47dd5cea0d653b63dd804d4038a967acadf628e57ba9c0b4ba37856d448348f2

Analysis

user interaction
yes
max time kernel
139s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/08/2026, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Btc-Tools.zip
Size 15.9MB
Sample260821-pr3eqatzet
SHA256 47dd5cea0d653b63dd804d4038a967acadf628e57ba9c0b4ba37856d448348f2
MD5 a7c8d9364b29015f1afd057b7a311fd5
SHA1 88560cebc6e5ae5d547e432f9a9e5044e724bda4
SHA512 f38b30d6d92542dc0057594a8b2ad8dbdcb5f1a72f12823daf146a64c6e907af0baca8e3e7fac4a2d76808c4791635f29dcb9b242881b0419ce1a26c6d45b2d3
SSDEEP 393216:8CirfmhmQ1vyr91YFQATqqgTTc3ET+caJcx3a5cbVDh5xvs4pLWY48uv:8D6npC9KjqLTA3ET+caJ2zbhKKHvuv
TLSH
T1AEF633C80334DECE96ABDEB70F620D914197D07E44AF188B5ED597440091B8FAB9E93B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
384	powershell.exe
4764	powershell.exe
4732	powershell.exe
3792	powershell.exe
4732	powershell.exe
3792	powershell.exe
384	powershell.exe
4764	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
3452	Loader.exe
2092	Loader.exe
3328	Loader.exe
1940	Loader.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2068	chrome.exe
5472	msedge.exe
5508	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317893412931234"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
384	powershell.exe
384	powershell.exe
4764	powershell.exe
4764	powershell.exe
384	powershell.exe
4764	powershell.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
4732	powershell.exe
4732	powershell.exe
4732	powershell.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3792	powershell.exe
3792	powershell.exe
3792	powershell.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
5564	chrome.exe
5564	chrome.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
5196	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
1244	7zG.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe
3884	taskmgr.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 3684	4948	chrome.exe	87
PID 4948 wrote to memory of 4664	4948	chrome.exe	88
PID 4948 wrote to memory of 4664	4948	chrome.exe	88
PID 4948 wrote to memory of 2068	4948	chrome.exe	89
PID 4948 wrote to memory of 5084	4948	chrome.exe	91
PID 4948 wrote to memory of 5084	4948	chrome.exe	91
PID 4948 wrote to memory of 4780	4948	chrome.exe	92
PID 4948 wrote to memory of 1532	4948	chrome.exe	93
PID 4948 wrote to memory of 4780	4948	chrome.exe	92
PID 4948 wrote to memory of 1532	4948	chrome.exe	93
PID 4948 wrote to memory of 3808	4948	chrome.exe	94
PID 4948 wrote to memory of 3808	4948	chrome.exe	94
PID 4948 wrote to memory of 1168	4948	chrome.exe	95
PID 4948 wrote to memory of 1168	4948	chrome.exe	95
PID 4948 wrote to memory of 4296	4948	chrome.exe	96
PID 4948 wrote to memory of 4296	4948	chrome.exe	96
PID 4948 wrote to memory of 3480	4948	chrome.exe	97
PID 4948 wrote to memory of 3480	4948	chrome.exe	97
PID 4948 wrote to memory of 4260	4948	chrome.exe	98
PID 4948 wrote to memory of 1648	4948	chrome.exe	100
PID 4948 wrote to memory of 1648	4948	chrome.exe	100
PID 4948 wrote to memory of 4440	4948	chrome.exe	102
PID 4948 wrote to memory of 4440	4948	chrome.exe	102
PID 4948 wrote to memory of 2308	4948	chrome.exe	104
PID 4948 wrote to memory of 3176	4948	chrome.exe	105
PID 4948 wrote to memory of 1456	4948	chrome.exe	106
PID 4948 wrote to memory of 2668	4948	chrome.exe	107
PID 2092 wrote to memory of 384	2092	Loader.exe	121
PID 3452 wrote to memory of 4764	3452	Loader.exe	122
PID 3452 wrote to memory of 1860	3452	Loader.exe	123
PID 2092 wrote to memory of 1996	2092	Loader.exe	124
PID 3328 wrote to memory of 4732	3328	Loader.exe	132
PID 3328 wrote to memory of 1760	3328	Loader.exe	135
PID 1940 wrote to memory of 3792	1940	Loader.exe	136
PID 1940 wrote to memory of 5044	1940	Loader.exe	137
PID 5164 wrote to memory of 5196	5164	msedge.exe	144
PID 5196 wrote to memory of 5240	5196	msedge.exe	145
PID 5196 wrote to memory of 5472	5196	msedge.exe	146
PID 5196 wrote to memory of 5480	5196	msedge.exe	147
PID 5196 wrote to memory of 5480	5196	msedge.exe	147
PID 5196 wrote to memory of 5480	5196	msedge.exe	147
PID 5196 wrote to memory of 5508	5196	msedge.exe	148
PID 5196 wrote to memory of 5508	5196	msedge.exe	148
PID 5196 wrote to memory of 5532	5196	msedge.exe	149
PID 5196 wrote to memory of 5532	5196	msedge.exe	149
PID 5196 wrote to memory of 5532	5196	msedge.exe	149
PID 4948 wrote to memory of 5564	4948	chrome.exe	151
PID 5484 wrote to memory of 5832	5484	msedge.exe	155
PID 5484 wrote to memory of 5508	5484	msedge.exe	156
PID 5484 wrote to memory of 5312	5484	msedge.exe	157
PID 5484 wrote to memory of 5312	5484	msedge.exe	157
PID 5484 wrote to memory of 5312	5484	msedge.exe	157
PID 5484 wrote to memory of 5496	5484	msedge.exe	158
PID 5484 wrote to memory of 5496	5484	msedge.exe	158

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Btc-Tools.zip
1⤵
PID:536

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xac,0x124,0x7ffe9b14c728,0x7ffe9b14c734,0x7ffe9b14c740
  2⤵
  PID:3684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,5369635699009884864,6824044504024152610,262144 --field-trial-handle=1808,i,2917406938478278743,15947037141722408995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1804 /prefetch:2
  2⤵
  PID:4664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2236,i,5586608046359572495,2060370310235253086,524288 --field-trial-handle=1808,i,2917406938478278743,15947037141722408995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,16263288021703207375,17720477903595260092,524288 --field-trial-handle=1808,i,2917406938478278743,15947037141722408995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3188,i,1765931856624311347,14112543919179996071,2097152 --field-trial-handle=1808,i,2917406938478278743,15947037141722408995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,8724035974884527570,3890115718943054070,2097152 --field-trial-handle=1808,i,2917406938478278743,15947037141722408995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4456,i,3028243745585556912,9962195479807953861,2097152 --field-trial-handle=1808,i,2917406938478278743,15947037141722408995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4460 /prefetch:2
  2⤵
  PID:3808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4740,i,14004118154084624084,2171167848279746934,2097152 --field-trial-handle=1808,i,2917406938478278743,15947037141722408995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4904,i,18153746843823637508,6854429965301440914,524288 --field-trial-handle=1808,i,2917406938478278743,15947037141722408995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4940 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5068,i,12951718256080266200,16868722764397787184,524288 --field-trial-handle=1808,i,2917406938478278743,15947037141722408995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5564,i,15016929615542313384,14740066040565271484,524288 --field-trial-handle=1808,i,2917406938478278743,15947037141722408995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5664,i,10726435407077563155,15514044837425835436,2097152 --field-trial-handle=1808,i,2917406938478278743,15947037141722408995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3428,i,1601053882864539550,5552833536838152017,2097152 --field-trial-handle=1808,i,2917406938478278743,15947037141722408995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3960,i,18146895381712415815,8351075812944177977,524288 --field-trial-handle=1808,i,2917406938478278743,15947037141722408995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3208,i,7270909309539070714,16413182442216021430,524288 --field-trial-handle=1808,i,2917406938478278743,15947037141722408995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:3176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4732,i,4606074030493444518,16516660743037622701,524288 --field-trial-handle=1808,i,2917406938478278743,15947037141722408995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6032,i,1823830347884223125,8664531909553456887,524288 --field-trial-handle=1808,i,2917406938478278743,15947037141722408995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:2668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4468,i,17048921015093131260,7291952625393445684,262144 --field-trial-handle=1808,i,2917406938478278743,15947037141722408995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3280 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5564

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4352

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5024

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Btc-Tools\" -ad -an -ai#7zMap26390:80:7zEvent25080
1⤵
- Suspicious use of FindShellTrayWindow
PID:1244

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Btc-Tools\OPEN SETUP.txt
1⤵
PID:1628

C:\Users\Admin\Downloads\Btc-Tools\Loader.exe
"C:\Users\Admin\Downloads\Btc-Tools\Loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4764
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:1860

C:\Users\Admin\Downloads\Btc-Tools\Loader.exe
"C:\Users\Admin\Downloads\Btc-Tools\Loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:384
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:1996

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3884

C:\Users\Admin\Downloads\Btc-Tools\Loader.exe
"C:\Users\Admin\Downloads\Btc-Tools\Loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4732
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:1760

C:\Users\Admin\Downloads\Btc-Tools\Loader.exe
"C:\Users\Admin\Downloads\Btc-Tools\Loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3792
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:5044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault5c0f5ed3he8adh43b5h9d20h4fef52876e8b
1⤵
- Suspicious use of WriteProcessMemory
PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault5c0f5ed3he8adh43b5h9d20h4fef52876e8b --edge-skip-compat-layer-relaunch
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ffe836ac188,0x7ffe836ac194,0x7ffe836ac1a0
    3⤵
    PID:5240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,3882560281437999681,2420999625138859111,524288 --field-trial-handle=2244,i,8546735284294534714,16702545241945106648,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,4025744256083624356,8955672948970890672,262144 --field-trial-handle=2244,i,8546735284294534714,16702545241945106648,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
    3⤵
    PID:5480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,17308544821846042536,8338558300999551916,524288 --field-trial-handle=2244,i,8546735284294534714,16702545241945106648,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:8
    3⤵
    PID:5508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3324,i,15317446123507580600,14178371539520105290,2097152 --field-trial-handle=2244,i,8546735284294534714,16702545241945106648,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:2
    3⤵
    PID:5532

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault596b7594hdd69h4e16h925bh0431ba8afed8
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x254,0x258,0x25c,0x250,0x27c,0x7ffe836ac188,0x7ffe836ac194,0x7ffe836ac1a0
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2020,i,11890922052416682910,9587822944685103933,524288 --field-trial-handle=1840,i,14230287440121355687,18144627268230459813,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,14057299822375526609,132090211544887282,262144 --field-trial-handle=1840,i,14230287440121355687,18144627268230459813,262144 --variations-seed-version --mojo-platform-channel-handle=1836 /prefetch:2
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2644,i,5822745958353990710,6143508110623572807,524288 --field-trial-handle=1840,i,14230287440121355687,18144627268230459813,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:5496

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2bf843e23933da97317e17dcd1c75b06eaf2760bd94b8c01084d5f6f5fd1373b
MD5 a78c477dc0bd160c1a62e77b9f087b86
SHA1 7dc3b9c2cb4bccb42506ebb128f4a19ed173b01c
SHA512 6a16869b27290fb395e23a542648bb696302c921ab99af56926e04501e53ededdd8e330225dad5d6af1ca73dc6919f8c8207e763a923d2b2985a05a18cbf6f10
TLSH
T1F1E0ABA9C920AD2B0CFC032964080707E750231B2B41855B3E3CC20D8FB86364486C1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 3aaa7ed0179ddd260dc817682ea03159fb7d184dff13b8d801b5fdcb01e42475
MD5 24841ed0463b95f7e84d3e0fba67d4a5
SHA1 e63594fc86818298a3e463b57918c643c19f2934
SHA512 8534dd1968dba12cbc09064ac211073c93f8be7a1f5b1902553b3cd1633c3682847307fc0db440a148423059dc50ebce40ffaadfd9ebc415246edd2161872be4
TLSH
T160512048289E485DCB6ADEF6AFE135677A315D8C48E3AEC61204E2361D63F73610205B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c8213e0dc5ec1e08441aa651b554967ad8a18de5bc8fd0c75ef405e6f6b1381f
MD5 e56d73356292eca0458a34bb06629d8d
SHA1 8b637a7a8876cbb09832e793e60ff888e521e477
SHA512 e3641f47a3ff7535bcde33e4aeff820c7d5b92620952a9d2f3f326c0142cb22b9f912225f37736ab4c38bc5a3da0383e53d4b8998a87cb188eb211a7d8a1312a
TLSH
T1C14147B7C6D8CA6D890156E4A6152E2FCE690E24532C3C5788D8BF4F53E2971E20158F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 3e9f80512c28b22307b6cf26641817734eafcbe5e47eb3e25bf188a3ad8bb8bc
MD5 8fba9c3159dbfc41ec218cbbb71f5ad3
SHA1 0bb647248f25c032e1ad31f2e84d321de8f976e2
SHA512 70389aa1fa0169d084c912ea873144f1a72a644bb690b749a68d0a3260f7fedff8424677f928f66ea385aaf904a9b9524627d7b64b09c4af9b06f498ba740211
SSDEEP 192:DmqqJpNmV8aIat3LdsgfP56NPLaPqDmmmlmDmraHmgmb:DmqqJpNmV8aIat3LdsgfP56NzaSDmmmV
TLSH
T1B2D19CF7C3E5892D890256F4AB156F2FCE290A24431C3D6688D8BE1B93E2871E15175F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 04ff7863faac1199953171acd6050dfbffb6bb21200f67316a640e68e2f67386
MD5 12324d9167102bf36e7e022cd8fd39f2
SHA1 72d943b855099788119f102e9be11933bc3621b0
SHA512 f77c4a7d690dd22205b77563f88208a82f025b31c62335d81a5ab916f12f8c6ddbaf95f5cb75b9609fe116227d1b5453949df7d2615ceb426a7e78d4c3691404
SSDEEP 192:DmqqJpNmV8aIV3LdsgfP56NPLaPqDmmmlmDmr0mgmwCiT:DmqqJpNmV8aIV3LdsgfP56NzaSDmmmlc
TLSH
T12CE1ACF7C3E4892D890256F4AB156F2FCE290A24431C3D66C8D8BE1B93E2871E25175F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0813346d27ed464329b71d7d64c94c34ff0f53a193e00e0c8b5c923e89a91fb6
MD5 0735a956fdbf1a797ad1adb7e8385021
SHA1 0bae9bad91633f351ba80430e937a0b1ca8b48ae
SHA512 86be9bf19d45058b380e27d732c3fb7ae9f9334852a653d41cc8f9c4fa605b3c340de5ad57f7c6751257caa28604d093dcf681ebf6c3a3d1813004e2a7dca950
SSDEEP 192:/RIII/3zWCfv72ympAPRp2/95Hsb+WNncz0EKJM4kwSVyIsnAUgtaJ:/RIIID3QUXo7wc0jJfy8
TLSH
T1D442C72EBE10657B9CDBD21AF9227753E7F5107625941E84EAFC8A2C14EB5CC321702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5e7dbeefe8e721cf9f946a60f175e5fe8c812f8ec9dfc85ebafd7026ecae09d9
MD5 99656e078c8408e160975c66884b665a
SHA1 cbd7efc25180564fa5796d5eabe6ddf87892ad13
SHA512 0ebab23c1c3a89093955622ed93ba334aa03904eb738ac9776bab014f9355240560a0e5e1215ce801eaa2227e02a631de8bdfb13e75ea271169f122b9cd63f9f
SSDEEP 192:/RIgcBzI/3zWitv72ympAPRp2UlFIE95Hsb+WNm+cz4Be23KJM4kwSVyIsnAUgtK:/RIgmzIPNQUX17w6n26Jfy8
TLSH
T1A552D82FB920297B9CDBD21AF9127717E7F1106625945E84EAFC8A2C14EB5CC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 10afcbb7f56873c01ea7ff083c11569d98f321ead1b922a8d2720aa68a3253cf
MD5 8c2f6257c342a4cacf5eed6334060325
SHA1 fb42e8d262282d627d1ab9883da9693ca2419b91
SHA512 d0f0583df69960d4c1e03569878d2b942d8f6a1734d44bea01dbe9adcdd22d6984a53a006eb2298d3ff639a810884edcb196f2c7657b24a17b0e46607f19ccf1
SSDEEP 192:/RIgcBzI/3zWi9v72ympAPRp2UlFIE95Hsb+WNm+cz4Be2LKJM4kwMVyIsnAUgrK:/RIgmzIP9QUX17w6n2+JfIe
TLSH
T14752E92FB920297B9CDBD21AF9127717E7F1206625945E84EAFC8A2C14EB5CC3217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 6b23fb7c4427952095ecec54fb6cecd106ed4e67c2881f55961b0c36fdf650e2
MD5 340c2ac90f4597eba6cc749d5caa84d2
SHA1 6888b05bb21d757fc9320298ce6fef8d22dc8f62
SHA512 1b052d325133e523c9d1fd602dd9ed838de2811ab7e356b34b8ffb1cc7d46217c6065ac9ff259b5b3f22bf55300e3ebf4fe2e08ec16c6174072027f87a9f1ade
SSDEEP 192:/RIgcBzIC0qiMWi9v72ympUPRpaUlFIE95Hsb+WNm+cz4Be2fKJM4kw4VyIsnAUp:/RIgmzIG9QAXJ7w6n2CJf8e
TLSH
T10D62E82FB910297B9DDBD21AF9127B17E7F1206225945E84EEFC8A2C14E75CC321B067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
TLSH
T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 53f3b931798ccacd269cdcb4b7f2bab8887177d7dd789b6366e2b35744012fa4
MD5 ee27ffbee707eb7d43a20671d3a59b87
SHA1 a46d85bf7ead949bbac496ac55dd36bf72fba186
SHA512 b37af1366e95a9a9d17708e9b36fa853a5e76b8caa2d3fdbdb09d33708c2380a3046d213e49009a8a9bf76302b76b341e017e9e2fd796883f97b563474093e82
TLSH
T141B01280C0019201C40203F41247288C7278DF10BB0A1F4653E46D33A8251609414054
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586472.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe586472.TMP
Size 96B
SHA256 c45cb5a15e425dba01029fa811618585e4dd6d784ea968975abebf5e10d2cf13
MD5 2eb1349b77d3b3b4e3dd4e46afd3b73b
SHA1 be1234466250559c5f9ffe3efd2e161e1a386a01
SHA512 b2a37fd4231603f4b77d260da869279d2d9fa8a4319135de37d2831d0f4b3d40cbec7d24fb140dd8111e32d43fa9bcc5b25647dbdc19156d7105e5a659cb2173
TLSH
T19EB02200C082B302C00203B038C0A0E833F0EF30C303E20282E00A23CC222300830C20
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 b327c0db2bb764b25d8f1329b9a5e31154b261932ed0f8ccc9762bb799cab7ba
MD5 f254e0fa95d20326801e27eab74be687
SHA1 01a127f4c4037e079b9b1fc2fe5ac5b4da8a0cf0
SHA512 e9d25d957bee57eacc666671254a48d3ab6f476c7e61e37455ccb5096e107bfe81954381ad2e53026745907118452ec410f4e23d50d646e8170b113a13f5b7f2
TLSH
T1D2B002E54210C46FE25B37F8E0C3844537B15C20134A454644ED605CD616346C662416
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 caaad7239969f69ff55b3a62dd3ef132d1bc2c2a69ab30fc9080d8aa31419ef8
MD5 9afd55bb4e4743a290b97c7ad958c4ca
SHA1 2d8c9cd249c281937e82287f7fb55da9751a66a1
SHA512 81d4e53dfc38bfe65bec20a50003a586c3ca851557fa799a9ea846db8224323e3133e4136550a3b50555db380f003b2c8ded86e111020378f6e9d67d0213149a
SSDEEP 6144:E8ERh8xEu/CSlHbtVogjDIfyqZ/ZLW3ExOH:EphsC+LogjDIqqZ/piQu
TLSH
T1B93412775FE51F33DF87CF74BA535BAB15BA84C0C4244309AE78A2DB24939D5648281C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 e3cc4d76ee9e5e10dc49ccb7f6d3154fc1fe116b0cc799694709b97daacb05ce
MD5 880182e2aab6a787d37d72e1736800a4
SHA1 2888fc12f58fe98d668568dad059a23375dd1168
SHA512 174952bd634a6e126bd4d6b6fe0e280eabd8e4a1217d1b61d823c5d583318c3b0f646848ac8012781e8ec81b292a3396fea175fdec1815d4450a352985dd77a8
SSDEEP 1536:TyQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:7qfd7NtZL8cHQRZEQ6Spsk
TLSH
T187C30237EBC21F339D96CB60B9530FD697B644A59034D301AA6D77BF6C83491684289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 c7f1d7fad78fc5d6d7e2699030489a361a7eb64faa227e5067e7d77743e99284
MD5 fc44d349c4357fd29cc503b80738fc5d
SHA1 cd490fd413ce93f733b396e27a1c80af2e8eea6c
SHA512 71f4436ff4ebcbe8beea6a5cc0633ec98e06dc6b9e9c1172c228f6b0c4656f65369817f0ff72d529d602bc15e0b47842017139a2b1546145a1deb8808bbb796f
SSDEEP 6144:N8ERh8xEu/CSlHbtVogjDIfyqZ/ZLW3ExOH:NphsC+LogjDIqqZ/piQu
TLSH
T10C3412735FE51F33DF87CF74BA535BAB15BA84C0C4244309AE78A2DB24939D5648281C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 acc61c3585d5f218a58e60825d85e76da3481507493fa0194146bd4bf0e5aaf0
MD5 2c2b466a0ba0a5d35aac223112951ee0
SHA1 7a9ec4e74a797f1b17444c264745964c82c1bfb4
SHA512 60cd33be2fc8e43cbb3f292c476c0e6ee0cb3eccfd629ed05d07dd569ad0aa75db2c16dd67314c743b0f551479f46a86913776e5192fc13f77afd376f2cb2958
SSDEEP 6144:QDERh8xEu/CSlHbtVogjDIfyqZ/ZLW3ExOH:VhsC+LogjDIqqZ/piQu
TLSH
T1413412775FE51F33DF87CF24B6436AA619FA86C0C424470CBE78B2DB6493995988281C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 648ba536c0fcaea23a9927aac72ec05d15aea4ce1119d785b73aef7ffc9c48ec
MD5 8cc6cbd10d655936c5c613d4db3edd6f
SHA1 13bd131d06b724c2ebcb5ac991706ed421231523
SHA512 5111c6e594d15a28f4b75ae82f4baa79337ca3f7cdebad77cf3f8af05ca4801a1b15c9f534510d240da0be88f9730430bd522d9321c1a3c776882491a7932650
TLSH
T19B612D3A428FC160F3A0C672E5D11D0E3A7F4097474F9EA5D3B339FC952A7A595A3448
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 5fba62eeb0ca9ad86d6c8f3055f0cbf767edfa4f0bed22505669bef0b3851ac8
MD5 20e760a5db6bc5a80d2ad94b4b7b27ba
SHA1 dacb445fa38cd7290a69381ab2364eed93fd0a3c
SHA512 141d83d97f5f8ccb3afc7846c5f9ce602dfeeaf999fa106331a5f7554f30121eee27bf47e15c6a92a1e3bbc41308a4d2ab645f3387f8cce90ac7cb4fb35f9a95
TLSH
T110E0D8BC68C6C11EAE6078D761386728D2943D9BE68AED4B170C88C07A43002B242547
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 627B
SHA256 409d4c47e940688527d730b996e8991e010988c7671565467ed69d640d0947f3
MD5 9d7435ea49a80fdd66e4915f513017f9
SHA1 469f6c6e4b19b85cc1be497812b2f20864f4ff2c
SHA512 0561cd632d4219aef4686de40ec092921384ca89755d354801e0eaec8645a8630a180807af518ac8fcf01f71eb3d10faa9ce1e62c7a7226a274975bdcb7eeb4c
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 e31052c74949bc3f2cd4a8e0c440cbbd4bb3690a7de78459ad929c6737f70c99
MD5 12b53cf4e6ade3127200858e72c23b2e
SHA1 bcd5265f62a782837d3b818f51464d117e7de029
SHA512 f7ac45e3cf27ec865c202e0230e2c57001843f5a499cb039a4576f4c2a08c1ec98cb1be39e65d7e457f640264cfb6e4009bd51330a233a40f4a73f81045bb4bf
TLSH
T101E0262814C8C2BDFC56FDD7926C732CD7E2381FB288B90B1B0C8C807142242A2F6281
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 139c1847872ca4073a6246cf41a3b5feb7ef2596d9ff655761527bbe4b211707
MD5 19483d2cd7652219175d316e1586dd33
SHA1 410176af5126c28776ec83e039b96876fd85fdb8
SHA512 280164956b2c82b830feee3044e200797e5f9c5264b4f99e0a55699a18ac5241832e6c2ea6896c2dfdf0fdfc3cdf672e8ffa55ac85e70c70b82abbca6b72719f
TLSH
T1F9E0D87455DEC15EAA06648B921C7B08C7B0381BF688EB0E2B0C98C0B042144A3C11C5
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 020b0421f7d5050e34533af0f6a413e0eb4949f11d049b3093d553d2a3d3e955
MD5 2c8ec7bee91879645ebabc4bfea629ab
SHA1 9b31c4978f0dc8b4c8ce0a2298ec4f6e59626920
SHA512 9edf259eeb12242c65c88d25beb2d923b4b60f816d11fc96dc304abb6225320f1b67fba9634ca9241f9dfa8fe905957739fe400fbbc3b625d85290986fd4719a
SSDEEP 96:sa2Y6TiEDWNsEKjscnb9SPCzhdHW+i046W6hfuH9EOx+WVoMfm+uecpYQjHU6Yjr:sxrTuNyjs7PubrpMHW6+WNGYLYqxhgOJ
TLSH
T15CF1C7566E28687B4CCBE11DFA267B53E2F5102265C51A48EBFCDA1C049B6CD230B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 609d832639ed17553e3ed8d99a89a0a2529150ced979ede06c46d2542d511cb9
MD5 33881df3bb669433fc7d62cec0b55066
SHA1 8db10a5500f870b5168ab978198a3e8e804a5435
SHA512 76989f63b8496e4576a315f1a70fd25fb76b8b03216ecc55cdb6332fea7d45bcf32daaed566e5baea5330e8436d5efdab1e37c14e1c3423ef1fdbe286b807657
SSDEEP 192:sxrTuNyjsFPubrpMHW6+WNGYLY8ixhgOJ:sxHuUsFiMHbG2Xa
TLSH
T1FEF1C7566E28697B4CCBE11DFA267B53E2F5102275C15A48EAFCDA1C049B6CD230B81F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 26KB
SHA256 011a1d66ac2ae7e160104971f945912a38589d4ea15a6097cd6e1e0bcfa36be3
MD5 728e6f2ac5cfce3fd4cff2458546809f
SHA1 a7478e1347c3049003bb2e159c9783c4ff0a99f3
SHA512 be5e2503f5cad3054b0b36c7b249ec83727351a096ba37d52a5850876645222982d9eade829199937566232d718079a7491d4d1ea631357b11f030e1a30fe37e
SSDEEP 768:8ieZu3MWvg0Go8F1+UoAYDCx9Tuqh0VfUC9xbog/OVueLlPZ4VnrozG:8ieZu3MWvg0Gou1jajeLZmV06
TLSH
T1DEC2DA3F744CCA7E4FC00A9DED5A6F973E9802C79A684D4047FA994C02C77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 37e1ed4887fe43ff42ee46ba0870f74dbbe0b544d05b4cb35f797c5690b0fa42
MD5 2386764909dda83db0b72c351a39f7da
SHA1 ec5970186dc24774c9b7eb820100d78424a4b151
SHA512 4be863221e79be33b716d6c50c5c2405cbd7c1f0f89d47c6e8bae158a8d81847a055817f91fec068e403d980fe476091585819c55638906de9ab2a8433d95844
TLSH
T150E0D86455C5C5BDB957A8C3116DD318D2E8B82FE6C8B9091F08CC4061835057272141
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 5b08a1e326adfe0bf370cb7476945cac1a8b6400939dc1d3aceddee74ef28eef
MD5 04f399806a1e3db9fa0cba5ff9659dc5
SHA1 ec55625251a4438682b85bc7ca31bf7148de4141
SHA512 b3c0df45a344bcf24182d16eb0830e6484d8d59ec9cd9a83564776564bb4d91b68992dd6047d1f2482f771911324f37fe86b3aacca2150b544890591e438590e
TLSH
T1C8E0D87465CAC66EB58B64DB529BE308D2F2792BEAC9E9192B0C9880624714472B3180
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 b48fcdd935a63dfb7fce4444ba420e490eb48af0aa0a369ffe8b3ee49743a260
MD5 b51f05b986ed1949c96477a79b47ac59
SHA1 ab68b3773873edc0867ed4ee7532b299b9ee75b0
SHA512 c8e671c4673fbe1dd167c74c968771aa685c13903e455eddf04b1c951c6d8488d71f17b46e11a1fcfe7b49d7c90c37b37dc0839e1b8909db4dc300bb0c52177a
TLSH
T13FE026B455CAC67DE982A4D742FBA71DD2F07D2FABC9FA0E570C4880A143109B2FB180
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 b7e4f4519fa32020cf9a561c15e5195332e8b907522d7dd375440bbcbfef3b1c
MD5 9529916bf78ea652f12aa2440efdff3e
SHA1 3c910e05aa0c1af5c21f7b52d2cc4f4e1820f85c
SHA512 bb86e4f5c08caf5e8325053ee0e3e9a2d635dd2c2251f57da0f4b8a38bbc830e0f3ef9c8a08c5b8928e788c165368314bb3acbbaf79b716472232ae2c81745db
TLSH
T11FE0D82464C4C2EEBC56B5CB2118631CD3D5381FFA84690F1F088844704210172A5142
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 297b7ec98ee1b6952cb9948eb30f7e4f10f53c6f9ceb04b6939fe4a287c59174
MD5 e8e019079aee9fce09c0d2ec92bdd0b4
SHA1 54c46931aedb6b875813ae1d2e3a616e6380425e
SHA512 e540151a7453de93c642b28ddaaee6ff1c3b047f9bde9054ed07a931f8a936e84f969ae9b162dc23308d7ff01fd35b8fb12b3b96dccee12cea3293d428d3d0c5
TLSH
T1EE212856F334C11AD24A4B3E103EAB190338D4169FFCFD0F11B520242EB6E111E4B2E6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 3ac05a41c98d01d510531f4ae45733a684b55fdd83e241146b35a69efcf8e056
MD5 e22fc01fbffdf64bf3ba253935ee5d3d
SHA1 c4ba1a27e49c51499813fe44545dbfacb7f844be
SHA512 ee913440c16446cb7534ad61416dc5b4e892460cdae95df67eaa60c9e9c4e5d011b2e493391b8d84f61c3c0e23fb1f9183b51f71cc92a2940442e3c8e566cb1e
TLSH
T184E0D82474C4C2DFF95164C30168935CD3E53C1BFA94AE0A1F0888445153142726B141
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1c8c8c518e60ef008337dcc38fe639c768f4db78b47e453802535c2733c31a45
MD5 2c0d7ded1581c894f375c2b527ba5013
SHA1 5231fbb8671cc298241a7e392d28c9d545ef9d1e
SHA512 6e2dba90506e4c12a990ac27b12b97ff3d14292a64c35dc61518db78e5e6a1fb44191cd4776c09664b7713a2e595ff0f7accd9f105d6ca87d1b006d46b3b44ee
SSDEEP 192:sWONgQ61bsWQmiUy6d6isMGX5Obd+j2jzoryXmOXY7ijJly5qLqU6:bONz6FtRGX5od+W8yLXHlWU6
TLSH
T17512F835A469FC675DD2B549B4873263AFE92077EE44AF80D6E81B2C00C769C271BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 b54c3ac818dfd055a2ed54ab5f1bbf1346b43f74304053726ace3091bf093a28
MD5 0f43a43e182a3c40bb3dfcc0a8438df5
SHA1 973a57a638749c187a79c1ce0e2a3691210f9614
SHA512 17b09d0027ad80939877ac2ae993b083765061eef72f0d2734434416e6f7f169b746c9ec8419880ee82ac476151ac0711f4ba4923dfc0aeb7dcaa26b53adf186
SSDEEP 192:z0WsNghV1tAbsWQmiUy6c6RsMzX5Obd+j2jzoryXmOXY7ijQXk5qLqUO:zDsN0V7U7RzX5od+W8yLXi0UO
TLSH
T19B12F735A468EC678DE2B549B48B3663AFE92077DA446F84D6E81B1C00C769C271BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 eed946ac63d2682d9152693ab01ff5bd92420f3e8653b95de0715b60074b99a9
MD5 e17b5a1de7ef284aa34a8a3b4ac67383
SHA1 631348c3a573eee308635d05ef8bbbd3891a79f4
SHA512 6ea18b08a2d49a11c1cad99c0d87f95f6af05da41ca530b88953840db9670b7c3ae4744b4b3ad98ed29d57ff0e52c2c986acdea39271cab61091484d84a5c274
SSDEEP 192:z0WsNghV1tAbsWQmiUy6t6RsMzX5Obd+j2jzoryXmOXY7ijQXk5qLqUO:zDsN0V7UmRzX5od+W8yLXi0UO
TLSH
T14C12F835A468EC678DE2B549B48B3663AFE92077DA446F84D6E81F1C00C769C271BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 654ea57f7686403038e461170bbf72c4c06e3f46023af479ac7cda62a657c453
MD5 b919257d6d22a5529f95cadcee721147
SHA1 eb42a97fb600ee5f531459f6d6764947a9159274
SHA512 1ed8eb6dfcb30a48cf2c82168573d9d3bb81550f0baa51590b3962ed98cf8abedd5195327c2049328cdddc77d1d18ab2cf8a16cfcb36b04a24d18f61c73edff5
SSDEEP 192:yON861VWQmiUy6V6igGX5Obd+j2jzoryXm0/aln3mDU6:yON86WVgGX5od+W8yUl2DU6
TLSH
T18002D935A8687CAB8EF2BE49B48737135FA42067EA556F84D6E81B1C00D765C2307C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 7f783100ec3c17f370a0bcff80d917ac4568bfd185916a0c5510c06a52d300b4
MD5 c6090b4e5f84144a75b61692f3185272
SHA1 97b8f7d0f1046dcb88f7218bd895a0bd50b4cf5c
SHA512 a5c10263736ebc0f2b726b37f4067932e60a4357f8fe66993c70da2b89f476a828b0e746765cca1fe01180b84fc65dcdb028ece6eb6e5e4eb6eb6bfef65efb00
SSDEEP 192:z0WsNmCV1tAbsWQmiUy636RsMzX5Obd+j2jzoryXmOXY7i6hI5qkMsUO:zDsNmCV7UYRzX5od+W8yLXQzsUO
TLSH
T18B12EA35A468BCA79EE2BD59B44B36135FE9116BD6446F80DAD81F2C00C769C2317C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 5cd2c4d9f13524923046198c92213691539407e04fa520cdae9eade1bad3d91d
MD5 e9e365607374115b92e4abe4b9628101
SHA1 d5054ea9b22317dca83801eb3586017bfcc0e2a8
SHA512 a84d65ed53e43883e5ecb7848fbd48f5305a63e6975e6af480cf85532879720061106be54f2a5888ebc3569f7123081a0e6eb48ccb8d7dba3e1da1c8a3c50401
TLSH
T151A012078473800AE4144051C49C024114A4804A0219D0015060932314A40CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 a9c2268a32d4b53421c510878be105729a41bb03d01622456369d322e3e35c5e
MD5 ffaa33c7940b1713a06a430414e2fed0
SHA1 b1ade7d02b641ac9c382fad82cb1d31362fafb91
SHA512 61913fe437de06bae8a99a02f3ff35f483d06ddd9593c16f9bb652dde94930ff47f1a07765b2d78ac5108abb65837a66444dc7ff9691ba9c9ceaf85f0ae73f4d
TLSH
T17C112223F38C8920CC96163A509DAC5172B686CB81AEDF9F7FC0D210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 5d3a1ba917023550fb2d91c0d320339f855acfd341c3d675f186b34d95eb35a8
MD5 e50c0160c1a8361971c881e2f80958a7
SHA1 5ab03ab987400d7591a787b06bbcd752a88e7f5e
SHA512 749778c0f4d5ed1b03a0288b3a5960b27478ca105e00f1e480b272c9820c3bef56441e3eab5aa77fb53742a9acea09c3d5ffa55378453658427f8fc49898b003
TLSH
T157112633F38C8960CC861639509DAC5172BA86CB819EDE9F7FC0C210E1BF684CB61194
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_sek2yn2c.pci.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sek2yn2c.pci.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Btc-Tools.zip.crdownload

Path C:\Users\Admin\Downloads\Btc-Tools.zip.crdownload
Size 15.9MB
SHA256 47dd5cea0d653b63dd804d4038a967acadf628e57ba9c0b4ba37856d448348f2
MD5 a7c8d9364b29015f1afd057b7a311fd5
SHA1 88560cebc6e5ae5d547e432f9a9e5044e724bda4
SHA512 f38b30d6d92542dc0057594a8b2ad8dbdcb5f1a72f12823daf146a64c6e907af0baca8e3e7fac4a2d76808c4791635f29dcb9b242881b0419ce1a26c6d45b2d3
SSDEEP 393216:8CirfmhmQ1vyr91YFQATqqgTTc3ET+caJcx3a5cbVDh5xvs4pLWY48uv:8D6npC9KjqLTA3ET+caJ2zbhKKHvuv
TLSH
T1AEF633C80334DECE96ABDEB70F620D914197D07E44AF188B5ED597440091B8FAB9E93B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Loader.exe

Path C:\Users\Admin\Downloads\Btc-Tools\Loader.exe
Size 48.7MB
SHA256 29e33bb4d148ae0341e9f7ea5ae40548172d3a66413d6f5cf78f461e8151d24e
MD5 1273533423237d5e560b8399cbc25c06
SHA1 9a0a2edfe3ec73bf2053bea07731dfe7588ac432
SHA512 73f35cd410cee27968ca2b6396d75a23ce95066df8b10d3b0509cae2cd0a7f9703e3e878163b5f7957a8b7a43a75009eadbfb800f12b2967b390053af21b4a2c
SSDEEP 196608:Yg2gzmnzYgF8YFUi53gC+TVrJ6+5NHu8ge0oAUfMJXw9if:9VzmnDH53gC26+Hce0eH9if
TLSH
T159B7D80B2E8282E0D57D4C3488E6966ABB313C0DDF2416CB2955B6187F7B6E452BF7D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OPEN SETUP.txt

Path C:\Users\Admin\Downloads\Btc-Tools\OPEN SETUP.txt
Size 84B
SHA256 a411ac2bc9ff9a7139df717d7f0fe930eca07c914242799c81cd78f8ec2632eb
MD5 2d4d05bef4b22e51eea9cb0015cb62a3
SHA1 569cd1e4926f0cb0fb714b61689093e9f2b18377
SHA512 ed484e4d2c78d74af3938fa2484fc68155d4cd02b2cb0c955e765bf0bb803f7b1cdc2e57b73cb4a04df61869d30a1c93b0a71ee3ae7ced5ba8958c40b523f34f
TLSH
T14EA0120F030871B046246134540EF0888785140011419840441484203939A8256601D9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/384-387-0x000001F907DD0000-0x000001F907DF2000-memory.dmp

Download

memory/3884-415-0x000002211B900000-0x000002211B901000-memory.dmp

Download

memory/3884-409-0x000002211B900000-0x000002211B901000-memory.dmp

Download

memory/3884-407-0x000002211B900000-0x000002211B901000-memory.dmp

Download

memory/3884-408-0x000002211B900000-0x000002211B901000-memory.dmp

Download

memory/3884-419-0x000002211B900000-0x000002211B901000-memory.dmp

Download

memory/3884-418-0x000002211B900000-0x000002211B901000-memory.dmp

Download

memory/3884-417-0x000002211B900000-0x000002211B901000-memory.dmp

Download

memory/3884-416-0x000002211B900000-0x000002211B901000-memory.dmp

Download

memory/3884-414-0x000002211B900000-0x000002211B901000-memory.dmp

Download

memory/3884-413-0x000002211B900000-0x000002211B901000-memory.dmp

Download