hxxps://github[.]com/ivelchampion249/FishSol-Macro/releases/tag/v1[.]9[.]6-HOTFIX3

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/04/2026, 17:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/ivelchampion249/FishSol-Macro/releases/tag/v1.9.6-HOTFIX3
Sample260420-web6bsbt7q

Score

8^/10

defense_evasion discovery trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
207	2568	msedge.exe

Executes dropped EXE 3 IoCs

pid	Process
5900	AutoHotkey_1.1.37.02_setup.exe
6096	setup.exe
6048	AutoHotkey.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
241	raw.githubusercontent.com
240	raw.githubusercontent.com

Drops file in Program Files directory 24 IoCs

description	ioc	Process
File created	C:\Program Files\AutoHotkey\AutoHotkey.exe	setup.exe
File created	C:\Program Files\AutoHotkey\AutoHotkeyA32.exe	setup.exe
File created	C:\Program Files\AutoHotkey\Compiler\Unicode 32-bit.bin	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1738563964\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1328880520\manifest.json	msedge.exe
File created	C:\Program Files\AutoHotkey\AutoHotkeyU64.exe	setup.exe
File created	C:\Program Files\AutoHotkey\Installer.ahk	setup.exe
File created	C:\Program Files\AutoHotkey\Compiler\ANSI 32-bit.bin	setup.exe
File created	C:\Program Files\AutoHotkey\Compiler\AutoHotkeySC.bin	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1328880520\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_456116391\smart_switch_list.json	msedge.exe
File created	C:\Program Files\AutoHotkey\AutoHotkeyU32.exe	setup.exe
File created	C:\Program Files\AutoHotkey\WindowSpy.ahk	setup.exe
File created	C:\Program Files\AutoHotkey\AutoHotkey.chm	setup.exe
File created	C:\Program Files\AutoHotkey\license.txt	setup.exe
File created	C:\Program Files\AutoHotkey\Compiler\Ahk2Exe.exe	setup.exe
File created	C:\Program Files\AutoHotkey\Compiler\Unicode 64-bit.bin	setup.exe
File created	C:\Program Files\AutoHotkey\AutoHotkey Website.url	setup.exe
File opened for modification	C:\Program Files\AutoHotkey\AutoHotkey Website.url	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_445886502\manifest.json	msedge.exe
File opened for modification	C:\Program Files\AutoHotkey\AutoHotkeyU32.exe	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1738563964\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_456116391\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_456116391\office_endpoints_list.json	msedge.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\ShellNew\Template.ahk	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoHotkey_1.1.37.02_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2568	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134211809922668421"	msedge.exe

Modifies registry class 33 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\ShellEx\DropHandler	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-312252282-3884318443-358092420-1000\{C0502441-6CD6-44DF-B14C-8B67D47B81EE}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ahk	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Compile-Gui\Command	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\ShellEx\DropHandler\ = "{86C86720-42A0-1069-A2E8-08002B30309D}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\DefaultIcon\ = "C:\\Program Files\\AutoHotkey\\AutoHotkey.exe,1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Edit\ = "Edit Script"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Compile	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ahk\ShellNew	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Open\Command\ = "\"C:\\Program Files\\AutoHotkey\\AutoHotkey.exe\" \"%1\" %*"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ahk\ShellNew\FileName = "Template.ahk"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Compile-Gui\ = "Compile Script (GUI)..."	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Compile\Command	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Open\Command	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\ShellEx	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Edit	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Compile-Gui	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\ = "Open"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Edit\Command	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ahk\ = "AutoHotkeyScript"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\ = "AutoHotkey Script"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\DefaultIcon	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Compile\ = "Compile Script"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Edit\Command\ = "notepad.exe %1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Compile-Gui\Command\ = "\"C:\\Program Files\\AutoHotkey\\Compiler\\Ahk2Exe.exe\" /gui /in \"%l\" %*"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Open	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Open\ = "Run Script"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Compile\Command\ = "\"C:\\Program Files\\AutoHotkey\\Compiler\\Ahk2Exe.exe\" /in \"%l\" %*"	setup.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	241	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3360	msedge.exe
3360	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
6096	setup.exe
6048	AutoHotkey.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
6048	AutoHotkey.exe
6048	AutoHotkey.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5900	AutoHotkey_1.1.37.02_setup.exe
6096	setup.exe
6096	setup.exe
6096	setup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 1456	4364	msedge.exe	85
PID 4364 wrote to memory of 2568	4364	msedge.exe	86
PID 4364 wrote to memory of 4988	4364	msedge.exe	87
PID 4364 wrote to memory of 4988	4364	msedge.exe	87
PID 4364 wrote to memory of 4988	4364	msedge.exe	87
PID 4364 wrote to memory of 4216	4364	msedge.exe	88
PID 4364 wrote to memory of 4216	4364	msedge.exe	88
PID 4364 wrote to memory of 400	4364	msedge.exe	89
PID 4364 wrote to memory of 400	4364	msedge.exe	89
PID 4364 wrote to memory of 2608	4364	msedge.exe	90
PID 4364 wrote to memory of 400	4364	msedge.exe	89
PID 4364 wrote to memory of 2608	4364	msedge.exe	90
PID 4364 wrote to memory of 2608	4364	msedge.exe	90
PID 4364 wrote to memory of 2704	4364	msedge.exe	91
PID 4364 wrote to memory of 2704	4364	msedge.exe	91
PID 4364 wrote to memory of 2704	4364	msedge.exe	91
PID 4364 wrote to memory of 60	4364	msedge.exe	92
PID 4364 wrote to memory of 60	4364	msedge.exe	92
PID 4364 wrote to memory of 60	4364	msedge.exe	92
PID 4364 wrote to memory of 1524	4364	msedge.exe	96
PID 4364 wrote to memory of 1524	4364	msedge.exe	96
PID 4364 wrote to memory of 4872	4364	msedge.exe	97
PID 4364 wrote to memory of 4872	4364	msedge.exe	97
PID 4364 wrote to memory of 2380	4364	msedge.exe	99
PID 4364 wrote to memory of 2064	4364	msedge.exe	100
PID 4364 wrote to memory of 2380	4364	msedge.exe	99
PID 4364 wrote to memory of 2064	4364	msedge.exe	100
PID 4364 wrote to memory of 1908	4364	msedge.exe	102
PID 4364 wrote to memory of 4168	4364	msedge.exe	103
PID 4364 wrote to memory of 4168	4364	msedge.exe	103
PID 4364 wrote to memory of 5104	4364	msedge.exe	104
PID 4364 wrote to memory of 5104	4364	msedge.exe	104
PID 4364 wrote to memory of 316	4364	msedge.exe	105
PID 4364 wrote to memory of 1056	4364	msedge.exe	106
PID 4364 wrote to memory of 316	4364	msedge.exe	105
PID 4364 wrote to memory of 1056	4364	msedge.exe	106
PID 4364 wrote to memory of 3500	4364	msedge.exe	107
PID 4364 wrote to memory of 3500	4364	msedge.exe	107
PID 4364 wrote to memory of 4584	4364	msedge.exe	108
PID 4364 wrote to memory of 2720	4364	msedge.exe	109
PID 4364 wrote to memory of 4584	4364	msedge.exe	108
PID 4364 wrote to memory of 2720	4364	msedge.exe	109
PID 4364 wrote to memory of 2720	4364	msedge.exe	109
PID 4364 wrote to memory of 2168	4364	msedge.exe	110
PID 4364 wrote to memory of 408	4364	msedge.exe	111
PID 4364 wrote to memory of 408	4364	msedge.exe	111
PID 4364 wrote to memory of 408	4364	msedge.exe	111
PID 4364 wrote to memory of 1968	4364	msedge.exe	112
PID 4364 wrote to memory of 836	4364	msedge.exe	114
PID 4364 wrote to memory of 836	4364	msedge.exe	114
PID 4364 wrote to memory of 836	4364	msedge.exe	114
PID 4364 wrote to memory of 420	4364	msedge.exe	115
PID 4364 wrote to memory of 3808	4364	msedge.exe	126
PID 4364 wrote to memory of 1748	4364	msedge.exe	127
PID 4364 wrote to memory of 1028	4364	msedge.exe	128
PID 4364 wrote to memory of 3732	4364	msedge.exe	136
PID 4364 wrote to memory of 3732	4364	msedge.exe	136
PID 4364 wrote to memory of 4832	4364	msedge.exe	138
PID 4364 wrote to memory of 4832	4364	msedge.exe	138
PID 4364 wrote to memory of 4832	4364	msedge.exe	138
PID 4364 wrote to memory of 4488	4364	msedge.exe	140
PID 4364 wrote to memory of 4488	4364	msedge.exe	140
PID 4364 wrote to memory of 4784	4364	msedge.exe	141
PID 4364 wrote to memory of 4784	4364	msedge.exe	141

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/ivelchampion249/FishSol-Macro/releases/tag/v1.9.6-HOTFIX3
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7fffeb23c188,0x7fffeb23c194,0x7fffeb23c1a0
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,7487609655239627145,2138872605586434349,524288 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,8365104208054497603,15353053820175626771,262144 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,6544477490368839751,14969866790199452267,524288 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=1668,i,12787129772505877131,1288576809341714846,2097152 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,3311824610842286482,15817971456185875139,2097152 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,10233577951079651462,8055049011049567876,2097152 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,6273796028943846317,13351737811318537277,2097152 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:2
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,11113046785449020236,8036900662961484352,524288 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:8
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,3451744805635922707,15881676381967592246,524288 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,6577701370375021572,15656499672384772527,524288 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,16436163666219774827,9112825503081346720,524288 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,14776617507531457245,10822479809048599627,524288 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,14776617507531457245,10822479809048599627,524288 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,5113497384311574838,12910267436980382484,524288 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,6950584948115123218,4287861012554553514,524288 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,1048091265007528993,4689229453380902742,524288 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:8
  2⤵
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,2045231172136745130,4383100651779759558,524288 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:8
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,17696798764465556000,3081709723439613552,524288 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:8
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,6002374245701989100,9611631924404148676,524288 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:8
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6492,i,2839846560469415268,16575714639598376887,2097152 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,91563853265049755,1417932592669606718,524288 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=4232,i,6720604272936429784,15543825088338821681,2097152 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6996,i,3027724639353034380,3797038258576871835,524288 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5144,i,16313108102604679204,7815786626260308003,2097152 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:1
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,6605354116559755546,6863485439655092003,524288 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
  2⤵
  PID:420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,4782789247142784712,608624707148896652,524288 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,7067878554617491877,17240280607276652972,524288 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,7977796766510154278,17320709319351148788,524288 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:8
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,1634341401129788616,3001658982571648134,524288 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:8
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=3096,i,3111998401451850641,13266518197025494508,2097152 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,7409549626542380733,14069340841817828622,524288 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=6052,i,1861457574246864200,1452844887460772700,2097152 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7232,i,5476243346751633029,7665669474566464001,2097152 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=7264 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7504,i,8867607275517634990,13524423435769432201,2097152 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=7520 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7892,i,13197377024359020664,288377683892812379,2097152 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=7908 /prefetch:1
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=5784,i,13387955489809690057,4136350325199421342,2097152 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,8245039504826470294,9026120431082538678,524288 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:8
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7008,i,1752961371131266538,1404557681063442648,524288 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:8
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,8897718980621959625,16022664541372418694,524288 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  PID:5368
- C:\Users\Admin\Downloads\AutoHotkey_1.1.37.02_setup.exe
  "C:\Users\Admin\Downloads\AutoHotkey_1.1.37.02_setup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5900
- - C:\Users\Admin\AppData\Local\Temp\7z97AF670C\setup.exe
    C:\Users\Admin\AppData\Local\Temp\7z97AF670C\setup.exe
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7700,i,5177462575427521182,9726570243194189624,524288 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7752,i,4349306091152054107,16103451233140618232,524288 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=7720 /prefetch:8
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7632,i,14129216486920447122,7954603378677170278,262144 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=7740 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,14167650227061517738,545371126435159521,524288 --field-trial-handle=2296,i,5410597093002057696,2800854424853038421,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:5172

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5036

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:568

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:4968

C:\Program Files\AutoHotkey\AutoHotkey.exe
"C:\Program Files\AutoHotkey\AutoHotkey.exe" "C:\Users\Admin\Downloads\FishSol-1.9.6-HOTFIX-3\FishSol-1.9.6-HOTFIX-3.ahk"
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
PID:6048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1328880520\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1738563964\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4364_445886502\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4364_456116391\manifest.json
Size 160B
SHA256 2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
MD5 a24a1941bbb8d90784f5ef76712002f5
SHA1 5c2b6323c7ed8913b5d0d65a4d21062c96df24eb
SHA512 fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2
TLSH
T133C04C23ED18BABA12F587D40971DB43F7F0031B34E169463B39948C5F761B8925175A
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 cf0266ac99d59d8e7bf7d06daaae58886aa69f3d629c74fbbf7794adfd2219a7
MD5 855c93f4f21d237e49deeb0724f94d4d
SHA1 9ddc8ddc10d3e5b48f893c6a47c2caefbff1140f
SHA512 0ffe3618dda92cf0c32f53b88d8586e4100a7bf6ff98a8c85877c4ffa8b392b45a5f3092f9ce911a0b58f4fa82e09244626a391f4deb58dc0c7adc95b0ed3fe9
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P71:fwUQC5VwBIiElEd2K57P71
TLSH
T151B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d084fddc35d62ab10457432373865714cd0577ad9bebe9188135998b9f802bd3
MD5 ff587c8337b9997eb40f19fb41bffd1a
SHA1 75e9be1412e32cbe6e960e041e872bbb48ab464e
SHA512 d50cc729f4f047045aba003643fd356cb1ac85c1d90f9ed992f787f682a862005a91103e9e388ad5cbd4f884c2668a35a0e5a0d011d0684ef2d6bc59a10b1701
TLSH
T15ED08089D5B15C35D1D78CF1154B37067915C577DF42532274633C3C8C435919546283
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b65e3f6d57bee85b90392c47f2236ea7ffcfe9cba07ca29930764c7dacc0ea2
MD5 726476576ad538c648305e214c389ece
SHA1 03960d925aa07a6736b28a431ddf422fa8bba04d
SHA512 7b99250e71a507574a7ea1c326ff4f687cffd7e1a0eb1ba5aa847f5b5e0c5d997dbef37ede7c2815a11e03b25f291a4f19173dd0aa9d22472d224e9b1d6349a5
TLSH
T11ED0808995F15C35D5D78CF1154B37067915C577DF42932374633C3C8C435D19546283
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000a4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a4
Size 19KB
SHA256 0b09fc3cc83336323bfc813740f36ebd8542c6af012ad7317dc1f4ff2e35e001
MD5 89be20584aa0bf6dfa7134e88ae7fcc7
SHA1 c678662659652b731b78416e9205f799a395d3ac
SHA512 12df81dc1f713cf08c096b19bc9cddc200adfc29bebbf0a98932508372bf298956d7ec79517e84df1695c78146ba83224f410f0f037bc5a9e9e53a71897d1e1d
SSDEEP 384:48umB7twuaMq8mIhNv8n0xKvJlzPnt/uD6PcV+y7lhNGjK0l/PUifoW:sGt548jNvCv9/uDDVr3GtlHUMoW
TLSH
T17992C0A8E15E90D1F2BEB1EC31B4EACCE57AC7677F112C461D205C7422F840E05B7898
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a7
Size 55KB
SHA256 9bc047ac8fe630eee479777069537697dffcd514aa7c51c6d0fb8ca5b50cf315
MD5 470490b4870025506e6727895e9e42c7
SHA1 10b6cffa1b834ca5ded32882a20c84debc6e0b3b
SHA512 44526c6d5fed54dd34bb8812cb1c4de741efd39dd1650f399a6eab7ab5976159dcf105e1bf86bee8418ed25f1dfe1a739bff24db9a63ff23a33fe49f34de09e6
SSDEEP 768:iLGGEMIJCvQS2W29Fnw1FFrQt9mTwX/1acqUNFsF1jnd1NKCCfAorQAMd:k2TJ6U9RwlQt1PccqZ/jnzNKCgrQDd
TLSH
T1DB43020C2696836F05DD0880C1E6A375B5CADC2165F29284FA756877ECF9C1BB9F478C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a9
Size 71KB
SHA256 cbf580fee06804c1470e322861c4f007be3979959aa6ade925cccc2f40a27e8f
MD5 c7b789ed1a581e975ca511fba0bdf7b8
SHA1 93710fd90af2b6c1d34397db99983e656f5b5b74
SHA512 f0c3d6ee0eaa55b8ce5224bf1362717d4d25f335e85592f4c11e0b3c25b55c82fda686a7670634b100bfdcabbceab82a351becc249abbcd87b9b530f1f870e87
SSDEEP 1536:6Sq+cM9J2+46Q+hwLeHbpy1C1bwV4z9HfylwCUyVXndE9JPyFPjwrwEk:/qzM9vyLeHb00BwVip0wgK9dyRN
TLSH
T1507302D047565DEFA7762BF2C3851A8E03AC9154A346B813B143A16BC70E7FBE30492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ad

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ad
Size 20KB
SHA256 ea95b1ef238655dbc2040025d97029aa3dfc95b85d6fe338c1cd70c9f8394a29
MD5 fc8c4f42ba6075218a5c78e70d5e139f
SHA1 519a558aa80067631b17e039ec0fe9522b9f337d
SHA512 ab641bd2fd9eb5fed65e35c6c09d21bf7a771f1972eccc526bf1cdd858180a5583afae50bb5e06701fb9fd4b7369cf9cd4b57ac16db4fa255384cac2657ada97
SSDEEP 384:Sdb8SvpuDNwgPKjLBlprTW7kT2OEHpNlpvmpynyEZzTKykhtT5FPuaLevzbp4Pp9:OwSGNjyjBTW7l34EFzTkhFWaLSi9
TLSH
T13792E1C639A9F308ECB723972756127EB2FD5C313EA1A5E2138101F90D54E417AFD242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b7
Size 16KB
SHA256 b23b213dbe323251779e953b8798116e83b09f23405508b9f8e726a5eef182ec
MD5 f0830f1d1e6d36bfbfa07b48de9e2c5b
SHA1 be58f14041fa86d2f412e75e0e32d2a4f85d256f
SHA512 2b481f45ba2df83674948c4884cf2275a372095d19b66332ffc425bf2837cc7d68a1b99c6cc15967fb5a3253930914277677101ffa654d82419ecf00ed055631
SSDEEP 384:o+I/TBRZMzBvWiLAO+MY/aavBhKAlouqKZUtgLQfhlRKPWGnF37C5L2:o+IbBRWzONvZgA+uqKZUMQfhlRKPv3wq
TLSH
T1D972D06F4E044D60AF2A67DC64547C4F6FE8698AA5F10637CC7A9408684C8FC3726BF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b9
Size 36KB
SHA256 f7c23a842a806ddbc434e104e9c4a237c1af4d430e969249733ad21deb196a50
MD5 df8da929c6c0f1af820bb446a9973197
SHA1 3576768492bfc3a25578147c137d71571e338314
SHA512 7975a9db40d10e41829afe74b6fd2f6326132da3755a97092716ed860262cab02de73969d420e87785e552e1abbe39484ffa20d5a772be002fd203e9d189fe61
SSDEEP 768:fNu8m47b+sgKdz2OWeQLR17KnNIWFZ/3IuPvjzNsN88ISgdeQY4KYoesW:VB7b+sgt/0nNHFZ/3IgsN81jdep7dW
TLSH
T125F2F2D0976C52EA329AB10605465C6002E0F7F75A42B638F99C2DAEFC52C9CFD065FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 9f40912cbfb8d1f84592dbbb93ece3139e4369a2d25ac5fdfee1549b294da95d
MD5 3a3826583043dc4eb1637387ca1ac5d2
SHA1 e30ef4cd51aaf40366a511a56e549fa697858556
SHA512 f5557fc29b8322403acb030d0957a0897211fa201d59db2fbb2006db009483b029cf07f2c75e37de6c7c0d671b417f86d5d8091e6fec98ed6006776e9a0fa42b
SSDEEP 192:/NoKzDhSJUODo5jqCi+RbkcgjeZsY40dq:/2KzQJzo5FhoCZsY40U
TLSH
T1AC12782253C1C292FBE840B109ED9A6B757EBF89547F4F4AB5F1D03E94E27B8805B484
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 9b23de1c6cc6c3827d18fd6365d17fd14a9a4ebc93db12c83eaf6d0e0a4b14e6
MD5 d705046d6c407c015052eae519ab4ccb
SHA1 e37fa631ff1bd14eb6f075bd8dc33281bfb0fb60
SHA512 211d4bd68426bad67c8eb29ef0316407cc606144bffa440b6f4da6c0182e026a3d73b4699c5349f7e43029791bb10f6a58ee276d835f8955fb095a9528e333a7
SSDEEP 96:O/fnsKoVv30gYKgZ614hyPV4h5hEmHl+ckE:O/fnsKYvEgYBZfyPV4h5hEmF+S
TLSH
T142B1F8274381C296EBF801B05ED98A6E327E9F8C003F1E46B1F5D03E95B67BC809B494
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe586de8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586de8.TMP
Size 3KB
SHA256 544e787eb542e6f56fcf36cef4707a16a6f2dce8ac9b2cbe61a33a019e325cc9
MD5 c283f58cfd1555712fe98082f077e1af
SHA1 fd4497f0cf800ca64ae7dae983d4050b7f4315ef
SHA512 0007b3b3adea0c68321ec914b719d62bf622868744b4d95b0e7127a8f11caf8b7f8bb570bf81013994156349cbd684d399665c3a5c13a70a31744db604d0203d
TLSH
T1D561B5385395479AE7ED00B09691D3AC726F9BCD410B1E8932F5E02C5AD6B2DC19F4C4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 4e1cf92bd726f9ba2b844e947f3e7c474d07da5d0d80628f65c5ce3b67b89513
MD5 7ad2f3f8b75a54e4ada4872a1d69a539
SHA1 ce513b1f3c76de9b863a0fd8e22e3f314de5a673
SHA512 24fbea3f8a33d504fc2212b8748edb0ab0d3292b40a89fa12de5ef145e1a45eded7e0bf2c3821ef6613b6e9b3cd3ebf768ed8b6319255f88054016e7fc3f53d9
SSDEEP 192:Dfm+cHWwf+MHi6BamrmXmDkj6Gimt0mgmz75HTcjAt8I+eLZZG3fzk:Dfm+cHWwf+MHisamrmXmDkGGimt0mgmn
TLSH
T143F1EDF7C3E5862DDD1151F0AA14AF1BCE2D0515836C3C6A89E4AF4BA3F2871E141B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 5628bd6f37c07d8d8817d56c0c545b2947b4666e878c497bb18ea68161b33b47
MD5 28e5094eb0068fcf205270b852150d41
SHA1 7db5006470b1ecd08c04c896116e9e28cef709da
SHA512 f7e68c3c6f30251809f3ac713fab68901dc700dd6c42a1412d291006f85e8dfcd20315d30ec6ec7889ea5c6ad014ca90392781301b023fb5abedcd598709faac
TLSH
T10271ABF783F5856D9A1195F0BA18AE1BCE6C0510832C7C6A89E4AF07E3F3871E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 5eab8097265c190366ee89145166657ad92ce54ff0dcc99a8daec700e4666475
MD5 ca08c5c66fe1ee1133158c2b0f5c2017
SHA1 b0d7ec6e0066d8e319c34a8580ee09d9f71df57c
SHA512 591b564e6615423ca256ab9162e660a2ab548ba374f6e5ba5d60138a76a9fc7c3e0d7e0a5227dca64842314172aaf93e33ed9fde70ce760d38f65c4db5a2dc21
TLSH
T157D022A3170130B9BA6C3F82C46AED8FC3371030C8C2EDD423E0DAD91E3286C0607189
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe59401c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe59401c.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

c54afca8-d1db-4c77-ba1d-59c32627cd98.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c54afca8-d1db-4c77-ba1d-59c32627cd98.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 022822e17b438ee2fcaf7b91b66f60bd80cf6b6104036299bda3cb68844119dc
MD5 e2a91b10e1041f644725cba1109c7301
SHA1 0d119ef3416a2665027918767f28f654cc0a7f5b
SHA512 1847f3fd66dc1507ef44a5ce69fbf8c4a195e1be39778996ba83ddba9fe1426b5aa4f5915977f337b491a73632846f2c8a54399e70165302df0641c0f0b17f08
SSDEEP 192:sxZfEdReyM//K1Ml8M9HE/fENsU6XIfCAW7gvGt6Idp9LdHW6+WNYYv/YJkps7If:sxZuQ1k/fENsUgI6AW7gexLHbb/ac
TLSH
T1D352EA16AA349E77CCCBD219B9457B53D6F54462D6901E54AEFCCA0C00F6BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 ab7b0c707cb7d139dea2e436621671809fc2fec19704dc06c4d58ab1256cd166
MD5 81e53212c6a9c710925df6fc9caba3d3
SHA1 6475ded45bfcb328cdbb4b2abfae700dad3d3f0d
SHA512 754286ac38111aa2c5b397400effbf72e1d1fdf50819abb2192dba5c96629d52921131378f28a844546413ee74dd4fe4777fa097010b32a43226cfbe67a99129
SSDEEP 384:sxZuQsm4k/fENsQgK6AW7g44cGHbXpUJ4Q/7xGU4:s2xm4k/fE2KYc48HbC4U4
TLSH
T1AE920816A5244DBB9DC7D219BD157F13E6F50062CA901E4CAAFCCA0C04EABED3203C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 74a38337689957115fcbeb0e63ad9ea6b900267e7e76ce2c6aeaf71da16bfd3d
MD5 adc7cc431a91d2ae85256be74ce87db0
SHA1 6cb42f003cd5a7ac0526686907864e313983aa3f
SHA512 a4a6d707680dc32c7892633e8920f1dabf91ea1e4ad712821ca7f0aa29772bcb77906c897190f1ba7b5b9e0af55cb27b3fbbab70d131d3220a2a4186c04407d7
SSDEEP 384:sxZuQq/m4k/fENsQgK6AW7gX4cGHbXOUJ4Q/7dGU4:s2X/m4k/fE2KYcX8HbpcU4
TLSH
T1C292F856A5244DBB9DD7D219BD157F53E2F50462CA905E4CAAFCCA0C04EABED320382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 83d4eb18942b32b32ce8e9d1072ddd4a25e55980b2a15b35e2c715cdd7513c2b
MD5 dc66401991cdb5a59860b9208e1880dc
SHA1 0f07c55a75348195ec07016c64225dbc4e333014
SHA512 d6fc2e769008ec89ddd5704cdce870a3ee19a0a08d12e54bd0efa2ac326b809def6b393db2f8ffb31b7327c2a604b29bd07bbbfab463b4c3f18fd2717b768ebf
SSDEEP 768:F+Qv2UE7pLuLneqWve+l+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVAr0FLllnWh6roo:F+Qv2UIEneqWve+l+u1ja1r0FLfWhxxq
TLSH
T1BDF20C3B6C0CCB7E4F804E9CEC2A7E8E6DE801CB9698895447FA845C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a8685028-8a71-4316-b2b9-e9c8eb46c656\index-dir\the-real-index
Size 2KB
SHA256 59b2cd799e97550fcd74f979166aeed85c8aab4950f30f010e5cea6b02272f4c
MD5 f4de0b21cab3327662c889cee9f13615
SHA1 98110e6b9f3de9b5c0525d52b8dde8e46df42bf8
SHA512 a68059c63524914fae898ad5b2209bbb62d9f9bc478060a8cf638d754376a5041015d2a99b360e2c01ff556fc078766a1fbf8252a358aaa9879b538379c8ffe5
TLSH
T15851E80D9C0A6F61CA7815B648B6188433B4E8CDBED44B1BEEDC55B0645721E1E1E627
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a8685028-8a71-4316-b2b9-e9c8eb46c656\index-dir\the-real-index
Size 2KB
SHA256 076389da83abad632cc34f5b1962bcad68d9ef7ea9c0ea122706ba3e52395c25
MD5 d652b51c284b8621a1669b177f68156d
SHA1 bd81f6da9aee7c898ba21b8044e42267ec65c188
SHA512 c220293ec864be4a8c841cde913d24a26f7fc5774dadace9b081e6555ae0c1c1c718570af783ec282a6a0b2031ace86ba04c38433a243595b2367661befce686
TLSH
T13A41B74D4C4A9E17CA3840B15CB5187C3334D8FE2988170B79FC92355C4FA5118A332C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ecbc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a8685028-8a71-4316-b2b9-e9c8eb46c656\index-dir\the-real-index~RFe58ecbc.TMP
Size 2KB
SHA256 b27d7659f22f0b34870e4695043ca743e2c6e6da78439a1d5dabc5777e0c8e6a
MD5 dd2a5f89436f7107c9a88e35a4cfab0b
SHA1 ab64a78b86de4e2d4348f86428b2217819edca2a
SHA512 0ce9c93715a85afcfd27ca9c32b235dacf1c28d2c950a1cb5210a9acc180737c924acd02c3143f5633ca6f0660ffbd9081786e1d3a8dce59f3743af91ab79403
TLSH
T19141E9595C824E13CD3084B258C9202C333DA8A509406B0B39FCC633ACD76A86D93154
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 79cc51ff25a97ce9860caeed5c29e56201654db6acf8825855fda0372a06c5df
MD5 5b22aafcdc3cacf6dccf3463b5695ad8
SHA1 9e9a169ec1122af92a59ad1ce36d7e56413bb4d2
SHA512 6c43f53f49189e2585336f19120a3ddad60e929baba6bceabcd28cbe495b54614b3119f20e81f69d2769c2ef1490dc7468eb1c9a3f56546aa232a78a49cbc9e4
TLSH
T136E0D8BB2DA71424EC9F93D12831A4A50149F8958951EC4E54AAA1D714F2640244AC32
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 b710c34ba6cb78de91e7c513ef94a4d65b1eee5a4ad41dbaa417b5d741929fb9
MD5 a75ee39a978a32af1dc7272bad3183f0
SHA1 61e407c0659ccdf0fc64311105ed0916569f9a5c
SHA512 45561ea41aee851cdb6bce4340c2908933db1342e8d7ae465ef08284f8c7992cd04a4b6f996f37b3a170522e2e13601c42ebee91d21096fb339fd549382a234e
TLSH
T1A7A0023991A65055C00A0A70D0828EC423149C541A27261542B916F8A970962427200B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594f01.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe594f01.TMP
Size 48B
SHA256 e1f6666b316405f97ae9004ff7ff7b93e7ee32ab7ac9586c34e7ab34f7740651
MD5 6fde0dfba1db6b1f313e6b36a08bf780
SHA1 63bec9b92c30ccca04afab77fe6ba570a3d96c92
SHA512 a4b1e2da8e52ab1fb19c9fd150dfcbbd4f168dfd0209d864ada4dd4c01e0bb429ecc9740660c1bb2ee99cf9ba6449c1c8700838e1e7f3744b65623dea9cd2b4b
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 4b27f87a8a81498271f1de8ce3ff45cad08e7f7ed9070a2882872f2da4927456
MD5 6d612f94009267019c9920873d195aa4
SHA1 839d60d73cc88fd79ae5e9aea3507fd48abed00d
SHA512 ac8aa25f18ccdcf0ff5e32decb5da12a5e4ca502e9f2d407ae052ca352c2a0af5564b1f27e1dfc9e95f782e1772cafb91d3db1d8f840eb677fad4a0059df3347
SSDEEP 96:KkE4Kh6CtWnimAEQgksBzuugKm1uYgS+ux4KaxGKagNdKKWY6SOYKrqkLSKYAM:SnR/57BnSZ
TLSH
T14EF15611333B42823A7E248EAD64B46E42C674673159A47B77B844B60F7BE20CDFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58e6a2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58e6a2.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
Size 3KB
SHA256 8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
MD5 94406cdd51b55c0f006cfea05745effb
SHA1 a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9
SHA512 d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3
TLSH
T1F681BE27C5B58E2796F060119750E654F53D43AFA600C6AFB5FC825C2F373ECE88A4A8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 6423cab4f89174167c40f1bccfd1f21a7ed3b9e48e5664922e29dadffc8e9483
MD5 ebc2caf075f9a2120bbfa7eeedb8cdb0
SHA1 d30c71752d653a4df314f9f02d11ec8c3372f869
SHA512 e31eeec401dc01c8446866053357a22755ab25b878182ba02c8b9aa3ab695d227d81e2f32686d48494865448eddd003615403127a7ac8cc69867b6a25ce54c55
SSDEEP 384:nFiFUjccCs+Bt0S3hAsNg8TUNTUlIl6Tiu7u3OBCxekIdHgTDfhpq6/MeSUXU/AE:MFiccQ+rwg/5xekIdAhD0eSUXabW6M4f
TLSH
T175D2A4F598D7893BE9AE4793A33E6E469EBCC0A775841994FB854D0CCC821BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 981cd005b64d4a307df3a410c2ef6df334b97b78fc8db6d37bcfeb9730c1e449
MD5 7382bdc0ef76c0f2dc5925fceccf0500
SHA1 e81bc182bd0e2341db9ad1f581ce220dcc59cd29
SHA512 ed316147de423c67216a18b455f4232ad54f65fe6235ed03599a34d888025d660fd60c8554cc0bed6a20abe777d4c06453f9be672236b246ad024f827b8b16b0
SSDEEP 384:nNjccCs+Bt0S30sNx6Cu7u3OSC/rgDq6/M5SUXU/AatId6qlZrYf3f:NccQUy6/cZ05SUXabW6M4f
TLSH
T18A825A7168B86D7BAAF3A925F0463B175FB050BB9B802F64EDD98B1D01D76EC1303825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 571464fbd94c786d3effc7883bd9d8b3a9daf83930e672331a38b2a4769669b6
MD5 448a71af674610ef64ad4f81c36ca43f
SHA1 85f42a02988344997cbf2a210aebb25ffb6013a7
SHA512 0353596bc4cba5db349742ffa7ce2b803759be33cb281e71c1745cf1bb23bbc3f8054bcea6ddab27ea7b1f1f0b15499b8c58bf708c3a7179652f4c223061f1c0
SSDEEP 192:ZONr6IT0JZQmiUysLYOgibFsxo4FuS2nU6:ZONr6B3L0Ogiq65SkU6
TLSH
T18702FA3568686C7B8FF36E55B48B7B235FA4116FDA953F84DAE81B1C00D759C1303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 30cc9c7424f0ef754231b0451746279ed446c8a7d4a49acbaa1cf24734672f69
MD5 f16e94080db4f73357fe04ba877d7897
SHA1 98e3ca5dffcb9311bae454e0e42e2efcd34f51b1
SHA512 25069ff7d9714b07c9d25051d06aecf98d203e2399e959ba47fed46b95bf3894d1afaaa1b758865d6a715a92d25374638f2a9bec78a469b36ce7d37aff970e27
SSDEEP 384:nYjccCs+Bt0S3vsNxlCu7u3O8C/rgDq6/M5SUXU/AatId6qlZrYf3f:GccQPXs/cZ05SUXabW6M4f
TLSH
T11E825A7168B85D7BAAF39A25F0473B175EB050BB9A803F64EDD98B1D01D72EC0303925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 9b3489613fca3c1384187b9822af89258eb0e48c6d2061898278db0b1a469d66
MD5 0cf7048480f72c5f2a8fedb2a3cf8a6d
SHA1 c1310b31ca1e74eadefe263a80dca55445022baf
SHA512 f07154e87a4782c470bb6ba450959d7a7c369deb6ca56710ca40eb185005769ee1020e23a785e15d99c34f2f13db9743591c0ae0d68cc97a1fc1f77f44b38523
SSDEEP 384:nFiFejccCs+Bt0S3hAsND8TUNTUlIl6Tiu7u3O7CxekIOHgTDf4pq6/MxSUXU/AE:MFIccQmawg/1xekIOA4D0xSUXabW6M4f
TLSH
T1CCD2A4F598D7893BE9AE4793A33E7E469EBCC09775841994BB854D0CCC821BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8ef7dc193af79ba1b67811d32e48081930956be28099fd69442bc847e3d69ca5
MD5 974dec8f500861d04633c0a64d0f81a9
SHA1 902884504aa0528bc5dd7117d96bf6b0823ca93b
SHA512 54343fb1cfec59fe2568f61c7e64047bbee58f52fedbc42494f5b2df5077cbc71b2aea5ee893ff49825930b5d8d0c39bb1a134ad80700acbedf2b38450353b5e
SSDEEP 384:nrjccCs+Bt0S30sNxxCu7u3OSC/rgDq6/M5SUXU/AatId6qlZrYf3f:HccQU36/cZ05SUXabW6M4f
TLSH
T1CF825A7168B86D7BAAF39925F0473B175FB050BBAA802F64EDD98B1D01D76EC1303825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 50370511b8157e2c8866f57d0bf9f895969959a7bbf71627cf74ed07b3486ac7
MD5 be5b75c494184caa3ecad4bf6a0b8edc
SHA1 6fb74efd8e3bab93a972e2f301d1cc4c5002638c
SHA512 742d60e96bb5a4014dc2fd9a0c4245490cb96a48f77ad1742da0760a588a2c03c0d65368f5f25e0db2538d6a0030713ae34b405afb035ed38fd7453b3af9d30c
SSDEEP 192:TON86IT0gQmiUys6YpgibFsxo/MQh1SpqZU6:TON86oLJpgiq6/M2SUU6
TLSH
T165121B75A87CAC6B9FE3AD66F0473B238FA0116B9AC53F94D9D54B1C04D769C2307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 37e6a01afda760f654bee95329e3577db77953a13bb8891d7524d3e255561cc1
MD5 8557c1f632ae04aa8365b99d028308f5
SHA1 f7063a1787fae7e7fb17e8f10fa00e9ce85fa6f9
SHA512 91e8482bf1f53ea226c014b5d4bf58514ad9e967baecdaa0ca782ea4def4f2033a8178e8f3a1ae579cd5d8763cd919fcb356b9aab19634ec0e1deed6498043b8
TLSH
T160E00207E70110E6C128033040431B641AD3C03103F5120A5A64217C2C333012D34F44
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5915a1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5915a1.TMP
Size 392B
SHA256 6e7920c36465493839462ef8ae8a628ca76baec799b125ee0cf02f0f2cad9ad9
MD5 8d2c01944171f37e052bf98dee2a1fe8
SHA1 70d83c70b687a83e34d749bb1d5d8159e696fecd
SHA512 766fe326a02deed35431f8df2a172543fb4b53ee39d40d600e1dc3443c9a6af0852f7baa6313ba9622b271505330c369f6ab22fbe8d0c50aa496bfdc537b8270
MD5 SHA1 SHA512

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0e5aff806d3ef8751b1b612d28fd8be0a0fe1eb7a1b9e47cd27cf9e395a8f04c
MD5 e88318c9a27815beab1abc4218105120
SHA1 1fd15fea0f79596eba0d6710c4c988cb34d24f67
SHA512 7cc98e64e41b2edf56ac899572a62f8a59594be4dabee669ab592bfc4f7c23f98e36ec86a7e8c10a693b94d5f98a0f7dd7019c097fe057c61779f9bc416d2cda
TLSH
T183412858B6E91148B3776F569BF7A87E44BBB8372F06D09E00120E4F0A62B41DD61B37
MD5 SHA1 SHA512 TLSH

Submit Download

218e884f-e7df-43f2-956e-8e1aa101b9cd.tmp

Path C:\Users\Admin\AppData\Local\Temp\218e884f-e7df-43f2-956e-8e1aa101b9cd.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3e75ed7e-966d-42ce-a857-3bb58acaba35.tmp

Path C:\Users\Admin\AppData\Local\Temp\3e75ed7e-966d-42ce-a857-3bb58acaba35.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

AutoHotkey.chm

Path C:\Users\Admin\AppData\Local\Temp\7z97AF670C\AutoHotkey.chm
Size 1.9MB
SHA256 de37a93068ca25701b3413eab0f01fa1646d2dab0346d78494192e95d94ad521
MD5 17d5e275dbc8278d888f7da1d681d7e3
SHA1 245cd35e6caa42fdd3936d2122c7464c877d6591
SHA512 041420c5fcba5d2fa5e2d549319948eb77b416cb32ce848218b2681f3bdb5a7ab50d795cfdabd068330f6a4f16812ae91564d654a958b0f0bb188d11890c4ad2
SSDEEP 49152:7X6QKboATWz2KXn3H6p2HPIn5lfkwHiAUG8E8LbBpOh:7Xf6oATVKqp8Pk5lNHi1GCbBpm
TLSH
T15C9533D3822C8995F0DEADB51EDA64BBB605791C4043BA93A0DD41D0DBD9E3EB30463B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoHotkeyA32.exe

Path C:\Users\Admin\AppData\Local\Temp\7z97AF670C\AutoHotkeyA32.exe
Size 775KB
SHA256 6a98b438b67da7316e9251eb1a92cd5384a8349d239a77903f7282fa076a77c3
MD5 fd94b77958305a1ac3eeac27ee765256
SHA1 bdf7f5633cd529186c7c9c87c120a58c35515d2e
SHA512 1e97ddbe9374513ec9a1f51313efb3621f81a309bf78982688b4c19aa389f0b422a604d8adcd84dc1ba28f44135d30edde06e32705fe02762e92cf2bbc725a91
SSDEEP 24576:Xm5sulQV7Bf5eUHngzv3xynU96at5gxqR:N8QV7RZov3xY5
TLSH
T148F4AE51F68580F2D9E134B211BABB726939AD69133049C3B7A43D7D0E726C27D7A30E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoHotkeyU32.exe

Path C:\Users\Admin\AppData\Local\Temp\7z97AF670C\AutoHotkeyU32.exe
Size 893KB
SHA256 ba35b8b4346b79b8bb4f97360025cb6befaf501b03149a3b5fef8f07bdf265c7
MD5 b6af97aa32c636c3c4e87bb768a3ceb7
SHA1 83054af67df43ae70c7f8ac6e8a499d9c9dd82ec
SHA512 54d2e806503f8a4145ee1519fc5e93cef6bf352cf20042569466f6c402b0a402bce99066decd7729c415cd57da7a9923a1b65926b242672731fe2f9709cf6920
SSDEEP 24576:Kbi/QhDC8mY93kyw8hC2A5CxLbRpWrzzZyP4UMdg:1/QMnl5YL7WzZyQRd
TLSH
T15B156B52B3C7C1B2EFA219F3D9B553360939BC68133889C7B7D8382DC9A16C06A75359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoHotkeyU64.exe

Path C:\Users\Admin\AppData\Local\Temp\7z97AF670C\AutoHotkeyU64.exe
Size 1.3MB
SHA256 effdea83c6b7a1dc2ce9e9d40e91dfd59bed9fcbd580903423648b7ca97d9696
MD5 2d0600fe2b1b3bdc45d833ca32a37fdb
SHA1 e9a7411bfef54050de3b485833556f84cabd6e41
SHA512 9891cd6d2140c3a5c20d5c2d6600f3655df437b99b09ae0f9daf1983190dc73385cc87f02508997bb696ac921eee43fccdf1dc210cc602938807bdb062ce1703
SSDEEP 24576:a3CTQQje6KWjFUsTNEDcN20pah5nQsrivkdhWeWr2O8hYzlj1TNp4j7YoqK:a3CTQQjxKWjFUsTWDcN20k5nQsrivkdq
TLSH
T196559D0633E6C0E8DEB391F6C5299623D772781407389BDB25E0592DDFA3AE05B3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ANSI 32-bit.bin

Path C:\Users\Admin\AppData\Local\Temp\7z97AF670C\Compiler\ANSI 32-bit.bin
Size 704KB
SHA256 f5a5c05bf0fedcc451ade5676a5647e828a6f08cf6c21970e6c035f4311b5a3c
MD5 31ed560d3edc5f1eea515c4358b90406
SHA1 36efc45f806ee021ef972dc80932f13f532d9ccd
SHA512 cb410bad3297493b68e51677b920a808393a30096eefd1cb2c7cf07c8432c78658e803099841be8167eff3f42475b765992da7c11a31e39108ba49010b07ba6f
SSDEEP 12288:mU+9H3900EJqrekLEyTYQcDL/TNuUCziP6VFGO5lrEaKYNtcBvAuvlee2NCFbLkH:mU+9XNrenyktDLdYNtcdvQNC9wHAP5cX
TLSH
T1CCE4AD61F69A41F6E9D134B011B9E7325939EE752334BAC3BBA43D7809312C2AD3934D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ahk2Exe.exe

Path C:\Users\Admin\AppData\Local\Temp\7z97AF670C\Compiler\Ahk2Exe.exe
Size 972KB
SHA256 754a28ed76a7b4eba7909b146cfc4c4c2aa43aff54e10a5cd6dbc939c0732b6a
MD5 78515b1091f74c0f828aed92d3c972b0
SHA1 0103e030518db102631310ce4e2eb7673d7a1994
SHA512 8edcfe6a59d56d69f0fb7672410fcb24fa0722a5d651f076a3b76a424140e162a213fb038c995ae9c2024929c88aa1fbd979694a485163c2d3f8ca3be75502a2
SSDEEP 24576:Vbi/QhDC8mY93kyw8hC2A5CxLbRpWrzzZyP4UMd0I7W:M/QMnl5YL7WzZyQRdM
TLSH
T14E258D82B3C3C1B2EFA215F3D5B557360939BC78133889C7B7D8282DD9A26C0697535A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicode 32-bit.bin

Path C:\Users\Admin\AppData\Local\Temp\7z97AF670C\Compiler\Unicode 32-bit.bin
Size 822KB
SHA256 2d193510b56fbdb8530f8ded2f1c9fb982df971dca5fad1f24f558be16a4f804
MD5 db213c2dc5d0f542a1e925f09c021e05
SHA1 41bebccc1dd9c44c4407892daa3d3fe44c2216d7
SHA512 dd0977a599359f577c5a52d0f86092a12488f291613a0d4812fca64e0553c4d61501d5213e7afd1a62c62da8470e4453f8d1ea2bbea0be74ab223bd4b47e97cc
SSDEEP 12288:9YEd//LbpeDJ4jfiIaBRtwfESz9pfYbVC3pKEVj4988fH:9bJIJ4TiIaBYfTz9wC3pKqH8fH
TLSH
T1FB056B12B3C7C1B2EFA226F2D67453361939BC35173C89CB7390386EE9A06C16A79355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicode 64-bit.bin

Path C:\Users\Admin\AppData\Local\Temp\7z97AF670C\Compiler\Unicode 64-bit.bin
Size 1.2MB
SHA256 6e7c9ae1daabdb958a4d9c8e7297ba956c9504b5f76ce61fc31281f5bb0b0b55
MD5 30da2df436169d6f09732e61d8849a05
SHA1 25694362dfa391caf55733772ca61a95978d507c
SHA512 134b616b01a18f9451cbfd947d6dfcba21a31615a5cb513a29c6e5f77d8bb2776e868a215f7f533b1bac6a82536cd8838db7b1f69025735cbacf94afce158066
SSDEEP 24576:lUNxvqF6FGYJf6yjNQpNONZNlTX5PlGPgquLEIWxUc7N11QaSYx7Gqc:lUNxvC6FGYJf6yjNQpNONZnTX5PlGPgc
TLSH
T175459D0733A6C0E8DF6790F2C6255223D772781117389BDB64E06A2DDFA3EA15B3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Installer.ahk

Path C:\Users\Admin\AppData\Local\Temp\7z97AF670C\Installer.ahk
Size 65KB
SHA256 ef88ba74aef53793937ddfaaca4908772fbaf2e7c9bfb5fdeb3c0a6b95755cd0
MD5 015d8f0a9ba93e41f418b8db8bef6a10
SHA1 06d35e419dc82f91d123f129b88ff46511d1cf2b
SHA512 cd034768b35fdb96251563cb87cddbfa63c55bfb798aa8ec6fdd9faa6b0155d6b42bc30ace6fe9034aac45ba3abc434613df2cb0e07a4b1b0bf0ed8ebb2e71d7
SSDEEP 1536:iha0PbLo/88KSAn4HJzlbfuxp7NaBNZ/MXtM:ihJYxbfuLMMXtM
TLSH
T17C633B02BA0A4536D673635DAB336903FA16851F569706007CEC41EC2F7B52E83A9FE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Template.ahk

Path C:\Users\Admin\AppData\Local\Temp\7z97AF670C\Template.ahk
Size 324B
SHA256 23e5115a25e2d539057443b0f0e9740b9ae85d7de0da204f1d739c9b2e206058
MD5 a85eeb1dc6f9a33897c407b4240dc20f
SHA1 be409c1ba630f2f11ab31e5f42c8a90ab49e8d8c
SHA512 9ecaf71105745739d79207313bc837ecb9fe63cd1cb66e75808e615dc58f5d931f9744fbb04c74085a8cb03142ce43611af7763e8b21e4821a32a58b0d64f77a
TLSH
T1A9E07D217684A2DE9E6823430E50B113344C535C13C5F83A05B35BCC23416720F6D776
MD5 SHA1 SHA512 TLSH

Submit Download

WindowSpy.ahk

Path C:\Users\Admin\AppData\Local\Temp\7z97AF670C\WindowSpy.ahk
Size 5KB
SHA256 4688629be394986c8dbe6517032429e6e8cdd9f5801ddb1ac1f53e6fe86eee7b
MD5 32020e55548b1e9e7ce22899617d5cd2
SHA1 6aaeb5009dfae698449449e560feda2257187fd0
SHA512 12b5ec622a7f5d3b07d7db821002e4d7886095be0274509d721040812bcf01348daa6a6c9db485d6ac6b58f9684443db0a31963433a33cd3e8a3c7c2e3119475
SSDEEP 96:qama1ocNHbBffkP1TIQP1Iqc7WRSdqr+nTGNRp184yGSc0RcJO0M/cEcVMiTogi8:fma1ocNHbBkP1v+f7WRSdiWGNX1ivnRs
TLSH
T138C1C8003E6F733493A2134F77734C99E229622B84DB14227139ECDCB66D0620B9E78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.txt

Path C:\Users\Admin\AppData\Local\Temp\7z97AF670C\license.txt
Size 17KB
SHA256 b27c1a7c92686e47f8740850ad24877a50be23fd3dbd44edee50ac1223135e38
MD5 e3f2ad7733f3166fe770e4dc00af6c45
SHA1 3d436ffdd69f7187b85e0cf8f075bd6154123623
SHA512 ed97318d7c5beb425cb70b3557a16729b316180492f6f2177b68f512ba029d5c762ad1085dd56fabe022b5008f33e9ba564d72f8381d05b2e7f0fa5ec1aecdf3
SSDEEP 384:gq2PmwE3b6k/iAVX/dUY2ZpEGMOZ77oPyBrsS/S9B:gzuh1iYWrTXoPAs9B
TLSH
T18182A32E7B0503F20AD242916A4B68CEE31EC079763A1155345DC1AD237FE39C3BFA99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7z97AF670C\setup.exe
Size 872KB
SHA256 6d876c526b5cbc5dc5341c1011b1c91639597f46677a1d42426f4a52dfea6756
MD5 b98ee9e00b5546763f9c6e65e436f6e6
SHA1 a28e2b0ba6cc748d166b2eb6d0c8acb0bd3b9f3b
SHA512 556e632fe39231622398c5afccc51d01f25bc430705a126737877ed9f354c7076b5bf3cbac27f8a1c4db4d326b6a8848fae4b8d6046f816597c370d06e824591
SSDEEP 12288:TYEd//LbpeDJ4jfiIaBRtwfESz9pfYbVC3pKEVj4988fpIXxnKubN:TbJIJ4TiIaBYfTz9wC3pKqH8feXxnNbN
TLSH
T105157B12B3C7C1B2EFA226F2D67453361939BC29173C89CB72D0387DE9A16C16A39355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4364_509528987\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

80b6f86d-4a2c-46b5-bccf-7d695b9c85e8.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4364_809745695\80b6f86d-4a2c-46b5-bccf-7d695b9c85e8.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoHotkey_1.1.37.02_setup.exe.crdownload

Path C:\Users\Admin\Downloads\AutoHotkey_1.1.37.02_setup.exe.crdownload
Size 3.3MB
SHA256 49a48e879f7480238d2fe17520ac19afe83685aac0b886719f9e1eac818b75cc
MD5 c2e8062052bb2b25d4951b78ba9a5e73
SHA1 947dbf6343d632fc622cc2920d0ad303c32fcc80
SHA512 c9a5ea57842f69223bd32a9b9e4aaad44d422f56e362469299f56d8b34b5e8bbf2b51d4e64d2bebe6c95d6d8545a8a88e6107b9b0a813e469f613e1353aad7a4
SSDEEP 98304:m7EROaI2yEbVidvdahm6QAxuE4iLqmzLdtte96g:m4FyMVq4og4iLqmNqMg
TLSH
T13EF53304E106A5D2F5F072305DA1A7D08C2ED6A26ED26D772F6FD8AAF53F0213D52788
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FishSol-1.9.6-HOTFIX-3.zip

Path C:\Users\Admin\Downloads\FishSol-1.9.6-HOTFIX-3.zip
Size 3.0MB
SHA256 7711b18370c738702e6bbfb52840bf803affa56043575816c2b80503b4adfd5e
MD5 3c5497c27c24e7f7e005a0ec484af853
SHA1 f67944d7098dbb7a3e6b0edeade9e616e7c44040
SHA512 e13165892b1683a7ec53ef51f2789bed57f0200c8cc87cb2250acc0b00a096df75e645355835b3b9fa3eb18b5b4340fc7c2d440771c63d67daf0a24b7dec9231
SSDEEP 98304:fm+fazlKwnf+FTWoMYMcejn96oPqCidsPI:fLCzlKwfQWoMYMcezhidsA
TLSH
T1A0E53306C9A27833D8EA4E76850E8BD7EF8D68869B7918D4825ED3CF4D0FD612853343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/568-799-0x000001E71A650000-0x000001E71A71D000-memory.dmp

Download

memory/1908-800-0x0000017E14800000-0x0000017E148CD000-memory.dmp

Download

memory/4968-827-0x000001670C860000-0x000001670C92D000-memory.dmp

Download

memory/6048-1892-0x0000000000800000-0x00000000008CD000-memory.dmp

Download

memory/6096-1839-0x00000000008F0000-0x0000000000953000-memory.dmp

Download