38360641c4180419a7a01d370d5b88a0b2c461002999aa3a696987e855
MD5 26c26a0f86d3668ecb06bb71cb4fe05a
SHA1 2c725cdd83aa1c702a66f72dc4d5379435d014ba
SHA512 e82c0bef337002cab77c5d78e6194c16f5b3a0ef67ddf6994625a788f34f7ae81293afa38d15fc7a7daded4c6ab10538a4f153fc54bac556a5f3de722ddf0e09
TLSH
T167D08C311C433446D7A818B2981BCEB380030814E600AB6782EBEF818D76CE02132033
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 0a9ccb3e10e2e0dcefc2f147bcad11a00f1a58965c219adbd0938e943a95deba
MD5 2003b4b6ee1135eebd957c1149a55a50
SHA1 44ce729fe3c86e86f91778ef497daeda325ffe4c
SHA512 3fb7fd724b16ba69212ad7ccab1d3a4f0fe3f6080520edcc510b702d8db5ac6d86144eaf828061099ff4df6fe6c6203f92afa0e4ec31ad11dbeec487339d961f
TLSH
T103619DB3D3E8DA7D881156F59A256E2FDD390A25521C3C52C9D8EE4B53F68B2D20038E
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 691B
SHA256 b136ac280b0b878d96ff7af2153068600f3f37ce78ea17302dafd7bb30f49cbc
MD5 c74adbd22b6b698922cdcd18b2bc57ec
SHA1 8463985ac3fbc425e405e07408d8704b6c2cd8a0
SHA512 1cc1a3fbe5afe9d5e771c6fc67746bbc1cbf253dd3350d32af07c4ced19562b24796c2d78888ed73b9ed0a93627c3934fb6cc7e7d5a185f184740bb627790eef
TLSH
T1BF017B97AABD742700BB04BE5E08B849297168311291A4F1CFDBC26CB0A74F30F12823
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 24195b43a0ccbaecf38578ef38334cd10661ac6998079d4d68553395e7647189
MD5 b0653f4b00e2f5add11be971acd57d17
SHA1 87055da3231c02c665edc396438aa3df23402daa
SHA512 6d04dcf118748d16c69516fe58655cab93645944020432594070fec359f6addeeaa6e6d037ae0465592d1a1f4c142b2dab35499204f8b77d917f1567dc305aaf
SSDEEP 192:HRR+uNITZ8v7XpAPRp2k9fHsb+WNPrB1Ey0bk2Qcef2ng9ZqPyIsnAUgtaJ:HRR+3oLUXPFw1H0o2U2ng08
TLSH
T10F42C83DB914657B7CCBD22AF9623B57D7F5103625902E84EAFC8A2C05EB9CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 88441f7725ed5685a2b1d5ef5037fb37b54904dd97a8a2e234382b55065b22e8
MD5 c29b41f992c4ca55f64012533f9da5d4
SHA1 d5a8a53295507f58299f13453395eb33e04f9055
SHA512 0b1196d764e78b4d4c7d2aba28cad794876b0671219aef38c499341d98770405f20546863e3a2394172f1f8fb23b09b0b7356fa4b03378afcb84bc1a7b60ae15
SSDEEP 384:eojKB7KxkXqKf/pUZNCgVLH2Hfgslmc7pLuLcSjYZXODKZ+ErU3n6HGY3Wobe:ecKB7KxkXqKf/pUZNCgVLH2Hfgscc7pg
TLSH
T14C7207777C489A370F94CACCD8277F4FADB5025B66E9886486FA482503D5ACF11062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 5069e60dd4aadc0c28b55a24463b8fad6c97fddcd1e36f6c0511147f371ae2f1
MD5 8176c272a5aa676717a067ca120c7ba2
SHA1 1625dd43262577634c8ed8c6e04cc52fb6ecb1a4
SHA512 4656bdb5cd66f83276a52579cd021330cddbcb9073ec7497fa3ef8dfd7286822c4194c2cfb9017295c6452c211ceccdc25666109151ffa6b2771c2eb61a6f07c
TLSH
T138B0124084025110C50301B821022488A1189F11E549970193F4AE6298256618124061
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a5e0f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a5e0f.TMP
Size 96B
SHA256 2198375906747342cc93b8ec74d4a19419a62580c23167de94b759b742b921ed
MD5 3ea643dc2a06982126a37a1178e83d5a
SHA1 4c068c473a7d3511716146ddcd0d68e9f9561f85
SHA512 5595b2d2c96398f08db5a63643fb4df103d9782a09a50ddbe22b88bd144e6b733d5bac534ad67cca0f2e9ef7f25062ddb8f658782879afb45cabc979c3235ea7
TLSH
T1A9B02280C2322203C02203B8228080CAB028CF20CA03220383E00B22CC202300030220
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 d678ba6c6790d9bb2e42bd545a6a0f6517db84ac84f93cf716597f9b947c332e
MD5 05827b7842841972f9c9c97d09941392
SHA1 9a354dfbc5f2355ffc17e82e52b383db46d9cfa5
SHA512 fda8b795f42f475ae1a38d671c243970d1a199b02f7f201a5bdcdc185127adfb26a41f074916543229f98438e6a860c6cda79b1e7833d880786682037e73b064
SSDEEP 3072:CGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMC:1m7Rkm1tYpBeh2BAoC
TLSH
T1AFC312275D71E97B69B9B71EB44E0F1E1EF14AA2D920DE42C8D85A0437EA7CC0A04A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 238KB
SHA256 2c0dadbfa5a2d45ffd52c4e207fd0fade6ac176f1fe1fec122abeb477de6cacc
MD5 debdb72569fb49420deb398a5746c83c
SHA1 435acb676431b9993bf6e0618d34bcbb46962609
SHA512 7b1c5721655a405941b2ea3bdce4b130eef7b853d6df05e654f1f487ecb499735e4bda3821b1a8ad5ca9cd5a161e4b22b5e1e30337408e1242673239c611c911
SSDEEP 6144:W1fOTnQ7FAql5DyXIj8Y3u/s+m7Rkm1tYpBeh2BAot:WFOmFAqliIfNZ9oBGcAot
TLSH
T116341237DDA5ED399B25679AF11E0A0E0DB026A28734DCD38DC46904BB5DEC90FC1A78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 238KB
SHA256 404eb4b56059a315490ca808f434f69a760a86b4a4366de2a538bdc4d6567312
MD5 152255cf7ff18f4e25daabe95fb532e8
SHA1 3d7e0205beabe42b2e8f343060d2756f1655dbee
SHA512 3822e80bfdc96e00e330d9ffd4640c042553c6b37757642828caf1481760000b7f6634b8adffb47f11428c539d520fbb5668724bef1ff6920bcf1bfb33faedc9
SSDEEP 6144:t1fOTnQ7FAql5DyXIj8Y3u/s+m7Rkm1tYpBeh2BAot:tFOmFAqliIfNZ9oBGcAot
TLSH
T15C341237DDA5ED399B25679AF11E0A0E0DB026A28734DCD38DC46904BB5DEC90FC1A78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fc69248227d1b80ff41106426895bcd599abcddfbfe7fdbeabc0fcc2aca903ae
MD5 be6741080fa256162cf6b0264133ca7c
SHA1 4914334b0edd1e4c3a470920450bdee63ee2f5b6
SHA512 8d42ac6412ff316aaa68e317e92c2167dbcac331381aec8d8be8410c5bfab4657127a0601dfc90f771660e393667d62af5e917155d6fcc5c7aa6a8ca1e03f903
TLSH
T149D08037394D7015E35D5175A463C7152B664C611497DF01F166CA7CD9B61C462C71C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 44e095af7ccad1927602b4b935aae3524939df30218011b877b59c782e6c6106
MD5 3c1bf221dd0438f719ae47a265c3e436
SHA1 b382689171539f473d331bdcef3739b0fa0b1062
SHA512 b7f8bf66ea12f9b37e5f8d1af222c106c1dfa377331d2153d9380edcc3af7381e9c3490378c0b160e05f5c4fd2e1590d5cb8ed07cdeb7b74fb7b38b0e8e1e57f
TLSH
T18ED080333D4D7015E35D5175A463C7153B7648611497DF01F166CA7CD9F61C466C71C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 557B
SHA256 39e72ac06dfdb1d7b97ea1bbfe5514dffe9730ed781bed07f1948bb13f381d18
MD5 9c96421b1a2b8b74a5ca9d10919ac1d0
SHA1 821f82e74f2111e944615e5df9fa39c801d6e72e
SHA512 c8824a43655a08a9050093943bc6c0b4c3968621d8b4c77f7383e9620384e852f8185583ad88503a4386e5818f503b77ad987050132c5b7c600c3c7d9e65c1bb
TLSH
T15AF08B450EC7EAE96E4252479244A209B06072C7FACCFA8B33C9E4CF71060E092F31D6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 4da280008b4395ea5ce0c45460d21548c17a3a4a6928b6ee3a251bfe8639e61c
MD5 79727d662067e51c9296e761537ea657
SHA1 78a349dfa7f007c604f0f0c48dd2dd12a344338e
SHA512 70c6527d64399abbc233fce80f76130c7d3f75ff4bff3af083853a0bcadc15c8e2550bd42cc3a10f31bfbd2d1b8079c6226dc208cb9886eebe72021c43c90066
TLSH
T14BE026E808C8CBEEDB64A6879178530CD2A0374AF3C8FE0A379084CB30064E0B6C3D95
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 5d1cfd204f2802a1ea03d1d7760fd62482f364922153b68930c151984e75e01b
MD5 878867b2e835954d6d144551212b0b5b
SHA1 3f51a81b68f4748dd7b69aa2c8a3f06794ece84e
SHA512 a4feccbdb344eea55ae6aafb0cfed4d0487da4c830846b96089fe3ffda705b87ca6c83accdbb81daa8b38e28a400c64082b8829494536a31188b6fcbb37281d6
TLSH
T120E020C909CCC3DDAB50E6476274470CC140374FE3D4F9C52F6088D97105090EAC3655
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 151B
SHA256 037d8435ca2e33b1170c7d95ce07e251adc0a6e485fadff53a55915da7010b77
MD5 4b36c361c1996c99f9f38229a139ace9
SHA1 5ff4e113a6e7b40f574c7a6512c55fe6b78333b0
SHA512 80bb35f1d998b99e6a1ff01c537db4646fb3a401461fd7b39196ffe3b5a6291b9e5349e7ae137f1d246fe4a19a9edc4ae3011465589ba64fe545e26bcd2b20da
TLSH
T134C08C2C38DEAA1AD6B418BFA349A0000F6407010022EC1623A4AE846F826940F6A160
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 0cd46d9817726a064565e229f537633d4d0432f220375591b83ffdc62356b715
MD5 26bf18a5be89f595ea1a50cf24cdfc24
SHA1 cb2a243c5b1aa53a58e95793133da0fe8bc579ff
SHA512 a4206179803f7f78ed5f2f9002f1ecbb10ddf2965778a78f4e03ecec86abc2246ccf0ebc921b00e3ceccc31e154d1b1c5241251805acfb718b3f0e61a13911cb
TLSH
T15EE068EACD71EC3708FD0B5D60A5174AE745235B2B808C5F3A3C910C8FB1637418282C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 57dbfed04439eb60eaed317c596833e4825b3e7dcc2535a65fb8ba478d560d84
MD5 dd1290dff5d2924f05a8dd02cb14af96
SHA1 a01d02c5b1f9b99d279114f446e3d30c8ee21edb
SHA512 6f4a8a3f2682b6181334c7222cdab52d83ee93ccf13aa5adbf11a32b4427977d69707530ed67d1663f05c644c23faf30a6cdbf04450c8b2f589d0b6d4fba207b
TLSH
T13F41ACF382E4856EC90156F0AA18AE2BCE2D0554432C3C6A88E4EF6BD7E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 db6c02a956d31a87e0c19b2714be84af482d4617580a3edd14fdb8c1b9acace5
MD5 ee1713e725e92bd296955705f075d47c
SHA1 98ad1d689ddd773572143a73b8054ec23bb782ac
SHA512 78bb0b5d8a6c716ba645e1d074eb1281a77028451ab76eb27a90d1b3df73735e3dcaa8be1309f1b80ea0a097cb7fb5fa8964f28f564acafb21dba22bafb75b18
TLSH
T1E841C0F383E4865EC90156F0AA14BE1FCE1D0514432C3D6A85D0EF5BD7E3071E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 19188612451a945de8190fa405a976cc8b9676c70f914c4f72bf7444baa5268b
MD5 f3c202a7ff3f1b8bbda809f09b3aa1a1
SHA1 94b6473f1bc93144f66219089c203e7c57f818c9
SHA512 d9501bce40a707c2413f3dc009f6deb8a619f323519df57f8711909a4624bfdf8edbbc81a2e3470ef6ad20ce97caa3e04b5637a7c9f0a6933351a72c1938c52d
SSDEEP 192:sxZLRMyMqZjK1Ml8UQzj3/fKsbTU/YYZZyszodpLHW6+WNGYBAjRxT11mqIg5tt0:sxZLzqX3/fKs3U/YmZULHbGtjr3Vnt0
TLSH
T1CB62E615AA349A7BDCDBD20AF6857F53D7F8556391904E44A9FCCA1C04E7AEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 986cd3b19a7d1dee5b438965b8a00864f5531b9deb13854f991d8244a31fdd31
MD5 70373e9c3ca96a9a297341c16b6acec0
SHA1 b8a8daaf22bd26f253666d17aef63bd060ef4401
SHA512 1165bb43767b70e18bbc615567264fe7b1435644d759c594fb03f74947ac33f053f18ad58f44b38d70e45ccac207234aa421bb2159adb415b69e60ae2fc2cf07
SSDEEP 192:sxZLRMyMqZjK1Ml8Mj3/fKsbTU/YYZZyszodpLHW6+WNGYBAjRxT11mqIg5ttQJ:sxZLzb3/fKs3U/YmZULHbGtjr3Vnt0
TLSH
T18662D615AA345A7BDCDBD20AF6857F53D7F8556391904E44AAFCCA1C04E7AEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 bff00ac82014885354c62d588ce5539da776a47a3e98576364761b0b6aafe9db
MD5 d6722cd7bcae89c9912b04806d9f81b5
SHA1 5a53036596b782e1e33a0e5e182a1cdb833221bd
SHA512 d111391a4113f2dffaebba86b81e3a51f24338a3c4b42e54c50bdea1df6df4d38b8f504fb7947a07768125791e9676ba993343a042f0ebbb5924a2b917cb8807
SSDEEP 192:sxZLRMyMqZjK1Ml8Mk3/fKsCTUHYZZyszodpLHW6+WNGYBp2911mqIgjtQJ:sxZLzM3/fKsIUHmZULHbGV3Vjt0
TLSH
T19462E6156A389A77DCDBD209FA457F53D7F8556392904E44A9FCCA0C04E7AEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 470f762f4ac8d778405cac20f97b3ac7294905a6678263bd9c4b72306e3d5383
MD5 12c82014b03cc1fe82e59a0ee603573c
SHA1 87ef3d617ba8f59159b7aaa352ad353515f7441b
SHA512 e27058bba5ce9a6d2bc0c6138267e9f1b70403a2b18ddf4327697ea7ff27a2686f15a6cf7f0ec2475bf1e5fe7b10a0fbd4f401b459b18d5fa14cc64dcee72bbe
SSDEEP 192:sxZLRMyMqZjK1Ml8M93/fKsbTU/YYZZyszodpLHW6+WNGYB0RR911mqIg5ttQJ:sxZLz13/fKs3U/YmZULHbG5p3Vnt0
TLSH
T19562D615AA385A77DCDBD209F6857F53D7F8556391904E44AAFCCA1C04E7AEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4a5db2156eb4fef5daa5096bff3f90657bd3e3f7e4afca552041515b3bb00ef9
MD5 d8fc0d9ea27f21fb344721ee644926d8
SHA1 13d74fb1b76636436ea648ef0842d2db1c86ea2f
SHA512 6e20274faa19d10d87a4ce06ab63f89516038cb2f97b7aac380d044960e3c29640ac920260a09b885f4ab19ece0927ab3c06e980b145b56014170d5af7d4cccd
SSDEEP 768:P4E/aX6WvCuFO8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDVLlFX6BaroVNm5Pa:P4E/aX6WvCuFOu1jayVLfqBRVMha
TLSH
T18FD20A3B280CCB7E4F844E9CEC266F976DD801C796988D5447EA884C03CB7EE511A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d48562ce-0fce-4732-afa4-e8e5c45ecad8\index-dir\the-real-index
Size 2KB
SHA256 1f92084cc87ce856495453e1426aab75699f3365d2cd25dd5f0e2954f060be4d
MD5 343f72ebe54ff2b07775084e2d3b3d72
SHA1 e8183a5ff2c8ad934e3d836dd36e6b9254ec751f
SHA512 f3c562b40c3674d2979a87df41511c7df45dcd79ff1174cd4277cffd8912fea6ad80e9df845bb494fa1c0778dfb73a03dd034d453a4c3e95ecda6bd5c8db15ce
TLSH
T15351B64D8D408A6FE87801B209B264E4377088CC6A109A136CFC2235BD47B5D2D5F3FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ccdd7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d48562ce-0fce-4732-afa4-e8e5c45ecad8\index-dir\the-real-index~RFe5ccdd7.TMP
Size 2KB
SHA256 5befa46359f13c759d1cc9b7cfafcbc2b7dd7df13db6db606b97c5947f03d47d
MD5 3ba2a9abcab1c732fbdc2355b2bdf6ab
SHA1 9126b4c2f7eced6e16abd931c75bbaae745c652e
SHA512 bf1d4e2626fa6a8540bfadf308c926136ba54493fd5d4b59dff317dce5cb24a4c0143c78a4b6ac15abffa8d0996b93171ae6a35b085ca6613184e61cc90f0b9c
TLSH
T13651C85A4D81863AE89440730DA2B8B43335580087557F5374BC5235AC927AD3E0E1D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 7d323638cb7413d8d9af543e10403fffe01ccf5feab84fd4c3e5da2967b4040d
MD5 db7e080035fd38b262ff4c462f7fb15f
SHA1 9222696586e7ebe095cb3c6ef107fcd1231c94c4
SHA512 976623542f86726e473af12237ab8594cdb343e3e450d6690b1ca2006bdce2b4c7e6e1a3713f31465bd82ca325c393ffaa0faa36f68100e9f994039c44a2eb93
TLSH
T199E068B629E70E04EC2FC3E5247240A004217804C504EC8F202AFA8360B03113009C71
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 16bc93f54f0407aed4596a69337124c4c4a5f941518d31f3eb8ca1c337cc9de2
MD5 67a348f38bb46d40ecce593adc96c2cc
SHA1 966291ca33b9f731fb6b6e87ae2d91ae0cc31b9e
SHA512 e644a0dbdeaee036771b6b284356bbc9fc08987bfe037ea5243e0c077e004fbd5128ef974ac0bbd0daf1fd48de60724890a300ccf211d543391b919838980fea
SSDEEP 192:OotE42aG3iLEAs1AOvQA7uItfg1MhlfznKzO5tZBBHaFlufF5XYP7cNBv3dR5LAR:8ptDYDcfvNR1ANAJ1ved
TLSH
T1E2B27E16713B065238BF250CA6979A379E4231A33418E4BF7BB914A21F67E125CFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 bfda0baa94b1c8ee754e385feaa79cf5ce94ed4c76cefed047611f0bb4ccdcd2
MD5 f07e766b6ea506a9988c73987562b313
SHA1 72af89cc32a9de4b86805b5a648978064555e1c4
SHA512 f5031813c9b1e9efb2445000617dfb71d249df2c3b9808a32f250ff88817e8cb34e6de1cafdc4877ce26d5b2605ff115d1fb48c3b7ca43d3d917946813b07f0a
SSDEEP 384:nviFPZcIlsNi8TUNTUlI4AoDcYBi6M132fifuG0gkz8PcRZje3Hk/OOPrXLpe8CY:6FHlZwgoo3CG0gkz8wSU/Oi9Pa8
TLSH
T1A9D24C72E8A4C9B7BDE68FDAA75A3A03DFE44153D68C9AD4E9DC5D0C00871AD0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 aa07ac839feb9cd8c2fb96ed5f171f5503ff9e9a931c69ff20bf827db09b594f
MD5 77594d5d3d581982a725eb966498a552
SHA1 c8e4a2a5abc9a492a18520e007db33977169268a
SHA512 1590cef851cd9a9c15efdb6ed46fe71dcfbb6d694f4d0546702935d5d618aa1861a4e106daf1730c792c88ccb29dfcb8fee16d058d4f2c9b9fdc299eb8d4d0e0
SSDEEP 384:n4iFiZcI73sNi8TUNTUlI4koDcYBibMf2fifuG0gkz8PcRZje39+/OOPrXLpe8CY:DFQ73ZwgUhCG0gkz8wSo/Oi9Pa8
TLSH
T159D24C72E8A4C9A7FDE68FDAA75A3A03DEF44153D68C9AD4E9DC5D0D01870AD0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 29f2b0e91e99e8b62f9abee1736d18809ef8410e14466c5c9352895d2fafdc37
MD5 56cdfbd5b5774df225239ac5aa904c2a
SHA1 3d782af0af0d2023fbf81139914deba5f2d97288
SHA512 8f914307208be5b4dec5d5e25c0e56e82bb82999cab80a5264cc681abe2d3de634273b7dc78db4354ade7331be707a78467e8706353ee77df4d70881c8fa3eda
SSDEEP 384:nviFWYZcIAsNi8TUNTUlI4AoDcYBiIM132fifuG0gkz8PcRZje3Wiz/OOPrXLpeO:6FxAZwgoC3CG0gkz8wSme/Oi9Pa8
TLSH
T1F5D25C72E8A4C9B7BDE68FDAA75A3A03DFE44153D68C99D4E9D85D0C00871AD0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 4afc622213f54c561c789dd6223de169addad7a69f6f44d650a06c73ac0c3403
MD5 4e01af691347503460473f71bb9e7d0f
SHA1 52ff3f9b83df277403c4196ed1be2720d1884ed8
SHA512 cb95cd3c3184b61fa4caf6f2019df1a96df8685001f453cd48d42c0ce4913785cc7ea0fa448716e15348fef4f1631d44fa05d781296df362a2606559b12bd563
SSDEEP 384:nTiFWkZcIb3sNi8TUNTUlI4AoDcYBirMf2fifuG0gkz8PcRZje39+/OOPrXLpe8h:+Fxb3ZwgoRCG0gkz8wSo/Oi9Pa8
TLSH
T143D24C72E8A4C9A7BDE68EDAA75A3A03DFF44153D68C9AD4E9DC5D0C01871AD0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 8271986639071cf2479d474f5a9680ce1fb5beb8e771895c36614a303e7669fc
MD5 262dfb9a897fcd5d8ae0cff67a8b4797
SHA1 8097c93bbef410b5aad325387b010378d3fa618f
SHA512 c75ec87fd5e5d0b2ece8b12a6ef16022d216e7596a7c60fd8a7a6899106dad4618209365a2af59e8e49fc6a6c784f3ff9d680536a8ee24f675cc14547c83c8be
SSDEEP 384:npiF9CcmyWCs3sNc8TUNTUlImkrDcYho9fifuG0gkz8PcR+VwLaJCra5eT7QIgHA:AFccps3vwgxE5G0gkz8NVwLaArXh
TLSH
T18DB25C35DCA4C9BBEDE68FDAA35E3A13DEE04167969C8AD4DED91E0D008709D0707826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 8c6ab06f0362454ff7c62a7eeb74cd96747eb57c2a511269ef8a343ec3b8f56f
MD5 6f3d6c0889f9f522f062759f2ec20c9a
SHA1 f9e303115c1ae60ef4716923ba17848e03cbe963
SHA512 c1bee1b222d7d0ec4bea1a11842cdcf0419aad2753bacfe427d491762cf618bd663efa3aefe348296bc908a5500091ea9e42af1edefe3c7e6ab4c2991af860d9
SSDEEP 384:n4iF9CcmyWCd3sNi8TUNTUlI4koDcYBiXMf2fifuG0gkz8PcRZje3E+/j38Hy/76:DFccpd3ZwgU9CG0gkz8wSx/j3C
TLSH
T17EB22B36EC94CAB7EDE64BDAB74A3A43DEE04153D68C89D4D9DD5D0C019B1AD030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 0f47b807534ca639a344c5c59a61f9719805f8cfd0a01dd4fe17b9982e24decc
MD5 b69a003f1e36560f6c711b78d3ede9c3
SHA1 ce3f5be9b321b640ac93732caa0f2dd28a38c976
SHA512 81e7b6d7b012b337bc10ea75b3efb7c1fc197220d15c16e4bbcb084e02f006cf0db39635d8a90fcfa315e0babfb6a124eae281f81a7be986275c9907b36fdd39
SSDEEP 384:ngiF9CcmyWCs3sNu8TUNTUlImkrDcYqTb3fifuG0gkz8PcRZje3O/wLaJCra5eT9:7Fccps3pwgx6DG0gkz8wSe/wLaArXh
TLSH
T12BC24B32D894C9BBEDD68FEAA35A3643DEE44163D68C9AD0D9DD1E0C019B0ED070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f32687960fdc6f3b7300cfb7704fb40ce563ac5c25071ff2f2551f71062aeb75
MD5 684e9d6e05de6f290327fb4f60d062fb
SHA1 d4daeadf71990d68f749772ea3405f65e7f4019d
SHA512 e83abc7b436f6d96e503f9b20842ad6f3dcb451215d9f2ceb25d317c9458430415d736cbde6310c1e1ee66cbe891bc5f4954438cfe7298beda52a1e66cd37545
TLSH
T1B441D659A6EE1148F3B76F5AABF6A86D487FB8772F07D45D10110D4E0A26E00CC62737
MD5 SHA1 SHA512 TLSH

Submit Download

ddos_engine.exe

Path C:\Users\Admin\Downloads\ddos_engine.exe
Size 423KB
SHA256 6da8c607731dfa55dc0120613497f48d3e1fa6e5f28b7e4b7e041337d224bd6b
MD5 5d23ede96f246e72f835761282c932ab
SHA1 c4d83bfc4feedd8a41a5cd33ea7864e4a6bf14f8
SHA512 a959a5cb2135e07ab57fce7cfaf1742c2110f35009f99b76b77d4d132cdea9915bfb315ec68d005bb3dd491afd1cd10283ffb472e4e8ceff9317d61a9845f0da
SSDEEP 6144:iX9hg3llkWb/i3mNGB29qVppeKLDQF8RSV3O76V7TUqRYv:iX9a3rTbi3mNRi9DQFbV3OmV5+
TLSH
T170948D15F6A420F8E16FD138CC664901E7717C8E53A06BEB23E01AD61F2B6D09DBBB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

music_debug.log

Path C:\Users\Admin\Downloads\music_debug.log
Size 118B
SHA256 7b85370c009a3109d3afbf99b285dcf673ba44af0bf29a1a195eb121a33aeeeb
MD5 6589de1f33f39fa0e1b26b16a4be39d8
SHA1 9d4ff81ca7e96eb2f8f1d68b138007813a3539d7
SHA512 17ac9e9c908a5fa9d5f0692d77e57e180f328aa4ebecb327e9e5e72815f487202ad12027eff2d25a5da33a18508722342a92415cde28533b2d3393dbb01a2271
TLSH
T1CDB09B9D41C79D596174D03756347155507429805EC035B48186560525115705D850E9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1416-203-0x000002B26BFF0000-0x000002B26CFF0000-memory.dmp

Download