b105e48925c37e9dec7994f91b79c516edbec08c5c95c84e4765f13184a684da

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 23:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ps5-dump-forge-0.3.1-windows-x86-64/PS5 Dump Forge.exe
Size 15.4MB
Sample261027-3va2jaws7p
SHA256 b105e48925c37e9dec7994f91b79c516edbec08c5c95c84e4765f13184a684da
MD5 32dc7e19ba7ba71069e4acf2d9169870
SHA1 63d87597d1020252cecf6f48c17c60b022006854
SHA512 e9bf45ab8f4ef8bfbd8631d97b5a09269f700d57a55a93de6f9b25b875350affe5955b95d4066bd8236f7120ac14617623815a7680da9c024c9f613cf0f2df25
SSDEEP 196608:t+YZG78PtfgyLP2hGDFZNNlsPJFCie3yG9KCSmP:tBG78tL+hGDFZNNlsPJFCie3yGU7
TLSH
T148F629117A5B98ACD587C87083468A734E2138DB1A36B9BF45C4A63D3F7DBF05B29318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	PS5 Dump Forge.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_656038018\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_656038018\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_438603532\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_438603532\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_438603532\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_438603532\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_438603532\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_656038018\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_656038018\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_1009031720\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_438603532\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_438603532\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_438603532\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_1009031720\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_438603532\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_438603532\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_1009031720\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_438603532\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_656038018\crs.pb	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4540	msedgewebview2.exe
4540	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5712	msedgewebview2.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 5712	4140	PS5 Dump Forge.exe	89
PID 5712 wrote to memory of 1736	5712	msedgewebview2.exe	90
PID 5712 wrote to memory of 5856	5712	msedgewebview2.exe	91
PID 5712 wrote to memory of 5856	5712	msedgewebview2.exe	91
PID 5712 wrote to memory of 5856	5712	msedgewebview2.exe	91
PID 5712 wrote to memory of 5856	5712	msedgewebview2.exe	91
PID 5712 wrote to memory of 1416	5712	msedgewebview2.exe	92
PID 5712 wrote to memory of 5848	5712	msedgewebview2.exe	93
PID 5712 wrote to memory of 5848	5712	msedgewebview2.exe	93
PID 5712 wrote to memory of 5848	5712	msedgewebview2.exe	93
PID 5712 wrote to memory of 5244	5712	msedgewebview2.exe	94
PID 5712 wrote to memory of 5244	5712	msedgewebview2.exe	94
PID 5712 wrote to memory of 5244	5712	msedgewebview2.exe	94
PID 5712 wrote to memory of 5244	5712	msedgewebview2.exe	94
PID 5712 wrote to memory of 5244	5712	msedgewebview2.exe	94
PID 5712 wrote to memory of 5752	5712	msedgewebview2.exe	98
PID 5712 wrote to memory of 5752	5712	msedgewebview2.exe	98
PID 5712 wrote to memory of 5752	5712	msedgewebview2.exe	98
PID 5712 wrote to memory of 3208	5712	msedgewebview2.exe	99
PID 5712 wrote to memory of 3208	5712	msedgewebview2.exe	99
PID 5712 wrote to memory of 3208	5712	msedgewebview2.exe	99
PID 5712 wrote to memory of 4540	5712	msedgewebview2.exe	100
PID 5712 wrote to memory of 1544	5712	msedgewebview2.exe	101
PID 5712 wrote to memory of 1544	5712	msedgewebview2.exe	101
PID 5712 wrote to memory of 1544	5712	msedgewebview2.exe	101

C:\Users\Admin\AppData\Local\Temp\ps5-dump-forge-0.3.1-windows-x86-64\PS5 Dump Forge.exe
"C:\Users\Admin\AppData\Local\Temp\ps5-dump-forge-0.3.1-windows-x86-64\PS5 Dump Forge.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="PS5 Dump Forge.exe" --webview-exe-version=0.3.1 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ps5-dump-forge-0.3.1-windows-x86-64\data\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4140.2512.5903292308889127041 /pfhostedapp:54d9d39f1e443ee63020a0c45d78875590b477de
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5712
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\ps5-dump-forge-0.3.1-windows-x86-64\data\webview\EBWebView /prefetch:4 /pfhostedapp:54d9d39f1e443ee63020a0c45d78875590b477de --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\ps5-dump-forge-0.3.1-windows-x86-64\data\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffb892b5fd8,0x7ffb892b5fe4,0x7ffb892b5ff0
    3⤵
    PID:1736
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ps5-dump-forge-0.3.1-windows-x86-64\data\webview\EBWebView" --webview-exe-name="PS5 Dump Forge.exe" --webview-exe-version=0.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1736 --field-trial-handle=1740,i,1423019716452751547,10353614190652470687,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:54d9d39f1e443ee63020a0c45d78875590b477de
    3⤵
    PID:5856
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ps5-dump-forge-0.3.1-windows-x86-64\data\webview\EBWebView" --webview-exe-name="PS5 Dump Forge.exe" --webview-exe-version=0.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2012 --field-trial-handle=1740,i,1423019716452751547,10353614190652470687,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:54d9d39f1e443ee63020a0c45d78875590b477de
    3⤵
    PID:1416
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ps5-dump-forge-0.3.1-windows-x86-64\data\webview\EBWebView" --webview-exe-name="PS5 Dump Forge.exe" --webview-exe-version=0.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2248 --field-trial-handle=1740,i,1423019716452751547,10353614190652470687,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:54d9d39f1e443ee63020a0c45d78875590b477de
    3⤵
    PID:5848
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ps5-dump-forge-0.3.1-windows-x86-64\data\webview\EBWebView" --webview-exe-name="PS5 Dump Forge.exe" --webview-exe-version=0.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3384 --field-trial-handle=1740,i,1423019716452751547,10353614190652470687,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:54d9d39f1e443ee63020a0c45d78875590b477de /prefetch:1
    3⤵
    PID:5244
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ps5-dump-forge-0.3.1-windows-x86-64\data\webview\EBWebView" --webview-exe-name="PS5 Dump Forge.exe" --webview-exe-version=0.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4352 --field-trial-handle=1740,i,1423019716452751547,10353614190652470687,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:54d9d39f1e443ee63020a0c45d78875590b477de
    3⤵
    PID:5752
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ps5-dump-forge-0.3.1-windows-x86-64\data\webview\EBWebView" --webview-exe-name="PS5 Dump Forge.exe" --webview-exe-version=0.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4500 --field-trial-handle=1740,i,1423019716452751547,10353614190652470687,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:54d9d39f1e443ee63020a0c45d78875590b477de
    3⤵
    PID:3208
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ps5-dump-forge-0.3.1-windows-x86-64\data\webview\EBWebView" --webview-exe-name="PS5 Dump Forge.exe" --webview-exe-version=0.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4392 --field-trial-handle=1740,i,1423019716452751547,10353614190652470687,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:54d9d39f1e443ee63020a0c45d78875590b477de
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4540
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ps5-dump-forge-0.3.1-windows-x86-64\data\webview\EBWebView" --webview-exe-name="PS5 Dump Forge.exe" --webview-exe-version=0.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4236 --field-trial-handle=1740,i,1423019716452751547,10353614190652470687,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:54d9d39f1e443ee63020a0c45d78875590b477de
    3⤵
    PID:1544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

65a84d85-7272-4b7d-a2be-002ed6ca8632.tmp

Path C:\Users\Admin\AppData\Local\Temp\ps5-dump-forge-0.3.1-windows-x86-64\data\webview\EBWebView\65a84d85-7272-4b7d-a2be-002ed6ca8632.tmp
Size 2KB
SHA256 f55f1f463921ee905db9a9628a3bbc30823dd39dd63849d39115ba40c650ee6c
MD5 c4b0e6a2792f3ac34883baedf04ed835
SHA1 0b0bb454e8b73f6b734d40d52a66a0bb902dadbb
SHA512 1177d413de50f086b8ee9a85ef0efeddd00458381634797eb36454a9488c6b108192186967e65805f90a3b5c0df45e19d6340e36533221389803bf18537d1d7d
TLSH
T171517273AC24AB7799E6C708797F3B23CE79A062F5511F209AEE0B08019729C1342C67
MD5 SHA1 SHA512 TLSH

Submit Download

81b8c6e7-04e1-4818-80f7-0eb78b0cd069.tmp

Path C:\Users\Admin\AppData\Local\Temp\ps5-dump-forge-0.3.1-windows-x86-64\data\webview\EBWebView\81b8c6e7-04e1-4818-80f7-0eb78b0cd069.tmp
Size 15KB
SHA256 1135befcbb1029ebf39d3c88335cd4592da92e8dae04deb69bd25ffdb589df12
MD5 3e14b6fa71163cb9b223ce482f305134
SHA1 dfdb215f6874a50feca2cd6e4b0e8bcb8842f858
SHA512 d89a8b762fdd5b537666e63318e254937f8ecdcd729a0c5af4a1def0416bdd9194842a83ba8ce34b984198b3115e1e47b01db3ab15071b7a5c3545ef79a985b9
SSDEEP 384:c+OBqImmJvGBLx3NaFMJFNNBSI3/audOug6rt:9cvGtlNLSoZJ
TLSH
T187729DBA18756B333CBBC60ABA8E2347CB656293C0916BD5CDEC5F0F116A5841342955
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\ps5-dump-forge-0.3.1-windows-x86-64\data\webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 14a8fe51260f84d810a77570b6a1e710398f40d1f63b6bb97136f3498507f7a2
MD5 2d36caa398a867ee686aad0121eff638
SHA1 4b86184e1606ba3fa672c38c72e751bd0eea6333
SHA512 e5448d46cae3e0a2a8196ca779ffd4238f6a4720afbe168fb4aede965db37896efba32a0582524ba2e587e899378745578a06f7271864547c99915ca1f7a6963
TLSH
T1D8D0121332110178C41022330403B62C0501C10B408941486429891D2E184950E13951
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\ps5-dump-forge-0.3.1-windows-x86-64\data\webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 08141771a5c55c554b226498daa1e919a4904b11ec31a668c1f332b68242301f
MD5 8400595800e21659540969fcd56b24a7
SHA1 c22b1ee75d4bd007378154fc3d9ece24cf156fc6
SHA512 5793af79145ff3fa3fc594a7b408aabde0ac5d9d77a81525e9f894fe64f5f20a32183642bc4096b733a357072c037a5b215f531f965960670cd2baecdb213e88
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\ps5-dump-forge-0.3.1-windows-x86-64\data\webview\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

363a7724-48fa-482f-8b6f-04106d86b30e.tmp

Path C:\Users\Admin\AppData\Local\Temp\ps5-dump-forge-0.3.1-windows-x86-64\data\webview\EBWebView\Default\363a7724-48fa-482f-8b6f-04106d86b30e.tmp
Size 6KB
SHA256 62d7cb9b4ca8f554d421c765c678c4d0ff2d24dbb9662f98d50fb85d0988685d
MD5 fb913320570bbef7c48d5826b3b5a528
SHA1 771a51bf8c405ead75d9ac7408d52cac8cbafda9
SHA512 571ba0ea6c8f0b834db818d530209762b203a0d85c18eaab58a5cb497968bae3467425b486d471482354e94f3b834bfd87638c7123cac82363a8634f99ebea97
SSDEEP 96:st8/d0mNvGBb9+gkhEo5h16Z0Zs7/x+6MhmuecJE01ejeOK+gCS4j1+28XM1C7K:stwfxgVonZsV+FdE0QjS8S4h+G6K
TLSH
T1F1D1B7415E247A7B4CC7E509BA397B13E3F96072B1901E48E7FD862C18EA6DC230380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Temp\ps5-dump-forge-0.3.1-windows-x86-64\data\webview\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 407a7bb97027b92a19b951689ef3283337536272be0e88b35bf8c26d07bfd8ba
MD5 cdcb8c3815781b6099a98cd1bfdaf150
SHA1 af79a2fc48af67b086bbbe9ce66a67c45ded2235
SHA512 076436e7159fcbd2048b068298385935fa87fd7ae7173bebcfe1da937a99ef1cf60718212cb736d1116e5f2c82efd7ca28c3e251f10b1e626c83efcb2c7c1d6c
TLSH
T18FA002F91551194AC21447B420C2A6F07278AC1D1707071248A44179C8D4B908619048
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\ps5-dump-forge-0.3.1-windows-x86-64\data\webview\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 6b42d973c58bd9f9b38e1d180f23c41e80aa682aa91939df2679441248af84b2
MD5 34fc4a50a0a4d1f20a114478a14ee73f
SHA1 e58cca9161f2ef2560e2e27749858b46e3a9a815
SHA512 bb42389b7126940061e985a5a5b2e430355a601c7a356617b882411179a71a12b6340d77be0d6d16eb9aa8e49f237af3547103c642dc7c60d1ebe10259bb4c9c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\ps5-dump-forge-0.3.1-windows-x86-64\data\webview\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\ps5-dump-forge-0.3.1-windows-x86-64\data\webview\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

997d9319-7aab-43ae-96a3-29a4e8a520f1.tmp

Path C:\Users\Admin\AppData\Local\Temp\ps5-dump-forge-0.3.1-windows-x86-64\data\webview\EBWebView\Default\Network\997d9319-7aab-43ae-96a3-29a4e8a520f1.tmp
Size 238B
SHA256 3a984152f56639262684ec2a65b582620ebbeb7df0cfbb804d71f221deb99dec
MD5 1622076891508cc87d79647883de8e03
SHA1 4e9cfe9e9c4e7b23d1f6bac53243da49ba15d1ca
SHA512 c3942375f04586dfcdeab5af50217f076b1309b80e8e6845ee6e941a99aa05bb6e35833dad309d406f44dcdbc856ed1a67842ed05a81e3236d033c7076428655
TLSH
T1B9D097A2427098FE8B4093A01A287903CA7E0002931C8E7ACAB9B7758AA20B9D024807
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\ps5-dump-forge-0.3.1-windows-x86-64\data\webview\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\ps5-dump-forge-0.3.1-windows-x86-64\data\webview\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e69dfb90-3091-4e85-816e-64a8dcd67652.tmp

Path C:\Users\Admin\AppData\Local\Temp\ps5-dump-forge-0.3.1-windows-x86-64\data\webview\EBWebView\Default\e69dfb90-3091-4e85-816e-64a8dcd67652.tmp
Size 6KB
SHA256 b5779ca19b0fb03c812eb7ceb9fe92d2479ea5f3b15797acc082b0c3e36b0549
MD5 a2e4e9a46e9f3e570a38536227f89159
SHA1 af3d489975e70e0f73242d496058f40c3d0eb203
SHA512 795c582fe8679931f2a144044bf544873a816e0787f64c7b11d645993388dd1c3009ca64fe0c2412fe25583a64c0453dafb78461723cd3f1c07e126333223123
SSDEEP 96:st8/d0mNYBb9+gkhEo5h16Z0Zs7/x+6MhmuecJE01ejeOK+gCOg+28XM1C7K:stwfHgVonZsV+FdE0QjS8Og+G6K
TLSH
T192D1A7415E647A7B4CC6E509BA397B13E3F9607271D01E58E7FD862C18EA5DC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\ps5-dump-forge-0.3.1-windows-x86-64\data\webview\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\ps5-dump-forge-0.3.1-windows-x86-64\data\webview\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\ps5-dump-forge-0.3.1-windows-x86-64\data\webview\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\ps5-dump-forge-0.3.1-windows-x86-64\data\webview\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\ps5-dump-forge-0.3.1-windows-x86-64\data\webview\EBWebView\Local State
Size 1KB
SHA256 595b5e5ebf25ea1a7857b1713de04a7ad886eba322597ade1f0f0a47df45886f
MD5 435486f8e93d60a1b16d6c2ba59fd48c
SHA1 005f456dddb1ef022c08694888ff27fcb6fa9050
SHA512 bff49fa0d54ce14478c0798d994e04d65dd3afb19ba1706d3c63872d5de1b53d8fc5fba1a04c16e3fb92b84cf5593927736e889409a5aba368a28addc7b08ce2
TLSH
T1172162B3E9646F72EC99930A363B7B439E356067A1504F00A6DE4708019728C965AC36
MD5 SHA1 SHA512 TLSH

Submit Download

ad74ef31-5e58-481c-8c19-b8bc024f3ba1.tmp

Path C:\Users\Admin\AppData\Local\Temp\ps5-dump-forge-0.3.1-windows-x86-64\data\webview\EBWebView\ad74ef31-5e58-481c-8c19-b8bc024f3ba1.tmp
Size 3KB
SHA256 26908255f3d5248340e3bb4f012ed77bde27a58f20556a1246e6961330677230
MD5 e2817ec78e0a8fe2531f52304bd5d1bc
SHA1 470af0373fd1814bb627920bf1f10a7963130fd8
SHA512 bd5a74f64db143d4d631f15fd9ed05ebbe3f6edd4e683235b40904a28cb500b09c73bd4e5caaac744d7a5d72c145d02cad060babf10dd32589da1b433da117ce
TLSH
T1B3618477A974AA779DE2CA05B9AA3B12EBB95023F4813F65D6ED0F0C01D728C1342C17
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_1009031720\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_438603532\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_656038018\manifest.json
Size 102B
SHA256 0ed889bea99f74fede865222f4cacca4277c63023db98efa666d42ba1f7f9502
MD5 329ad25b265a82c711c72c02a553a353
SHA1 a9a666d4182caad82edd399fdab141473670c5a7
SHA512 b81005847e76dc513b255b36704dec0ae84c922d23dc152cc42bb3eec9e18cb083e601bb90562b3f3c9b2ac540e801866f59277b9c43c0b97fd3e90b688f26c5
TLSH
T178B01220EC10B4B3000403AC0C6CC3C063372F032C4079180DE59F84E80D9DBE071E29
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4540-322-0x000001ED49740000-0x000001ED49741000-memory.dmp

Download

memory/4540-324-0x000001ED49740000-0x000001ED49741000-memory.dmp

Download

memory/4540-330-0x000001ED49740000-0x000001ED49741000-memory.dmp

Download

memory/4540-333-0x000001ED49740000-0x000001ED49741000-memory.dmp

Download

memory/4540-332-0x000001ED49740000-0x000001ED49741000-memory.dmp

Download

memory/4540-329-0x000001ED49740000-0x000001ED49741000-memory.dmp

Download

memory/4540-328-0x000001ED49740000-0x000001ED49741000-memory.dmp

Download

memory/4540-331-0x000001ED49740000-0x000001ED49741000-memory.dmp

Download

memory/5244-68-0x00007FFBA96F0000-0x00007FFBA96F1000-memory.dmp

Download

memory/5752-269-0x00007FFBAAE40000-0x00007FFBAAE41000-memory.dmp

Download

memory/5752-270-0x00007FFBAA7F0000-0x00007FFBAA7F1000-memory.dmp

Download

memory/5856-20-0x00007FFBA96F0000-0x00007FFBA96F1000-memory.dmp

Download