hxxps://dosya[.]co/k0jv8zwsd4u4/YT_Lendox[.]rar[.]html

Resubmissions

01/05/2026, 10:36

260501-mne4xaat4p3

01/05/2026, 10:25

260501-mf993sas8q8

01/05/2026, 10:22

260501-mefdbaas7p8

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/05/2026, 10:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://dosya.co/k0jv8zwsd4u4/YT_Lendox.rar.html
Sample260501-mefdbaas7p

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
277	1708	msedge.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\International\Geo\Nation	winrar-x64-721.exe
Key value queried	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\International\Geo\Nation	winrar-x64-721.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 5 IoCs

pid	Process
4600	winrar-x64-721.exe
2804	uninstall.exe
4484	winrar-x64-721.exe
5424	uninstall.exe
1584	WinRAR.exe

Modifies system executable filetype association 2 TTPs 16 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5048_1158603983\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5048_1158603983\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5048_1158603983\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5048_1158603983\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5048_1871455849\deny_full_domains.list	msedge.exe
File created	C:\Program Files\WinRAR\Order.htm	winrar-x64-721.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-721.exe
File opened for modification	C:\Program Files\WinRAR\License.txt	winrar-x64-721.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5048_1158603983\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\WinRAR\Zip32.SFX	winrar-x64-721.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-721.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-721.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5048_1158603983\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5048_1158603983\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5048_1158603983\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5048_1158603983\_locales\pa\messages.json	msedge.exe
File opened for modification	C:\Program Files\WinRAR\Order.htm	winrar-x64-721.exe
File created	C:\Program Files\WinRAR\Rar.exe	winrar-x64-721.exe
File created	C:\Program Files\WinRAR\zipnew.dat	uninstall.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5048_1158603983\_locales\lo\messages.json	msedge.exe
File opened for modification	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-721.exe
File opened for modification	C:\Program Files\WinRAR\Default32.SFX	winrar-x64-721.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5048_1158603983\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5048_1158603983\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5048_1158603983\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5048_1158603983\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5048_1158603983\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-721.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5048_1158603983\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5048_1158603983\_locales\ur\messages.json	msedge.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-721.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5048_1158603983\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5048_1158603983\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5048_1158603983\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\WinRAR\License.txt	winrar-x64-721.exe
File opened for modification	C:\Program Files\WinRAR\Resources.pri	winrar-x64-721.exe
File created	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-721.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5048_1158603983\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5048_1158603983\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5048_1158603983\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5048_1158603983\page_embed_script.js	msedge.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-721.exe
File opened for modification	C:\Program Files\WinRAR\WinCon32.SFX	winrar-x64-721.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5048_1158603983\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5048_1158603983\_locales\az\messages.json	msedge.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-721.exe
File opened for modification	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-721.exe
File opened for modification	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-721.exe
File opened for modification	C:\Program Files\WinRAR\Default.SFX	winrar-x64-721.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5048_1158603983\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-721.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5048_1158603983\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5048_1158603983\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5048_1158603983\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5048_1871455849\manifest.json	msedge.exe
File opened for modification	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-721.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5048_1158603983\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5048_1158603983\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-721.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-721.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5048_242023597\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5048_1158603983\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5048_1158603983\_locales\mk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5048_1158603983\_locales\ko\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1708	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134221045694749565"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.taz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tzst	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cab\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz2	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ = "WinRAR.ZIP"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lha\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar	uninstall.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\.ZIP\SHELLNEW	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.uue	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.txz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zipx\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ = "WinRAR.ZIP"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.arj\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tlz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.7z\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xxe\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zipx\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR archive"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xz	uninstall.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2144	msedge.exe
2144	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1584	WinRAR.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3900	OpenWith.exe
4600	winrar-x64-721.exe
4600	winrar-x64-721.exe
4600	winrar-x64-721.exe
2804	uninstall.exe
4484	winrar-x64-721.exe
4484	winrar-x64-721.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 3868	5048	msedge.exe	86
PID 5048 wrote to memory of 1708	5048	msedge.exe	87
PID 5048 wrote to memory of 4100	5048	msedge.exe	88
PID 5048 wrote to memory of 6088	5048	msedge.exe	89
PID 5048 wrote to memory of 4100	5048	msedge.exe	88
PID 5048 wrote to memory of 4100	5048	msedge.exe	88
PID 5048 wrote to memory of 6088	5048	msedge.exe	89
PID 5048 wrote to memory of 4288	5048	msedge.exe	90
PID 5048 wrote to memory of 2044	5048	msedge.exe	91
PID 5048 wrote to memory of 4288	5048	msedge.exe	90
PID 5048 wrote to memory of 4288	5048	msedge.exe	90
PID 5048 wrote to memory of 2044	5048	msedge.exe	91
PID 5048 wrote to memory of 2044	5048	msedge.exe	91
PID 5048 wrote to memory of 3660	5048	msedge.exe	94
PID 5048 wrote to memory of 3660	5048	msedge.exe	94
PID 5048 wrote to memory of 3660	5048	msedge.exe	94
PID 5048 wrote to memory of 1080	5048	msedge.exe	95
PID 5048 wrote to memory of 2932	5048	msedge.exe	96
PID 5048 wrote to memory of 1080	5048	msedge.exe	95
PID 5048 wrote to memory of 2932	5048	msedge.exe	96
PID 5048 wrote to memory of 4548	5048	msedge.exe	98
PID 5048 wrote to memory of 5868	5048	msedge.exe	100
PID 5048 wrote to memory of 5868	5048	msedge.exe	100
PID 5048 wrote to memory of 4024	5048	msedge.exe	101
PID 5048 wrote to memory of 4024	5048	msedge.exe	101
PID 5048 wrote to memory of 4024	5048	msedge.exe	101
PID 5048 wrote to memory of 460	5048	msedge.exe	103
PID 5048 wrote to memory of 460	5048	msedge.exe	103
PID 5048 wrote to memory of 460	5048	msedge.exe	103
PID 5048 wrote to memory of 5704	5048	msedge.exe	104
PID 5048 wrote to memory of 5436	5048	msedge.exe	112
PID 5048 wrote to memory of 4724	5048	msedge.exe	113
PID 5048 wrote to memory of 772	5048	msedge.exe	114
PID 5048 wrote to memory of 4780	5048	msedge.exe	116
PID 5048 wrote to memory of 4780	5048	msedge.exe	116
PID 5048 wrote to memory of 1236	5048	msedge.exe	117
PID 5048 wrote to memory of 1236	5048	msedge.exe	117
PID 5048 wrote to memory of 5368	5048	msedge.exe	122
PID 5048 wrote to memory of 5368	5048	msedge.exe	122
PID 5048 wrote to memory of 5368	5048	msedge.exe	122
PID 5048 wrote to memory of 4312	5048	msedge.exe	123
PID 5048 wrote to memory of 4312	5048	msedge.exe	123
PID 5048 wrote to memory of 3896	5048	msedge.exe	124
PID 5048 wrote to memory of 3896	5048	msedge.exe	124
PID 5048 wrote to memory of 3088	5048	msedge.exe	127
PID 5048 wrote to memory of 3088	5048	msedge.exe	127
PID 5048 wrote to memory of 3088	5048	msedge.exe	127
PID 5048 wrote to memory of 2480	5048	msedge.exe	128
PID 5048 wrote to memory of 2480	5048	msedge.exe	128
PID 5048 wrote to memory of 2480	5048	msedge.exe	128
PID 5048 wrote to memory of 1804	5048	msedge.exe	129
PID 5048 wrote to memory of 1804	5048	msedge.exe	129
PID 5048 wrote to memory of 1804	5048	msedge.exe	129
PID 5048 wrote to memory of 5148	5048	msedge.exe	130
PID 5048 wrote to memory of 5148	5048	msedge.exe	130
PID 5048 wrote to memory of 5148	5048	msedge.exe	130
PID 5048 wrote to memory of 1124	5048	msedge.exe	131
PID 5048 wrote to memory of 1124	5048	msedge.exe	131
PID 5048 wrote to memory of 4348	5048	msedge.exe	132
PID 5048 wrote to memory of 4348	5048	msedge.exe	132
PID 5048 wrote to memory of 4228	5048	msedge.exe	133
PID 5048 wrote to memory of 4228	5048	msedge.exe	133
PID 5048 wrote to memory of 4228	5048	msedge.exe	133
PID 5048 wrote to memory of 3704	5048	msedge.exe	134

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://dosya.co/k0jv8zwsd4u4/YT_Lendox.rar.html
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffdc8a7c188,0x7ffdc8a7c194,0x7ffdc8a7c1a0
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,9253069952619853944,1863169477536286622,524288 --field-trial-handle=2576,i,15246655132519217328,1985488197864672847,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,1436067560058738819,6545054354359096378,262144 --field-trial-handle=2576,i,15246655132519217328,1985488197864672847,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:2
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,14084856977313025372,14311762571585042393,524288 --field-trial-handle=2576,i,15246655132519217328,1985488197864672847,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,4466933973948616762,11881117996293571546,2097152 --field-trial-handle=2576,i,15246655132519217328,1985488197864672847,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,16601242340925642673,17909386888911042244,2097152 --field-trial-handle=2576,i,15246655132519217328,1985488197864672847,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5068,i,11872710527355881418,13315886576625755615,2097152 --field-trial-handle=2576,i,15246655132519217328,1985488197864672847,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,9831439570145838090,12584915962597293767,524288 --field-trial-handle=2576,i,15246655132519217328,1985488197864672847,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,12565600077570912816,14652105160552879550,524288 --field-trial-handle=2576,i,15246655132519217328,1985488197864672847,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,11059188638984085751,1724142533525080666,524288 --field-trial-handle=2576,i,15246655132519217328,1985488197864672847,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,11059188638984085751,1724142533525080666,524288 --field-trial-handle=2576,i,15246655132519217328,1985488197864672847,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,8555232852181352025,3616768828406643489,524288 --field-trial-handle=2576,i,15246655132519217328,1985488197864672847,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6280,i,7475693642452393853,15676120913610468377,2097152 --field-trial-handle=2576,i,15246655132519217328,1985488197864672847,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5068,i,4598183973312716963,500466803214725761,2097152 --field-trial-handle=2576,i,15246655132519217328,1985488197864672847,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,11202815953130376198,8009799460520875252,524288 --field-trial-handle=2576,i,15246655132519217328,1985488197864672847,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,15032039006021328905,7926863721525277308,524288 --field-trial-handle=2576,i,15246655132519217328,1985488197864672847,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,9233130770251227797,17456276990985081348,524288 --field-trial-handle=2576,i,15246655132519217328,1985488197864672847,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,3085433838198609965,5574529188321582507,524288 --field-trial-handle=2576,i,15246655132519217328,1985488197864672847,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,3247799992419849822,6193620449907236478,524288 --field-trial-handle=2576,i,15246655132519217328,1985488197864672847,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,4890775557181611633,4069719568465423862,524288 --field-trial-handle=2576,i,15246655132519217328,1985488197864672847,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=2188,i,3204121873174610517,410930360672142268,2097152 --field-trial-handle=2576,i,15246655132519217328,1985488197864672847,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,14441689579751544114,15589768826899254685,524288 --field-trial-handle=2576,i,15246655132519217328,1985488197864672847,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,10750815182925258764,17006664650124122851,524288 --field-trial-handle=2576,i,15246655132519217328,1985488197864672847,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:8
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5636,i,2932646659615755232,7037967054798264249,2097152 --field-trial-handle=2576,i,15246655132519217328,1985488197864672847,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7140,i,5571879710054923586,8771842411441744504,2097152 --field-trial-handle=2576,i,15246655132519217328,1985488197864672847,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7300,i,6602259502843817016,3205626756481952287,2097152 --field-trial-handle=2576,i,15246655132519217328,1985488197864672847,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7516,i,10050711114813826538,7543096477406172144,2097152 --field-trial-handle=2576,i,15246655132519217328,1985488197864672847,262144 --variations-seed-version --mojo-platform-channel-handle=7480 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7580,i,16481068836489246381,9421456771659560681,524288 --field-trial-handle=2576,i,15246655132519217328,1985488197864672847,262144 --variations-seed-version --mojo-platform-channel-handle=7596 /prefetch:8
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7748,i,4868748135085352606,14315595041113429269,524288 --field-trial-handle=2576,i,15246655132519217328,1985488197864672847,262144 --variations-seed-version --mojo-platform-channel-handle=7764 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5260,i,6170604101267716020,6756238879747877525,2097152 --field-trial-handle=2576,i,15246655132519217328,1985488197864672847,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=6996,i,10408951643335108126,18080685440932667313,2097152 --field-trial-handle=2576,i,15246655132519217328,1985488197864672847,262144 --variations-seed-version --mojo-platform-channel-handle=7936 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7392,i,9945269876559555375,7903693492873930861,2097152 --field-trial-handle=2576,i,15246655132519217328,1985488197864672847,262144 --variations-seed-version --mojo-platform-channel-handle=7480 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8164,i,8075730730352882606,5562574457681273432,524288 --field-trial-handle=2576,i,15246655132519217328,1985488197864672847,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:8
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7448,i,8908808867882916703,9787114717020517623,524288 --field-trial-handle=2576,i,15246655132519217328,1985488197864672847,262144 --variations-seed-version --mojo-platform-channel-handle=7384 /prefetch:8
  2⤵
  PID:5872
- C:\Users\Admin\Downloads\winrar-x64-721.exe
  "C:\Users\Admin\Downloads\winrar-x64-721.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  PID:4600
- - C:\Program Files\WinRAR\uninstall.exe
    "C:\Program Files\WinRAR\uninstall.exe" /setup
    3⤵
    - Executes dropped EXE
    - Modifies system executable filetype association
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7864,i,4457775206682186047,8827475736432529909,262144 --field-trial-handle=2576,i,15246655132519217328,1985488197864672847,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2144
- C:\Users\Admin\Downloads\winrar-x64-721.exe
  "C:\Users\Admin\Downloads\winrar-x64-721.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  PID:4484
- - C:\Program Files\WinRAR\uninstall.exe
    "C:\Program Files\WinRAR\uninstall.exe" /setup
    3⤵
    - Executes dropped EXE
    - Modifies system executable filetype association
    - Modifies registry class
    PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7968,i,8748937496633584340,14785612983586637617,524288 --field-trial-handle=2576,i,15246655132519217328,1985488197864672847,262144 --variations-seed-version --mojo-platform-channel-handle=7940 /prefetch:8
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=6048,i,4840694957675730251,12591935656440562989,2097152 --field-trial-handle=2576,i,15246655132519217328,1985488197864672847,262144 --variations-seed-version --mojo-platform-channel-handle=7708 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7668,i,6151725306948214905,5439493266253226306,2097152 --field-trial-handle=2576,i,15246655132519217328,1985488197864672847,262144 --variations-seed-version --mojo-platform-channel-handle=7588 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8140,i,1996117395318084003,14222316205525614425,2097152 --field-trial-handle=2576,i,15246655132519217328,1985488197864672847,262144 --variations-seed-version --mojo-platform-channel-handle=7828 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=4036,i,8703197245216405581,11577972666566609679,2097152 --field-trial-handle=2576,i,15246655132519217328,1985488197864672847,262144 --variations-seed-version --mojo-platform-channel-handle=7988 /prefetch:1
  2⤵
  PID:3212

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5364

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4496

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3900

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\lenox.rar"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:1584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Default.SFX

Path C:\Program Files\WinRAR\Default.SFX
Size 384KB
SHA256 59605ddc35d1b4acb791aa54d4a56ff68ff0ebd890fb5cd373c17d1761dd68bb
MD5 81f4f005cf85404945e3f4b19a224ad7
SHA1 502cd17ed1eface998d4ac618010ee189aee810b
SHA512 fdac0e0373bef058ae714968f2b7df7169298dc0ce246b4d2c16501a149120d29c3a76182ff3d249b8d846997c40c52642ff76077f829cdcee45ca9822969ddd
SSDEEP 6144:pRs9Djkimq76tIy5qHbh4ZkcRKCfmJLaImb4zG8GR4d:OciZ4qN4ZkKdcLtmUzG8G4d
TLSH
T1A8846D19D7E401FDE1B7E5B8CE834916E772784947A1E7CF03A459A21F232A09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Default32.SFX

Path C:\Program Files\WinRAR\Default32.SFX
Size 64KB
SHA256 82ba1ccf06ce0bddac7f53a762f31aedfa6c600bdc8a41c2491cbd1c8f147f22
MD5 384955ad591838e70fe7b05a52f44bec
SHA1 3580cb955ff0faf83916122169a048a39e06e531
SHA512 10c360dde111fc8920a65c503ecfc507beb44c6572480475c20d11e92653b41f808a8aa544a61e83f0bf3c629dd8d0915dcf818738a7a2b31240d4346b11bea9
SSDEEP 1536:IWpGmBB8ByH02Qy/WMN4yWGQdu3Ay7YpM1W:IoRBm7f7kWGQu3dwM1W
TLSH
T1E7539F537F8988F3D56B3AB0FE1C251AB57480123716C2E763F0ED182A25DD2D3169EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Rar.txt

Path C:\Program Files\WinRAR\Rar.txt
Size 110KB
SHA256 ea151b19902e1e289940df30d930669be361c17b279efe27b1dc29741a336cac
MD5 c9606e649f12eab27e485658d497ec02
SHA1 44398e458a783939294d1a894f983ac503c19143
SHA512 e6f831a1115e5fd83191514988c3e00077742807a4ea694bbe913fa278d387cf0d561fadb90158b34844f81ee159561a6b26194a8b518a943cd54a423a3d611b
SSDEEP 768:bodhu8h1SIfjcjKVbRZHwT93KEYiHSToOKyIQiVL18e5xGMm1tgD3cb+WkOPMmuB:bodhuGKKV9ZU9nSbKyIJL1ZYYsiWB5w
TLSH
T181B3C8277E8E1371257201965F1DA199E31090EF271B169538ED838C7F3A8A293F66EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RarExt.dll

Path C:\Program Files\WinRAR\RarExt.dll
Size 659KB
SHA256 e571e767079494d78b9e61b4edba44700088527f148c545ab0db7b08a47d44f6
MD5 9d68248ee7be8f0a37b9abd928c0956a
SHA1 6aced4033a0697dfd29864c7fcb7c01076cc5879
SHA512 b970a360d475d5118229eae04b3bf96b43ddc0f4d55a6da1eb38421762a70bb63d25680bc6a79b0c5575e92b93828b3fff05cda9e4e5dc33c0cde3c112452c8f
SSDEEP 12288:uyrI1lJlLZHJndEB7UFJtdqri2+aFBQKuk9ltyC:uyrIHJxHdEB2JbqzFBQKdltyC
TLSH
T160E48D09A69853BAD47FD07CCA83461FEAB278558372C7CB03A156AA1F177E0573E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RarExt32.dll

Path C:\Program Files\WinRAR\RarExt32.dll
Size 554KB
SHA256 375b1b03c2672a945474d65472c10b322f6c91c31b3ff05c1c2f659167adf6b3
MD5 a5f45b44c32ec44fba1c4b0470458af2
SHA1 06ac2c91e4a5255629c70859e4cb5e3fc0ab7f03
SHA512 f14cedfe4541ef4fe92a9b537abc162755fd9297ab886e8b05b23ede518d00f382093488d45b9fd291b9751cfb6ced91a08fa007008c060661870faa258a514e
SSDEEP 12288:/ZIqOCQC5rFB4siu2ogBFCdPQsAuHjBQKuk9ltyNDpenO:/ZI0QC5pB4sMuPJFBQKdltymO
TLSH
T185C4BF21B8818072E5AF1630992DEB39C2ACED710B7891C767D4197F69F09C29F37A53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RarExtLogo.altform-unplated_targetsize-48.png

Path C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png
Size 4KB
SHA256 5e3c8bbcd81cd0c08819edcbe04772dbd157f79373a0171b7bd914cf7a2cdef9
MD5 ec177cbe676473543e8c9b5d9fb0b797
SHA1 0d1bb7649d090831d2ab1f2fb44f580e0d4004d3
SHA512 925a86b5be1c9fe91cc587b71a3e0d2fbf8eddef06093a8356bffa955b63c296a041729db38a9538dfc811b723e0aca4b7a183ab0e9d12d0a302d1239db12374
SSDEEP 96:HsNP4L15zRkIEBdPWt+zIeofvdWIcq4dkuRQVRv6hKXUvBzpoLb+qSEsYqw/m+wC:MNP015zRk/uczQfsIcq4SuiVx6KXaBzk
TLSH
T16E818EB6339A360CC6D182D96CAF0158070C83F0E8499092818DB6BCA2D641EA7D23BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RarExtLogo.altform-unplated_targetsize-64.png

Path C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png
Size 6KB
SHA256 ed99246ebc6fad80103f1e887dd8388f67eb509fcbba187aaa13556b8d884ab2
MD5 248fa2b659874a14b43b5e0e17ac1cff
SHA1 b6b0671e015104ee7f4bac4e6abf961ec55fdb12
SHA512 1a8e9f0c13d565cdae77cc17942792e33861f056f73422eb2df79fba5dc241a37106c0bf7173f9ba83f517e2016e9d3b8e117df2bd2d5972155781dbf147f90a
SSDEEP 192:F7LhuPsvwxZKPeCHV6sZ68EUDfHZkmoWsm:F7SxEDHV6sZd3Nsm
TLSH
T1D4D18DE4F3A20FB83B3C95049841D49AA560B91324178ECE77B1283057FDF398656F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\WinRAR\Uninstall.exe
Size 402KB
SHA256 d88c873172069fe96285c47683c0a0a7255f59a7710a4a76a8624fa31fa2e220
MD5 04471ae2a16c1dba7fb68936ed984a35
SHA1 b08bb0397b5854e239c87b15ddca3cab235e3049
SHA512 acd67b23f7beabd527824a65790b3e89e0de2bb70fb9041ef827886c87b922a300b92975b95322ed8e80ccc529c4d18e05ee3d873ab5535e38d30947917f0695
SSDEEP 6144:lllRoo4QIa63bknS2ecOTJDPvVbnSfIHbqeC2IIII+Sn5HBK7jcRUi:/lu3QnS2EJz9bSwxC2IIIvS5ejcKi
TLSH
T183948C1DE3A555FAE5B7D53CC8A24607E6723C558BB1C3CF03A1099A2E237D09E39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WhatsNew.txt

Path C:\Program Files\WinRAR\WhatsNew.txt
Size 63KB
SHA256 e44efb69b90453e7153875cd579d05eed787ced598a47fb2ee05133bef197bd3
MD5 611c0f851ca46466f811e8cf1edf3413
SHA1 e9d8e3aa014627a93c78615bbd02dde8ac94ccee
SHA512 89840bfb25963ac1e7fec5300de9005a4369fca0de87b58987189f87da661f6a6173803d6a45347dc7df79249efcbc4c44cd9c59ecf48df45d862217daf6d914
SSDEEP 768:BMiHKKDaVkJimxZ1Z41kVEbUDbwXic9p63Df3fXxuWJo4c:BJqKDakJ/xl41kVxwXicDYb3fXxuqoR
TLSH
T1AC53A4237D9A13712AB242856E156295F31861AF370B42C4787C838C3F369A7D2F76F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.chm

Path C:\Program Files\WinRAR\WinRAR.chm
Size 320KB
SHA256 9c3abf9935d70346451d3760ba5e1ea2bf4f85c45646d0a62143efe3280c1c84
MD5 55981b62c76a7faa13f06461dbdfd0ad
SHA1 4b42c7ea07e8aef01a941060751e02f25c594f47
SHA512 7e525670a0b92c0b9a53fb9394d42a02e1e7baef5fd31fe8f2b6475412ee441545000d4141be40cb0b9298684595ebc415a63f6cd0e1b99b6b59dca41ad268d2
SSDEEP 6144:K1W9Q/Hy3rKBB5k2UEiG63C0s3Vphf3rn333NWVBtKX4ngVTom6XNRLCHSi:39iygYuV3f3j33cKo8oDfyh
TLSH
T13E64121D7D9E9131E8E57D71EACC03CD6324782A00C27B112D4FE9B6A1D8FED8169794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.exe

Path C:\Program Files\WinRAR\WinRAR.exe
Size 3.2MB
SHA256 30ce21663b7c391c7ce56ab0c9b426c915d80afb34a1404065c23f141369fa13
MD5 37ef4a68f976b35c3f3c7fa14b9b7d8c
SHA1 609a77d417187122868bc48d36b7d81542a31d35
SHA512 9b1e07a22355ccc2160692a7ad96ba848f1e5548f54cb1f4c144ab56db4ad77b17a90f236ce1fa5a9244c29a9256efa3990210e116f6cce8e022d0596537a599
SSDEEP 49152:ZKadn5R0oiKZ2v/04A5NrsDi8WsT1qQ4htBertYXfeYzAvaKUeT+uXEkjNEEBHLu:M5AUBJHAa+uUkjDBHLu
TLSH
T15AF59D1AA7E406ACE0F7D679CED6C553D776780D07B1A68F029098A64F732608F39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5048_1871455849\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5048_242023597\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5048_712596634\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5048_712596634\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 924e96ec20750cb6a5239ec6615014ae8ebb3de4d3c60595d6c95e7ccd197fe9
MD5 9b2430d85ce0b6612f557c45f7f3cbcc
SHA1 0a1e10f745cd18a847854cf92a1d4154f1e53a18
SHA512 187d6a5fac24a44192cd7964a293cf55a01134f6bd0ced9759bf4dee1fbc0273c5e118208cf3606ca4853d0f0f145448fc8342dac94a0745638e99f4acafd46e
TLSH
T1FED0801C1275BC31D4BA8575544537092D1DED675543533B5433557C0D87E1085971C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ce180cf0fce9a4a96685bbb0c58efb5750080d37ce961b69a74ae38b49eb68c9
MD5 2abcf056d353616a5983a10f17185a31
SHA1 40d71f06b42cf03d05e8dba44f76231dd24d9fd9
SHA512 5bff16b6683201694139145fd708bf7d834e97a5792e68cfb43b011e13c0e993e1cfb6a8c6f450aa2437fe486fb6f3ff1af62a05b918ee73bc195ec5cb0b3e02
TLSH
T1D7D080181275AC31D4A68575548537093E2DED675543533B5473557C0DC7E1085971C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 660c48d07c3758609db86f70b3cb937181d36a07b3d5eb8a9c7bbaf5452ff3be
MD5 58b850dff0a305aa1ee0c25331593737
SHA1 47ae503a199a909ceac36d5f9b58e64dc11fc87a
SHA512 b3d4bf569e2a3282363bf864fc30960c0e37168b1947d81dd73b7850a435de24be052233f0e4725162f5918c9141185be1ac338dd72095faf3d3cb3a67df5e49
TLSH
T19DE0E5A9C829E86718FC575871514646E76013962B50491B3A3CD21D8FB063A4186C5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000d2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d2
Size 68KB
SHA256 aefd05f4a194fde186877d586fc902495ee1fb5dee2261cdf7b2c18994d5a944
MD5 a5df8d4ea3f834ad3bbadec40eeb38b6
SHA1 7e4576a619f984d8e4e7cbeedaa409e8b7ee4626
SHA512 6d1e2a6b5235efd2137f7692ccfbb448d990de8fb8122786a6f91bc97602f7175fae982f007dddafa502acb0d076a5332b9a6d498ef55f0d97aacda0ff30660a
SSDEEP 1536:YiRNSGeMr5x6mFS4JFXLgXI80VIiVB1dSGQkoIjudKZ2u0:Fzt744JFXLgY80DVB1KpIjOKd0
TLSH
T1DF6302C0A319FA9CD9929BC8AD49C58FE420FF3A3C5B49444BB15563C24FAF1D498E92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d3
Size 62KB
SHA256 df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3
MD5 c813a1b87f1651d642cdcad5fca7a7d8
SHA1 0e6628997674a7dfbeb321b59a6e829d0c2f4478
SHA512 af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b
SSDEEP 1536:Q9pfnSa+E9Az52gNbkYtUtqvUhZRHuLdrx07LXz:uhnSpE9A1EY6tBPix07Lj
TLSH
T1695301D4670EE2A579F2CF23BF59C5C00803162D8E11AA68FFA063878D8430BA793D1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d4
Size 19KB
SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863
SSDEEP 384:/Und3PKicut4yiFkC9RWzlJpa2/CKYOyDJmCZyXJTW4PO821GyLjSoBwNeS:0UizQDYlJpaQCKYOyDJpI5Kx821DS3Nz
TLSH
T13692E1670BCE314E422EE25FA316A51733E41BE1EFE49640D6AA70D81C38DA243179D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d5
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d6
Size 38KB
SHA256 5a2967d18d7d3422b542eb3d09b50b0e1e1bb82af4c97f568b875be8985b8929
MD5 d8c56b194904506cc2139e28d4a99b0e
SHA1 ea54bc190c5966f058a4fc513511f6930f73a9d1
SHA512 ebac87dd0c0a847dabcabfad33e387be4e4c3d2168f627d30ce72609c69422f9ae60b26292b6afcaf694ebc58796649d291de87adee18feb4fb647a99ac7a967
SSDEEP 768:93tW9MnkLU6jaltek2nrfmO5zjLbgLx1wL+W85Et+muG5xNVX8XA:93tGMn0xjaTeb+p9P5Et+muMVXeA
TLSH
T1B203F1F415783EFFC19D0E854A652E38DE2A41A4925AFF59F5398A40EE9C7C613E0503
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 a97644816e4b093cc110ca29a1d0e1beddddc7ea434bc6554dce846ad85b5d72
MD5 a6c6206ddf713ce7fa6fa28bbe592604
SHA1 59f8cf5ac65a4b9ad6bbb577b31d4f480e985205
SHA512 4058e9e65adcd62f3810ea87683efe1f6c97e3311ff0c8300d67e1eb7bfc2ccc61d3daf5b155ac5527309563d57c9943920ad6487bffce399caa953dd9eaaa48
SSDEEP 96:Hfz1YpraiOD3Lr2lW57TFy8aN+yevdjGXnF:HqpfOP7RF3a8ycdy
TLSH
T153E19114B7D284E3EBD00FBE74D858B57939B0A022131F3E36E867FE546B3926144786
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 91928912e6dc808996219186a4b9be9ccd731dfce34ff3cdf7369c6844caaf5d
MD5 0223284abb849f4befb03a0ae9f4358c
SHA1 267c7e3faf89fa60fad02eca34b32c7739d4fb53
SHA512 8c1f1aeb8baa5484bd75042890ad7b65ed76c300d4bb52290690a2709c5462d0b519b450069083e9bb8339c153cb553a86c0a4887e4f63fd5a0c5d5d3668712c
TLSH
T17B716264F7D0C868EBE443BC1AE244B6BD7E7A6842532F0D16D895FFC96B7529081B04
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587d1a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587d1a.TMP
Size 3KB
SHA256 4f3835f9615eae8fa54dff28bcfc3f8bcbf6ad2021cd8c540083992eafd9c96c
MD5 2ec254b78f7c39e8ad673cdcde215a11
SHA1 ff7b7e19fd3c0617aac94da8a4632e9ce4e9f605
SHA512 197105b96309bd379530dcc1cbd36bfdb5dc647a348698399bc6deff3c6ee05143b90d02a1e2a40e66f2058e63b6959d70d44e5244eeba90b300c04b6408f04d
TLSH
T1F1618464B7D0C828F7E447BC0AE244B67D7D7A6841532F0E06D495FFC96BB139085B04
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 b06864d198868ba2b9db276118d008747ce1729ad0d7938617c69cedfdc79ce8
MD5 380848bd408de5dfb750bdd9c8c6000c
SHA1 910b4e5d9be6bedf87c722173373ebdaac5f41c5
SHA512 f0f357eb4775c4ea62e6c25aedaea156af4c90f37658f0c2ebf2ae15e7e47b7591bdbde78784d58e59dc882089aa637dc680e75680f1461e512fb85df6a10378
SSDEEP 192:Dp451QciFvgfzbMsj3Mvw/g98MV63vOnj6f8jQva75OGTcqU2y:Dp451QcilgfzbMsj3Mvwo98MV63vOnGb
TLSH
T155F19CF7C3F8866DC81156F4AA286E1FCE1D0A16836C3D5A85D4AF4BE3E1470E151A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 2e3ea8b1efd1c49fad98dad1d983a8f221ad708fa87dccea99342c51eb43aab6
MD5 ef99c95c5e22f903f44bbfd33cfeba17
SHA1 5ed5394aa12e7a57de7c259ad00ba4780d1c3b61
SHA512 3f69d2153897c99f3ac40ff895106f0099b4d4eac24aa6da97b2578b32955613ddabc408bb09815843de5c727f8ba94f5166c7133444bec35333b0f85a4bab5b
SSDEEP 192:Dp451QciFvg7f1j2+lzbMsj3Mvw/g98MV63vON8PvajkzIvwGj6V75PB5GctzuG:Dp451Qcilg7f1j2+lzbMsj3Mvwo98MVG
TLSH
T10922ABF3C3F9826DC81152F4EA286E1FDE1D0A16836C3D5A85E4AF4BA7F1470E151A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 e69f41b702b45f7f43db2db5d7dd5959c82f77f1ad0b8c0893b4c4cdf2f3dd24
MD5 88b720988841801a45d1e9b0e90394a7
SHA1 d0e175ea01e1032cb8664c141f335b0cf25a74c4
SHA512 31ef6f108a61096dff40c0c595d328008965bfcfb784598e1cf1271ce25dd0b8affa271b0b8d0d86739f87c366bb3b93ce14dffa60405608d369247947f29f73
TLSH
T11BD023932305B075559C1EC141DDEC4FC72700910843D9D514E09CDC1D3765C251B251
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 22KB
SHA256 e1b8d79b41a9250275aad277e98ead057d59647063b5415a25d4e41ad7445956
MD5 d15087ccb27d435034398513c2a29634
SHA1 3a623a709a021e9593605f17c0fb08224e992ff2
SHA512 168bec2a19bd5fd02edf3964c6ae7e9a9b786e72e11a2de2485370857a19bb16b95594adbbdf0f405b9954f9d807a2e14efc6f86e84f022dd15b931af303f96d
SSDEEP 384:sxZena4sm4D/fXsXdzaLJ4LSHbZow/l8Vxggr7VfT33:swapm4D/f8dzcfHbxl8ow9H
TLSH
T1E0A2F853A524997B8DD7D515F966BF63D6F80463CA804E8C9AFCCA0C04EB6FD310682B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 22KB
SHA256 fda36ae4b70935e8895818e1996a67977df8bffdf60b6c558d309a3a4d7ddcdc
MD5 9ff41fc1bda873e67048bbf883a7684b
SHA1 fd1c060a9c479473c5b53cedde3a65f85c603fc4
SHA512 1099d1c272af2a49bf65b295c0b8429219fcbde39cd5d809233ffc5e6d3512357f31a0d2c2744fba5d9f1139b89d4498ffa0b9837503508745b3e42e0d84480c
SSDEEP 384:sxZent4qe2m4D/fXsXdzabacQqTHbZowD/l8Vxpgr7VfT33:swtfVm4D/f8dzEbpHbtl8Bw9H
TLSH
T10AB2E8536524897B8CD7D525F966BF66D6F80463CA804E8C99FCCE0C04EB6ED3506C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 22KB
SHA256 08966af6c23fba2317233d7e7c210dde4ac313ee7a49b9f35975076180982797
MD5 10fedd84208834ceef13df794c61f259
SHA1 ca2cb50944fe2f0926156ac3f0429c2779aefbaa
SHA512 6f8c4dd36a6c8f915e6e40e33338bb3faf9bee4c50a4abb448b0f57ab2ba3ab6cf956506552787c484c632c9bf2166c91b73b0aad98ef815a5c5e2e346e37f2d
SSDEEP 384:sxZenz4sm4D/fXsXdzabaIRqTHbZowD/l8VxOgr7VfT33:swzpm4D/f8dzEl2Hbtl82w9H
TLSH
T114A2F8536524897B8CD7D525F966BF66D6B80463CA804E8C99FCCE0C04EB6FD3506C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 e0e2a09fbd465fc9f573980c27f14e2bcdb49a55f4d598137d73c26515c5f5fa
MD5 777785ea57d53c6fd76572db35736ec9
SHA1 3686f031d791f154dbe945a78271e5a84eccc5c0
SHA512 0501a0e804949cb99ac31d23ce00acc47e13a5caf1dbe073b1a8e2cd75eada8bfa6c7a825deb691f37f396d0f96c762e71ff955da9c1eb47c93069105c56660b
SSDEEP 384:sxZzY1D/fXsiRzaLdcDHbF/l8VxogrSl6:sLYD/fJRzcGHb5l8g7I
TLSH
T14C72E9166938997B8CD7D219F685BB93D7F9056392904E44AAFCCA1C00E7AED310782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 622310b46d0705f8464f47e775b729c393be942736cc7601c47a24493011ca92
MD5 3b0648456c884b32bf3f7fde62df52a1
SHA1 c5466e04cfcb8026721f679a944fb49a49d5f54a
SHA512 adf52f13460b7db4b7a7cd9bfd4ddac6b8a06bfb15a7edc66d1037f1f21b7da9768f426228c6dfb2d489aa4a2a5121837ddeb53b334a29a30d6eae40c79c9f31
SSDEEP 768:KJ4Z0+27pLuL/8MWv80Xo8F1+UoAYDCx9Tuqh0VfUC9xbog/OVvYsLLlXZUJRrok:KJ4Z0+WE/8MWv80Xou1jaaYsLLxyJqxS
TLSH
T150F20B3B6C4CCB7E4F804E9CEC2A7E8E6DE8028F9698885447F9944C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5164943d-97da-4fb2-9a39-4b8756f5b3ef\index-dir\the-real-index
Size 72B
SHA256 8b929346dc60cf77460fc0dad40797eec998f4b89fbe93b3399f2474d88e863d
MD5 d4f92a41bde701d4757b541e2104319e
SHA1 23cd3382a3f7ca58bbfad98e8161c7872d3e2477
SHA512 eed2b75ad75ed588fee8bd3ba59de5408ccb77785688c071a7fa031b5b051a877b756b58014a6f98b911b45bcde2bf2a7829b090887e1f2d6aa4fb370ebd9ad7
TLSH
T1A5A0022D85561099E73423B310CB89B1A2105C908289435950F941888C517509701132
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59905f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5164943d-97da-4fb2-9a39-4b8756f5b3ef\index-dir\the-real-index~RFe59905f.TMP
Size 48B
SHA256 4ee639fc8bac6cd0e6b2b7afd7de1d07783203a1d707ec622627d89fe0b04552
MD5 2959c073bbbf9001afece6ababc8eadf
SHA1 12d30e947a5affcf0b636707080268aa8f63bc88
SHA512 cd0c0051412fac118d46846ec888e1a6e58fb085f36932f39be8a7962ad9f4701a578375fb746c8351a6775b9fbd8f926c4e8bcbbb6a0f82c3542f2d06de9d86
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e1940040-ba3a-4882-afdc-249f8af79c0f\index-dir\the-real-index
Size 72B
SHA256 4f77f9133d6dd5834374b8a33023ed845fc58b6eec01c152889a45efe48f469a
MD5 94ad21947910d22811bf0c88f44e4969
SHA1 6cfd7118bbbbdf0d2d25193626765d7cc2922500
SHA512 03d4358894764770b0b65b933b934404a63aeb2591c9a0690ada864d853e61e6525ded0a5d2bf9fdb2d03f9d0901898354a73c11e209958d6f2d9a01831b08c5
TLSH
T164A0022041798951D4010FB5964201652315FC9A0601430740E3447D9E521E94D03145
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f589e95c-170b-43c1-871c-9ea072d3076c\index-dir\the-real-index
Size 72B
SHA256 70fb333910bc20f50aedbdc6052945e2b5831cd4bbffd6500a4d151b4c13fa13
MD5 d90fec89e59a2401e3a6eb60e5aebe66
SHA1 7107aec12dc79126597d0a89585f47bcd0d1e287
SHA512 47da2a18d0fbbc3c13aeed6d9dc250d865a9001d52fe89131c8ff9bc17808b1f0f827f2159d78446a697736e56412ed7648023b98a32d8505b0c0923c8ebc774
TLSH
T158A0021C12904446C41366B039A785D52330CA102A01133B61E067C8CC505475D5202D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f589e95c-170b-43c1-871c-9ea072d3076c\index-dir\the-real-index
Size 72B
SHA256 f9a118e27122608a633560fbe1bfec8a5029614f9e8e466a5b17dcb36297fa0a
MD5 a4be4c016afc2c71cba8dde98d8a64f0
SHA1 3c158398f151e7f42c9e442e73b8c1743fc6186e
SHA512 e59b11b59f771aac0c7bf6e8a325d1b5e2a8fe859f74209268e8f9b2565e0baae17324c7f69d0563980abb91fbed006e83022c30f2df3db1f68b5e020fbde296
TLSH
T108A0021443D4201AC0279EB11593335533108C912142532B40910445CE905814BE11AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f5ba40f3-432a-4c7f-8e37-0710a00cf07c\index-dir\the-real-index
Size 3KB
SHA256 036c99c4627cf88f1f11a0afdcb99855dfda9d41588fc1cd164305334c713357
MD5 a62ec4ffb02d354106f2b614ee083511
SHA1 a706c2ca547bc8abfb3e96ef893a14e57d7774d3
SHA512 46ab628935c4e98d432241e350fee09a768bd63dfc1ea642122365039a53241752527feb503771221ff2813ef6075a84b4c8d5d461a23fa68fd3b79de4479424
TLSH
T15151A78D0D476BB7CDAC45B21AF20885333C19DD67949A379CACA134748B73A1E6B748
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f5ba40f3-432a-4c7f-8e37-0710a00cf07c\index-dir\the-real-index
Size 2KB
SHA256 89c1e3c14f387808d38a7420ec33035120c64ba273d64cba379e0b973a70decd
MD5 58d431e2fe491e00a79bbc60962c8df4
SHA1 183cb1302b80cd77d859fba2b6bea08c66541538
SHA512 59f8c42c06d429bbe870eea3cb527e806047e464e080ed12b2bb713735874ce91c8bf4cb1ac532bb290383fdd9ed3529349c8037292154f97209ce51563a9155
TLSH
T17D51D98D8C972B17EDAD42B244F60458333C1CEE1B4C5617BCEC96348C8B6A528BB354
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f0b4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f5ba40f3-432a-4c7f-8e37-0710a00cf07c\index-dir\the-real-index~RFe58f0b4.TMP
Size 2KB
SHA256 5aa9fdd5ffb9c09d60f360f178a385a4b0350955d59539814b57488c387d30c2
MD5 b29b9d8953b3fc75fc0b61d1d253ecc2
SHA1 d9951c6efa121bae7067ec7dfce61e1eb0a073de
SHA512 da60f05a72ccb8292cf6720e7491f9c1b53c2d0efdcb6f81d26f52864c7d3e49cf7f28288a83e7ab8017135585639dfa1d5b0f5e2a97b4160164bab574f55f8e
TLSH
T1A651A55A9C420A22CD9081B349CA5069333E68954944AF0B34EC8A33ACD37AE3D66384
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 46373ff2bdeca32b214b1df8bea28bdee093875c5a81a3da335a9180547ae835
MD5 f99bf0e2be310346d95c6448ba03a12b
SHA1 7c7b0e2d9578454ef781559cab47aef72e7d0cb3
SHA512 dcb56d6d2c739be9e34d3ad1b104c409c18e2c12d08bc9706cd511d9631d6b40f73aed062a0909c76e4a22bf4be8e0a088dc26e75a09747a52e7e99b368d2ec5
TLSH
T161F027B62DEB1810FEBBD3D6B97254A001297C68C980ED0F541AB29B90F0B20A44DCA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 534280e5db71356f338f359121d5634f31f75c33215848d808d4982b48ed4a3c
MD5 35b967e9ac8875dd87d96eb45e3a941c
SHA1 6e4e9a111fb5ead03553508f7b65da81ef10541a
SHA512 006134a1eec518d1e2cd5bc204783d13a543847dbcd0c7f80beb78f29839796d6298712efadf9d1d2922f052c8c59ff840887c77cc63c2faa80dcb7f257b1760
TLSH
T180F027B62DFB1810FEBBD3D5797254B001297868C990AD1F541AB29B50F0B206449C62
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 e7138cf353e7f88e177812bd718c1a6264275029652c10a8d84b9bf253eb379a
MD5 9d7576a9af0806f44e5c8496eeeda142
SHA1 5e9daf0727df81c2cc1b47aa7db95bc418190f73
SHA512 de3f40fa9b4762122a8e41d16bc0eabb6c6889a6bc3831a96d838c8aa2df38a718dde78ff3f0b97b97d8d28522b86e7d01fad73ff4d38d626048919953a40e33
TLSH
T13DA002938F7CC441C6010378B47111882614CFD817152B7194ED01559C902508197415
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594329.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe594329.TMP
Size 48B
SHA256 9240715e9c26960645ee79b1bae6cf05e3582d4ba579fcfd7e87d6b63540a1fe
MD5 30d95bb06dd8d2bb7dd092e72f1cfccc
SHA1 0990cef3d9528f5b53cabbd2dbfac2f4a67458b4
SHA512 8fb9a8fda2044887813dbd4d9bbd1954f878a93d9f36c010d557bcfb1c6d4bc077eb7a2480489f5de6be0e811d019d593ecf384de55a98782c99c0587a61038f
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 d76ffcca5c71719c8dbeb9fe878e02d587e44c9efdb51b1d846f49346b1a631d
MD5 1bbc22c64add61cb3bdf91a24497ded2
SHA1 707ab73428e7a02a1f543c96fbfc8362ccae99af
SHA512 d436fb372d0ca486eaf852f7e08644d9d9ae4b1c9efdd62a68f376282d8e253c6caf50d3cff9caebf99db7790030315942d5cdca5d2e7f59ae1f2dc6eb5e281e
SSDEEP 192:ANtDrpn3F2E9FHwgRBL3WDfSZXV9MJdvnn63mt99r/LWV9O7N/tH:AzD9n17lw8BrWLSJCNH
TLSH
T14BB23911717B02C13E7E299E8195B46E62C231633198B92B3BF844764F6BE20DDFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 7f204bade54cfc12395fd98cc284cfacc030a9e79d71cab1c6379ea09cf7df35
MD5 ca4f9cde89aaa6ae03144ddfcaad9187
SHA1 1fa45f1aab79d58ce6fb5e053d5d91303aa0553c
SHA512 e8123f970d6cb38084b6922d3b803767347c497d19c645c34d942b54f4639ea67bd6056262251bc5face57e47408d2a360d51b3f122ff0278a02bef5242f9c20
SSDEEP 384:nAiFscXqnJ3sNe8TUNTUlI4RTXJvuxO0G7Y2qvfqZpVhFL3LrqHIR3XGbfxYirNm:bFuJ3fwgOmxUYAZpVqHIR3sieI
TLSH
T1A9D24A36E898ED6BADEB8FC9B35A7643EEE411A7854C0ED4D6D85D0C00836DD134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 faa05ac0037cd5d76fdb4f898e303ebb42ff5c8266fe8d1df38983cf8ab7aa49
MD5 616e1f32faff079e54404e8057b64d82
SHA1 566c8c5f6a91d92b4f0e32b592ba5ba7ed47adf4
SHA512 bd36e1a7c419af405a7c1f996ad81221560820b1ed9a1ae3f4bd26291ff7d262922e208950e52ccb9f2703f32d7015593d725a5a3732abd03df7d2b6d1977c25
SSDEEP 384:n7iFavqMI3sNe8TUNTUlI4uTJvuxOyGqXqvfqZpVhFL3LrHHHlrN1k+5vI+J:WFayH3fwg1mxZnZpVHHHxd
TLSH
T1C0C23A36E868DE67ADE78FCAB74A7643EFE011A785880AD4DAD91D0D00C71DD134BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 68c3290ff2ae7b877595463b8aec753c25bc9898443d8dea4c8bfef31e4ae2f2
MD5 836894cf793c60be5f66072ae1f230cf
SHA1 c7e98af780c14b47439c564470c298b6eec2ff48
SHA512 9f6fc84fa7d6e7cd382c97c7167a01742af10148999d02c9e9cf53123674154701ca5ea5b7103f893c4ca0894340718ffe96e6a12cfca42bb22ab631e2100443
SSDEEP 384:n7iFpcXqnx3sNe8TUNTUlI4iTJvuxO0GqXqvfqZpVhFL3LrNHIR3XGbfxYirN1kj:WFdx3fwghmxfnZpVNHIR3sieI
TLSH
T167C24A36E858DD6BADEB8FC9B35A7643EFE411A7858C0AD4D6D85D0C00836DD134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a8b4da170ae0286053a2ac92d60f6c09a46b98e95fee731c8c69a57e22121e11
MD5 e79c5059625989943723cdee179cb75e
SHA1 9e77d8c51e1e464656d5d90a41233d9ef96c48d5
SHA512 5bd8882f8203c5e24c25cf175ae3cd8d7fb8dd9237c0fe9d74cc86dc49fbfa20baa1937d83ddc1fdedc9e9bf257a91113fe26c43676dc6453869d1cb4245873d
SSDEEP 384:nUiFpcXqnx3sNe8TUNTUlI4iTJvuxO0GqXqvfqZpVhFL3LrNHIR3XGbfxYirN1kj:vFdx3fwghmxfnZpVNHIR3sieI
TLSH
T1D1C24A36E858DD6BADEB8FC9B35A7643EFE411A7858C0AD4DAD85D0C00836DD134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 1aa5f108a73d9e36eca9df34cd0a0e108cbd59143d401d6971bd03644e81d625
MD5 3fe27c1d73363e3c8f9eb1302fe80f53
SHA1 1317888abbbbada02a53088aed0a53bab7e081f9
SHA512 b11607cf09c1e9da9afcdc69fda621b2e65fefad3df9130c0f04bf8cab984b89bfd11889bcb9fbd17d8be3b4ef969dee8a4daa9f8e443f66952ff1dfcaa3c659
SSDEEP 384:nsiFavqMg3sNK8TUNTUlIm2TJvuxOieDNLqvfqZpVhFL/OiRYV/Vw1mRQCe0wrNx:XFayv37wgzmxIdZpVRRYk1mu/0Ur
TLSH
T1E1C24A36E854EEABEDE78FC9A70A7A07DEE41167C58C4AD4CAD41E0E00971DE5307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 86db56c3333d7f52010174139922eb900cf46485cce5e93090ab3a3852a9f4b7
MD5 4236f0e8f9207f478dc06f4a1fb35f27
SHA1 82ac8c85461c67bc720b81087adcaafe02b4c6a9
SHA512 779a32dd7170ce920316c1d5f1846c7a740837e7979803bd4cf22118616fcf22b4926b21207e3092fdebe6f75dffbddf13d66e3f63da9a53e387d89a800a8fab
SSDEEP 384:n7iFrcXqnx3sNe8TUNTUlI4uTJvuxO0GqXqvfqZpVhFL3LrNHIR3XGbfxYirN1kj:WFzx3fwg1mxfnZpVNHIR3sieI
TLSH
T149C25B36E858DD6BADEB8FC9B34A7643EFE411A7859C0AD4D6D85D0C00836DD134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3f0f750c2c2b367541f2fe54040333b50edc245cc5d41eea7c860e89710ebb12
MD5 bb28a6c76260b4aa673707293130a9f6
SHA1 56114a5d7b1dbe50bf791dc3ce292cbcf9b4a74d
SHA512 8b7e57bfa1600fee7d70fa8fc6d28931f851d6add2ff401910be3749d5551a2cbfba0fa718eb39865736fbae480e183ba07c359eeb870afd9df5864886725479
SSDEEP 384:neiFavqMg3sNy8TUNTUlIm2TJvuxOWxIkqvfqZpVhFL3LrqHRYV/Vw1mRQCe0wrr:1Fayv3vwgzmxKmZpVqHRYk1mu/0Ur
TLSH
T195C24A36E854EEABEDE79FC9E70A7A07EEE41167858C4AD4DAD40D0E00971DE130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 75dfb31c289bad0623bac7870a72bc9be23ee04075deb8fa18f77188afb9af95
MD5 7f0d1aab03c9953ae3211a692ccc1682
SHA1 7b23373eba74c6f6ecad878da5e8726fd364b318
SHA512 87eb28eaea39a0da86563865ee56bf8f3a3ae5d92e641e199929912123dbfd543f3feaa6194a1cb8f926948eb3c7137d13fde5fac46f9918630b43ac5f39e86f
TLSH
T149E00203D30004FAC014033000936B2017E3C03207B207165F1002646C633005E34F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 465bdd12f510743d0c9567383a10222de26bdb561b61ea51127cee143d65085f
MD5 fe2dae9242557a92b2cc29e2e070615b
SHA1 31dfdac264345b348a1d888cd5841d787a61bbe1
SHA512 b266123d070685af8a205e9c01d76a38411503a19b85dc3c5a387e73531f2e98b928ee3a5e37e33289320c74e3802d8eb7080264c566b9790499f2a525b6f76f
TLSH
T12EE00203D30009F6C00C033000976B1017E3C13607F207165F1042646D633005D34F40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 86dfa440adda95c5d45a9d7c4d2995719e45d49c8ebc9c8b7e6c2780cbf700c4
MD5 502b48484749777d86232726f1801346
SHA1 fb552d9e8c66b6063839d8cc462bc9b17ea459c2
SHA512 511d124751ad7402cf88d95c20c20b3c185ce8f307e4abbf9593093ddec14a8da5bf337c0e33f53c2f0f984f8ea15035f9523ed192f26c1d4f9c3134932e6801
TLSH
T1BBE00103934149FEC028033000976F2427E3C13607B207166F614A64AD733406E34FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe592570.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe592570.TMP
Size 392B
SHA256 168a2e85289663d7164c04ab32175a73240a33c7984414b55fce2cded493d481
MD5 8db68b4207f885414245441d833ed502
SHA1 2ff62efe465d63253b642d86dc802d135dd70edd
SHA512 6cb099b88311da7661a6d202d9c00125451d0f9236e27446b9c3bb0cf0822bee7df7eb67c251d15dd7c19afc6fd17242b9998126797c33cae871fdfd157389ef
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 00681d39bcd48933c4e41a3be4f569ed317165c7085a43b496c9c8619212075a
MD5 6cbcb11b7c82a32198d2959848d0aa88
SHA1 539819ffada054afb8bf08ec9a33ad24c1948be8
SHA512 cf1c9759bb760f31192ea09a07dd348886e83faab89d66d5894f91fd306aa46efb54815fb3992601134426ad6a3996118603c47695977c3d55338a6a403c265a
TLSH
T1613140E14C3E2AD1D4FE0F2E646738FC91D8C72AF5B4707D1820DA84067960E204443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 51e97d1c90676f0d515310abe4dc937ad1d2c92c61df921063bc679ea79afd5d
MD5 87126da161aeca718f7970dc3cb0c705
SHA1 57ff96bce6f6bc19ef24d6a3ed99ca848b0911c7
SHA512 f44ed60fa92b0d4fc4a93f80b8abc6121b61067df5d42fb1c3936a0971534d9229e4f52156632aa4962a476d2f6d889a1b4cb89e34d17b8209a5ea991ae43bc5
TLSH
T18F3154D14C3D26D1D8FD0F2E646778FC91D8C32AF4B8747D5824DA840239A0E604143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 f8bed71bc558dedc30e8e1b258a2fb3df470c43cba2e7d8c6a88649d59c65e0a
MD5 f971a6bc9262741b4fe44adcb76fdd61
SHA1 47f1c64b027a27f46d4abb43b64e2aa2dcf240a8
SHA512 d8a1d981273577f405aec863199273839c014f0fa2fb998d5c1480fd0f525ec12219abe76bae37202adc8c957f2ad660c7ae7e48d85c270db14de9178b707268
TLSH
T10A312FE14C3D2AC1D4BE0E2E746738FC91D8C72AF9A4707D2820DA84427960E254442F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ebcbafb9f53aca7a7b400f2f8584bec9eb7acb10f50ba4d98032185f405a8760
MD5 9df3050b79f71f6fda32667eafc1e5fc
SHA1 b6540c3201c320c5552b979227bd35bc53c794ca
SHA512 148f76fa4008e2331951ff0a56743ad23d4f0a0b59c9ff05acb84f84ac37faae2c9535f146ce923c12d274187322cbb8aa045b51fbd751d756e494ed6630c70f
TLSH
T11041E958B6EA1148B3B72F565FF6A46D487BBC772E06D45D10010E4F0A76B40CD62B37
MD5 SHA1 SHA512 TLSH

Submit Download

winrar-x64-721.exe

Path C:\Users\Admin\Downloads\winrar-x64-721.exe
Size 3.6MB
SHA256 63c2f703397ad30dc3440de9113ec8e7fa9612c406e196543852ca5e1c5d987e
MD5 9cdb5d2c108b8bdb55c2c1365b3839be
SHA1 01741008732da240a6437a7971d90ef1ee546344
SHA512 928f641cc0718ad6c588bf903f3affe89a5c1588bf7efada74681922298b24b0f7101f4d974066b607206dad5f4a5d918d4bb4c27ab5a4ba4c5b404d40f92d09
SSDEEP 98304:bKBAc8FU6UDKpOHOqQ528WGA2Ty1ooxlazA:iZuAlQ5SZ2TGla8
TLSH
T1A606236AD2A914F9E27BD578CCE2420AE6B27C5D1B70C6CF33E515461E233D08A3D762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/668-35-0x0000022DC5A60000-0x0000022DC5B09000-memory.dmp

Download

memory/1584-2183-0x000001AA79140000-0x000001AA7914C000-memory.dmp

Download

memory/1584-2182-0x000001AA75740000-0x000001AA757E9000-memory.dmp

Download

memory/2804-1885-0x00000224401C0000-0x0000022440269000-memory.dmp

Download

memory/3900-555-0x000001A3EEA50000-0x000001A3EEAF9000-memory.dmp

Download

memory/4484-1995-0x000001188A580000-0x000001188A629000-memory.dmp

Download

memory/4548-246-0x000001956F8F0000-0x000001956F999000-memory.dmp

Download

memory/4600-1854-0x0000028A10FA0000-0x0000028A11049000-memory.dmp

Download

memory/5424-2028-0x0000021A45D60000-0x0000021A45E09000-memory.dmp

Download