hxxps://www[.]mtas[.]ru/uploads/stat[.]zip

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
1048s
max time network
1043s
platform
windows10-2004_x64
resource
win10v2004-20260130-uk
resource tags

arch:x64arch:x86image:win10v2004-20260130-uklocale:uk-uaos:windows10-2004-x64systemwindows
submitted
09/05/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mtas.ru/uploads/stat.zip
Sample260509-e8g51aax5v

Score

7^/10

discovery

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\ST6UNST Uninstaller.LNK	setup.exe

Executes dropped EXE 3 IoCs

pid	Process
5380	setup.exe
3844	Setup1.exe
2996	PedStat.exe

Loads dropped DLL 11 IoCs

pid	Process
5380	setup.exe
3844	Setup1.exe
3844	Setup1.exe
3844	Setup1.exe
3844	Setup1.exe
3844	Setup1.exe
2996	PedStat.exe
2996	PedStat.exe
2996	PedStat.exe
2996	PedStat.exe
4640	msedge.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\temp.000	Setup1.exe
File opened for modification	C:\Windows\SysWOW64\COMDLG32.OCX	Setup1.exe
File opened for modification	C:\Windows\SysWOW64\MSFLXGRD.OCX	Setup1.exe
File opened for modification	C:\Windows\SysWOW64\TABCTL32.OCX	Setup1.exe
File opened for modification	C:\Windows\SysWOW64\MSCOMCTL.OCX	Setup1.exe
File created	C:\Windows\SysWOW64\temp.000	setup.exe
File opened for modification	C:\Windows\SysWOW64\ROBOEX32.DLL	Setup1.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\msedge_url_fetcher_4640_9868442\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1327120333\hyph-ta.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_573486922\json\i18n-hub\es\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_573486922\Notification\notification.bundle.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1349645974\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1327120333\hyph-de-1996.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_573486922\json\i18n-ec\pt-PT\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_573486922\json\i18n-notification-shared\ja\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_573486922\json\i18n-notification-shared\sv\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1349645974\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_573486922\json\i18n-notification\sv\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_573486922\json\i18n-notification\zh-Hans\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_573486922\json\i18n-notification-shared\fr-CA\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_50888449\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_573486922\json\i18n-ec\nl\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_573486922\json\i18n-hub\ar\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_573486922\json\i18n-shared-components\zh-Hant\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_573486922\vendor.bundle.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1672799701\ranked_dicts	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1327120333\hyph-mr.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_573486922\json\i18n-ec\ja\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_573486922\json\i18n-hub\fi\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_573486922\json\i18n-hub\nl\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_573486922\json\i18n-notification\id\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_573486922\json\i18n-notification-shared\pt-PT\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_573486922\Wallet-Checkout\wallet-drawer.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1349645974\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1349645974\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1349645974\_locales\lv\messages.json	msedge.exe
File opened for modification	C:\Program Files (x86)\PedStat\Пример порядковой шкалы.psf	Setup1.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_573486922\wallet-webui-708.de49febeeb0e9c77883f.chunk.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_573486922\wallet-webui-925.baa79171a74ad52b0a67.chunk.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1349645974\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1349645974\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1672799701\us_tv_and_film.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1327120333\hyph-ga.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1327120333\hyph-tk.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_573486922\hub-signature.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_573486922\json\i18n-ec\ru\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_573486922\json\i18n-ec\th\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1349645974\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1349645974\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1876127876\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1327120333\hyph-be.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_573486922\json\i18n-mobile-hub\pt-PT\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_573486922\json\i18n-mobile-hub\zh-Hant\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_573486922\json\i18n-notification-shared\ru\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_573486922\json\i18n-shared-components\ko\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1349645974\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1349645974\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1327120333\hyph-da.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_573486922\json\i18n-ec\en-GB\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_573486922\json\i18n-tokenized-card\ru\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1766389650\_platform_specific\win_x64\widevinecdm.dll.sig	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1349645974\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1349645974\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1349645974\_locales\ar\messages.json	msedge.exe
File opened for modification	C:\Program Files (x86)\PedStat\Пример дихотомической шкалы.psf	Setup1.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1327120333\hyph-cs.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_146693828\Part-NL	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_573486922\json\i18n-ec\da\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_573486922\json\i18n-hub\id\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1349645974\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1349645974\_locales\fr\messages.json	msedge.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\WINDOWS\ST6UNST.000	setup.exe
File opened for modification	C:\WINDOWS\ST6UNST.000	setup.exe
File created	C:\WINDOWS\SETUP.LST	setup.exe
File created	C:\WINDOWS\PedStat.CAB	setup.exe
File opened for modification	C:\WINDOWS\PedStat.CAB	setup.exe
File opened for modification	C:\WINDOWS\st6unst.exe	setup.exe
File created	C:\WINDOWS\temp.000	setup.exe
File created	C:\WINDOWS\Setup1.exe	setup.exe
File opened for modification	C:\WINDOWS\Setup1.exe	setup.exe
File opened for modification	C:\WINDOWS\ST6UNST.000	Setup1.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PedStat.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4544	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134227750251949105"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDD1F053-858B-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Setup1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D761-6018-11CF-9016-00AA0068841E}\ = "DataObjectFiles"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\Version\ = "2.0"	Setup1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000000000001000000ffffffff	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7500A6BA-EB65-11D1-938D-0000F87557C9}\ProxyStubClsid32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7629CFA4-3FE5-101B-A3C9-08002B2F49FB}\InprocServer32	Setup1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352}	Setup1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E3867A3-8586-11D1-B16A-00C0F0283628}\Version\ = "2.0"	Setup1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F04A-858B-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	Setup1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C8A3DC00-8593-11D1-B16A-00C0F0283628}\TypeLib	Setup1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6262D3A0-531B-11CF-91F6-C2863C385E30}\ProgID\ = "MSFlexGridLib.MSFlexGrid.1"	Setup1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}\2.0\ = "Microsoft Windows Common Controls 6.0 (SP4)"	Setup1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C74190B5-8589-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0"	Setup1.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C4F3BE5-47EB-101B-A3C9-08002B2F49FB}	Setup1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD9DA665-8594-11D1-B16A-00C0F0283628}\ = "DImageComboEvents"	Setup1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9F6AA700-D188-11CD-AD48-00AA003C9CB6}\ProxyStubClsid32	Setup1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F4DF280-531B-11CF-91F6-C2863C385E30}\TypeLib	Setup1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE35-8596-11D1-B16A-00C0F0283628}	Setup1.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E43FD401-8715-11D1-98E7-00A0C9702442}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}\ProgID	Setup1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\SniffedFolderType = "Generic"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5E9E78A0-531B-11CF-91F6-C2863C385E30}\1.0\HELPDIR	Setup1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDD1F055-858B-11D1-B16A-00C0F0283628}\ = "IListSubItem"	Setup1.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	PedStat.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F2-7697-11D1-A1E9-00A0C90F2731}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{083039C2-13F4-11D1-8B7E-0000F8754DA1}\ProxyStubClsid32	Setup1.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE40-8596-11D1-B16A-00C0F0283628}	Setup1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66833FE4-8583-11D1-B16A-00C0F0283628}\TypeLib	Setup1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C74190B7-8589-11D1-B16A-00C0F0283628}\ProxyStubClsid32	Setup1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	PedStat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	Setup1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C46780-499F-101B-BB78-00AA00383CBB}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E43FD401-8715-11D1-98E7-00A0C9702442}\TypeLib\Version = "6.0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{35053A20-8589-11D1-B16A-00C0F0283628}\ProxyStubClsid32	Setup1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F9043C85-F6F2-101A-A3C9-08002B2F49FB}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352}	Setup1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSFlexGridLib.MSFlexGrid\CurVer\ = "MSFlexGridLib.MSFlexGrid.1"	Setup1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{609602E0-531B-11CF-91F6-C2863C385E30}\ProxyStubClsid32	Setup1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	Setup1.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CBB76011-C508-11D1-A3E3-00A0C90AEA82}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C74190B5-8589-11D1-B16A-00C0F0283628}\ProxyStubClsid32	Setup1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD9DA664-8594-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	Setup1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C74190B7-8589-11D1-B16A-00C0F0283628}\TypeLib	Setup1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\TypeLib\ = "{5E9E78A0-531B-11CF-91F6-C2863C385E30}"	Setup1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\Programmable	Setup1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66833FE9-8583-11D1-B16A-00C0F0283628}\ = "IButton"	Setup1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD9DA664-8594-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Setup1.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F1-7697-11D1-A1E9-00A0C90F2731}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F2-7697-11D1-A1E9-00A0C90F2731}\TypeLib	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E43FD401-8715-11D1-98E7-00A0C9702442}\ProxyStubClsid32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.Toolbar.2\CLSID	Setup1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE3F-8596-11D1-B16A-00C0F0283628}\InprocServer32\ = "C:\\Windows\\SysWow64\\MSCOMCTL.OCX"	Setup1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F051-858B-11D1-B16A-00C0F0283628}\ProxyStubClsid32	Setup1.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66833FE9-8583-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	Setup1.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
984	msedge.exe
984	msedge.exe
6916	taskmgr.exe
6916	taskmgr.exe
6916	taskmgr.exe
6916	taskmgr.exe
6916	taskmgr.exe
6916	taskmgr.exe
6916	taskmgr.exe
6916	taskmgr.exe
6916	taskmgr.exe
6916	taskmgr.exe
6916	taskmgr.exe
6916	taskmgr.exe
6916	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
4128	msedge.exe
5064	msedge.exe
3124	msedge.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeRestorePrivilege	2672	7zG.exe
Token: 35	2672	7zG.exe
Token: SeSecurityPrivilege	2672	7zG.exe
Token: SeSecurityPrivilege	2672	7zG.exe
Token: SeRestorePrivilege	2276	7zG.exe
Token: 35	2276	7zG.exe
Token: SeSecurityPrivilege	2276	7zG.exe
Token: SeSecurityPrivilege	2276	7zG.exe
Token: SeRestorePrivilege	4288	7zG.exe
Token: 35	4288	7zG.exe
Token: SeSecurityPrivilege	4288	7zG.exe
Token: SeSecurityPrivilege	4288	7zG.exe
Token: SeDebugPrivilege	6916	taskmgr.exe
Token: SeSystemProfilePrivilege	6916	taskmgr.exe
Token: SeCreateGlobalPrivilege	6916	taskmgr.exe
Token: 33	6916	taskmgr.exe
Token: SeIncBasePriorityPrivilege	6916	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
6916	taskmgr.exe
6916	taskmgr.exe
6916	taskmgr.exe
6916	taskmgr.exe
6916	taskmgr.exe
6916	taskmgr.exe
6916	taskmgr.exe
6916	taskmgr.exe
6916	taskmgr.exe
6916	taskmgr.exe
6916	taskmgr.exe
6916	taskmgr.exe
6916	taskmgr.exe
6916	taskmgr.exe
6916	taskmgr.exe
6916	taskmgr.exe

Suspicious use of SetWindowsHookEx 34 IoCs

pid	Process
3844	Setup1.exe
2996	PedStat.exe
2996	PedStat.exe
2996	PedStat.exe
4128	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
3868	msedge.exe
4400	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
1204	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
4632	msedge.exe
2360	msedge.exe
3800	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
6292	msedge.exe
6628	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 4656	4640	msedge.exe	84
PID 4640 wrote to memory of 4544	4640	msedge.exe	85
PID 4640 wrote to memory of 3548	4640	msedge.exe	88
PID 4640 wrote to memory of 3548	4640	msedge.exe	88
PID 4640 wrote to memory of 4564	4640	msedge.exe	86
PID 4640 wrote to memory of 4564	4640	msedge.exe	86
PID 4640 wrote to memory of 4564	4640	msedge.exe	86
PID 4640 wrote to memory of 5236	4640	msedge.exe	89
PID 4640 wrote to memory of 5236	4640	msedge.exe	89
PID 4640 wrote to memory of 5236	4640	msedge.exe	89
PID 4640 wrote to memory of 1848	4640	msedge.exe	90
PID 4640 wrote to memory of 1848	4640	msedge.exe	90
PID 4640 wrote to memory of 1848	4640	msedge.exe	90
PID 4640 wrote to memory of 6124	4640	msedge.exe	93
PID 4640 wrote to memory of 6124	4640	msedge.exe	93
PID 4640 wrote to memory of 6124	4640	msedge.exe	93
PID 4640 wrote to memory of 5800	4640	msedge.exe	95
PID 4640 wrote to memory of 5800	4640	msedge.exe	95
PID 4640 wrote to memory of 4212	4640	msedge.exe	94
PID 4640 wrote to memory of 4212	4640	msedge.exe	94
PID 4640 wrote to memory of 3276	4640	msedge.exe	97
PID 4640 wrote to memory of 2016	4640	msedge.exe	100
PID 4640 wrote to memory of 2016	4640	msedge.exe	100
PID 4640 wrote to memory of 2020	4640	msedge.exe	101
PID 4640 wrote to memory of 2020	4640	msedge.exe	101
PID 4640 wrote to memory of 2020	4640	msedge.exe	101
PID 4640 wrote to memory of 2284	4640	msedge.exe	106
PID 4640 wrote to memory of 4268	4640	msedge.exe	108
PID 4640 wrote to memory of 4268	4640	msedge.exe	108
PID 4640 wrote to memory of 4268	4640	msedge.exe	108
PID 4640 wrote to memory of 2744	4640	msedge.exe	109
PID 4640 wrote to memory of 2744	4640	msedge.exe	109
PID 4640 wrote to memory of 2504	4640	msedge.exe	114
PID 4640 wrote to memory of 4340	4640	msedge.exe	115
PID 4640 wrote to memory of 1008	4640	msedge.exe	116
PID 4640 wrote to memory of 5824	4640	msedge.exe	117
PID 4640 wrote to memory of 5824	4640	msedge.exe	117
PID 4640 wrote to memory of 720	4640	msedge.exe	119
PID 4640 wrote to memory of 720	4640	msedge.exe	119
PID 4640 wrote to memory of 720	4640	msedge.exe	119
PID 4640 wrote to memory of 2616	4640	msedge.exe	120
PID 4640 wrote to memory of 2616	4640	msedge.exe	120
PID 4640 wrote to memory of 2616	4640	msedge.exe	120
PID 4640 wrote to memory of 2248	4640	msedge.exe	121
PID 4640 wrote to memory of 2248	4640	msedge.exe	121
PID 4640 wrote to memory of 2248	4640	msedge.exe	121
PID 4640 wrote to memory of 880	4640	msedge.exe	122
PID 4640 wrote to memory of 880	4640	msedge.exe	122
PID 4640 wrote to memory of 880	4640	msedge.exe	122
PID 4640 wrote to memory of 436	4640	msedge.exe	123
PID 4640 wrote to memory of 436	4640	msedge.exe	123
PID 4640 wrote to memory of 436	4640	msedge.exe	123
PID 4640 wrote to memory of 3168	4640	msedge.exe	124
PID 4640 wrote to memory of 3168	4640	msedge.exe	124
PID 4640 wrote to memory of 2164	4640	msedge.exe	126
PID 4640 wrote to memory of 2164	4640	msedge.exe	126
PID 4640 wrote to memory of 2164	4640	msedge.exe	126
PID 4640 wrote to memory of 4000	4640	msedge.exe	128
PID 4640 wrote to memory of 4000	4640	msedge.exe	128
PID 4640 wrote to memory of 4000	4640	msedge.exe	128
PID 4640 wrote to memory of 2536	4640	msedge.exe	129
PID 4640 wrote to memory of 2536	4640	msedge.exe	129
PID 4640 wrote to memory of 2536	4640	msedge.exe	129
PID 4640 wrote to memory of 5004	4640	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mtas.ru/uploads/stat.zip
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ff8a093c188,0x7ff8a093c194,0x7ff8a093c1a0
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=uk --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,13272540915421700026,7759411797292025948,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,16290644871250981834,12602849355952183251,262144 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,7080985234925344510,13099792783190217731,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:8
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,1627752900387357724,2102343705498387881,2097152 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,13722230785941870032,5247831053609151352,2097152 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4932,i,8607232925459723299,16665917878917787044,2097152 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=uk --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,18246258823060062776,16350091790398288952,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=uk --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,5114213546257831744,15552752650296057668,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:8
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,2621509482305694188,2262956798377927834,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,2621509482305694188,2262956798377927834,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=uk --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,11313544565522217026,16239605620967652320,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6124,i,6346173236953176695,643453711732498726,2097152 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,344727129618958650,10878553031759078922,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:8
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5796,i,16963427519645976174,13923529543730902089,2097152 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=uk --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,2551196836549624919,445768033586642947,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6940,i,1382492012157484483,16076774496167484049,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,4144399511020964458,5750875462734613944,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,6446964920254412148,5253246400919690086,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:8
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7128,i,13993119958742211364,7860728172152932593,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:8
  2⤵
  PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4864,i,438189299760065996,15598576989669268846,2097152 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5284,i,3134625493459776001,10524408419076099116,2097152 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5048,i,17319277221365946808,14491628317465906015,2097152 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7240,i,5285381690026438608,12207746279756087357,2097152 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=7220 /prefetch:1
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7148,i,6642262413554070617,4626697116102912923,2097152 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=uk --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7744,i,6138427203007007061,11338945584362713130,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=7760 /prefetch:8
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8312,i,15040716070350877461,15475638640832917107,2097152 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=8320 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5092,i,6306532745901490155,11109283665304479572,2097152 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=7404 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8644,i,18389408834170653884,12243702641918126213,2097152 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8992,i,15502628651185301062,1762634077246305231,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=8996 /prefetch:8
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8992,i,15502628651185301062,1762634077246305231,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=8996 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8364,i,13416949514310394069,3330213749316761092,2097152 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=8428 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,5257361548315956072,5341397051951303190,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3488,i,3511079399957399236,6036764178649944200,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=8396,i,6874991644280157871,14580162146841483042,262144 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=8660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8636,i,5738426268919537528,10576059925318727690,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,6126781186834321242,162753104220893269,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=uk --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,5741886854263872655,13665623138943193133,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8676,i,8300328543177223728,8556064347900937396,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:8
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8292,i,7592823956010873306,18102422054174473379,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=8632 /prefetch:8
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,3507182176345050475,12752227567150483070,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=8224 /prefetch:8
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=7408,i,13442792078997857835,5918135389391190864,2097152 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=7336 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=uk --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7124,i,13690676317075309513,6034073162456678329,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=7252 /prefetch:8
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=9212,i,438671054603786266,14171156802450690983,2097152 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8588,i,17260625366818746634,13692506507235254777,2097152 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=9112,i,12367853515718618190,17891762291776034608,2097152 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=9272 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=7204,i,8901585408994534743,5743901699247772160,2097152 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=9120 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7564,i,8151258636423985758,18269874434282230658,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=7292 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8632,i,9057413378558319064,14141567482346423352,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,17545427323221610295,16214097215662308589,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=7200 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=uk --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,5062535039181073667,14767817630705988485,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:8
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,18026319985292476897,8263173699457851227,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=8324 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8064,i,2779922955343501825,4938224209540070968,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:8
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8064,i,11612198226778976407,10438125853727188368,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=7764 /prefetch:8
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7568,i,3436417525309064235,4225173919618883262,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=7928 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8120,i,2069034514696688516,7011883577615481275,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=8140 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,757853753511743348,4892595724273158204,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=8268 /prefetch:8
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8076,i,11416007067836669973,11872159750516772517,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=8176 /prefetch:8
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8084,i,8349047059648054308,9749777969428608254,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=7612 /prefetch:8
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8184,i,14790593131667453857,8966673673505777007,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:8
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8124,i,8780207161075644797,7008319057565364094,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=7280 /prefetch:8
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8124,i,9624450707406205844,17694984936777055132,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:8
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7996,i,18246581558268101112,12188414746374902679,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=8020 /prefetch:8
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=uk --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8188,i,202328456403974612,7731961563032465836,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8848,i,1612290750154217237,17038552741868260313,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=8252 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,776125976485012093,17769255522721392742,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:8
  2⤵
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8708,i,14962934452033632816,11873284664034468302,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,11963891329957892468,972928411078177403,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,9925682517136324381,1405178348007050043,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:6292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6920,i,14885080105741162605,12424299943998095350,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:6628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=uk --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8500,i,13020794842919093352,1558020118053672363,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=8560 /prefetch:8
  2⤵
  PID:6960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=9412,i,7878972616891533831,12120829273833473467,2097152 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=8596 /prefetch:1
  2⤵
  PID:6756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=4868,i,12528329172872443932,12911158047582286919,2097152 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=8324 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=6880,i,6209763525858413449,7525008340461705766,2097152 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=9184 /prefetch:1
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=5348,i,6309340605605261264,15316890088667512758,2097152 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:1
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=7560,i,4223841516912259062,16499868879106103889,2097152 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=8040,i,18060860719203388071,9546618656456038292,2097152 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=5348,i,452382051878441598,13343247377563582547,2097152 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=8208 /prefetch:1
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=uk --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9252,i,5768871232613011733,10691776557482069883,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:6484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7448,i,494490469628354717,9533526722497782014,524288 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:8
  2⤵
  PID:6608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=5056,i,15394599808672211669,8773868386417038953,2097152 --field-trial-handle=2308,i,14855350511000503443,11632857598607224112,262144 --variations-seed-version --mojo-platform-channel-handle=9024 /prefetch:1
  2⤵
  PID:4156

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1256

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:824

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\stat\" -spe -an -ai#7zMap31053:70:7zEvent13658
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2672

C:\Users\Admin\Desktop\stat\setup.exe
"C:\Users\Admin\Desktop\stat\setup.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5380
- C:\WINDOWS\Setup1.exe
  C:\WINDOWS\Setup1.exe "C:\Users\Admin\Desktop\stat\" "C:\WINDOWS\ST6UNST.000" "C:\WINDOWS\st6unst.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:3844

C:\Program Files (x86)\PedStat\PedStat.exe
"C:\Program Files (x86)\PedStat\PedStat.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2996

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" a -i#7zMap13943:910:7zEvent30721 -ad -saa -- "C:\Program Files (x86)\PedStat\PedStat"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2276

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" a -i#7zMap7574:910:7zEvent1449 -ad -saa -- "C:\Program Files (x86)\PedStat\PedStat"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4288

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:6916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Пример дихотомической шкалы.psf

Path C:\Program Files (x86)\PedStat\Пример дихотомической шкалы.psf
Size 920B
SHA256 989fbc1f3d41f4fad3ffd3beb2dfc3c61ccfaf707a36b5c8a82858fd420670df
MD5 cac0809eb19f848cb57ed2cd9ae2b8b2
SHA1 c87e8f45c82531f292170a6ecd8fbdb5d15f4d1b
SHA512 cfe8bdeabb922064fb62423092c16431b8a13215f5de5393a14fdee59d551e391b08832ad2cb006c23bf948613fcb80cc262733a1fe10a168a715a85fd128a06
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1039157798\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1210837653\manifest.json
Size 165B
SHA256 daf50c160ae8f5935baa4a7207e9d04afbbc81a6dd9ed02d99de12056743eeb6
MD5 8ff4c35081337b1ba6731cc36163c2a8
SHA1 31c80c4a98e5492fbf1b6b3e050446e7240c24a6
SHA512 1a616b9b797441fb438c89864beae36c1a151b1c85e1288481dc61d9f82df2c1fd5e002dbacc05d3070323f56325ed960df3e353d314eb2ee218f8e93aea3fac
TLSH
T1D6C0805294011D7419CE47150D5CE3889723D7152980B0155BD7C218DC3DC8B68F3B4D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1255455571\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1327120333\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1327120333\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1327120333\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1327120333\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4640_136875125\edge_checkout_page_validator.js
Size 1009KB
SHA256 9960614ae3d67b2a2b2b1bb1fdd6a427f4d103835e50e45f2e2cf3b1c540fa44
MD5 f4cf71ceaf44655238e8f6e445479361
SHA1 4d184496decd453261423d11a681bb925d1c466f
SHA512 c6af515da4c1eaa6689c829be6a99602f148090989c7f8b5aa5cd0620ca73d8b217ba266b188aa72bd219f863c86fb00d6e48758278346f5959f2c5169c1e382
SSDEEP 24576:cs4ymRAbsvvG3kJ6ARjiQixwaErn9VUfWEo0EQ1Xp8C9T0dK/vzHEiJsfaG81E9/:cs4ymRAgvvG3kJ6ARjiQixwaErn9VUfq
TLSH
T15F252B84E1E2253466D74CB960B7D2C4B5DC04583399F1E8FA6C68CADA0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4640_136875125\manifest.json
Size 146B
SHA256 1d4f529025d274699f815657573b828ae880ae0d44ee0b0ce66a6a273f2bddff
MD5 94e3a47681712a13578f122b3158c015
SHA1 376442061baa7018ee9e784d991798fc9f302b31
SHA512 6974139805e18959c2ad2a71727705f1c5268ee598b8864833732e042beffe2416db033180b8d01bf8bb3b2b901d4ccbb090dd677ecded939aa3d07797ba05b2
TLSH
T12FC09B73C931AC71157507D449F59745EB74574BF511B1563730018D4B3D57550606D1
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4640_146693828\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1672799701\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1759510587\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1759510587\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1766389650\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1815810613\manifest.json
Size 102B
SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
MD5 19322c8a94f1ac01a70f8c58cdbbc720
SHA1 7c90dac178c47dac9087dfce738f24a4a627f022
SHA512 f54a9cab8dbe96333862a67912e88c4f26cc3e25a7dc93e8f06d1fb5b0b8e91d53cc0f5619c192380573a2846034ee583276d7eda73dc9fc93bb0d9168f4e099
TLSH
T156B01221EC10B4B32004036C086CC3C063272F032C4079280DE19F84E90D9DBE471528
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1876127876\manifest.json
Size 118B
SHA256 69e4e1c13d13f15e8066d6d7e984a96a08d3b2a2ae33fbb218b1e0de5b8d1aed
MD5 4687681b420a5c580fe40870ed6af32c
SHA1 1aa40f91b2ed8c5ea38cb30b81c87a9ac7e21e6f
SHA512 5ced299552785894df9aa86f0cb5d9c057cf73753f81112ef91a8b8dbc6147913e39c27b6327613bc41c447ed230fbbc74881db79853d38e365685132e618762
TLSH
T170B092B00C1AA43B22C09320ECA0668683F84218E8421B1A098036481F882B880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4640_1990162344\manifest.json
Size 52B
SHA256 38bee4120e8eb37975dd2f6a2a3b23f9cea6e6c4f0335ad80270dc22b9990fc9
MD5 50ba36034cb8b97ce52eb941d76e9103
SHA1 a8757a3700f2af777ce5efc382010d2619f51491
SHA512 001110c3e45514a09cf6f60ca14855524e83ac15cf56776cf3005e016464dc6584b107c63842328a7c1738cc7f2154d8689f84d913b9b8199367699c3f9085aa
TLSH
T1FC900260082491171AC10E506570F8859391661A95851D1D0445154802A646CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4640_50888449\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

notification_fast.bundle.js.LICENSE.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4640_573486922\Notification\notification_fast.bundle.js.LICENSE.txt
Size 551B
SHA256 38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179
MD5 7bf61e84e614585030a26b0b148f4d79
SHA1 c4ffbc5c6aa599e578d3f5524a59a99228eea400
SHA512 ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3
TLSH
T108F08B5A31E12673416285A1270B52DE7F0C10BDB0AF39779444C3386C348EE82D0EE1
MD5 SHA1 SHA512 TLSH

Submit Download

tokenized-card.bundle.js.LICENSE.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4640_573486922\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt
Size 1KB
SHA256 363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831
MD5 8595bdd96ab7d24cc60eb749ce1b8b82
SHA1 3b612cc3d05e372c5ac91124f3756bbf099b378d
SHA512 555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5
TLSH
T1A2313A5B32F53673416245A1670B52DEBF0C24AEB56F38B79495C3387C388ED82D1DA1
MD5 SHA1 SHA512 TLSH

Submit Download

strings.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4640_573486922\json\i18n-tokenized-card\fr-CA\strings.json
Size 2KB
SHA256 c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
MD5 cd247582beb274ca64f720aa588ffbc0
SHA1 4aaeef0905e67b490d4a9508ed5d4a406263ed9c
SHA512 bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895
TLSH
T17251EE3D88F4489B60C7921B6B1142D7C9704E36D704F3848A63828A035BDEFB0BF69D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4640_573486922\manifest.json
Size 121B
SHA256 cd25cc1afcc03514d978f0a90692454e810c3cc81763074e0ea5ac504255335a
MD5 8083caaf7f5bc5f01ede464e68db1c7e
SHA1 ed6cf18f79c4ee2968adfffe7bf1bce163ef3873
SHA512 60924bd5617ac5f994805f9a871999764ba93c6adda79c501a0b692dce51b9db6f6531a5e25129bc424ae7c4de868ba6e5a976d6bcfbac2bb8bd192c5513c7ee
TLSH
T10CB0922289429D300469079809B486A6E230674BE406F0397B7041CC8B785B8A4A2A94
MD5 SHA1 SHA512 TLSH

Submit Download

6fa44973-9893-4469-90d4-653cdaae73c3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6fa44973-9893-4469-90d4-653cdaae73c3.tmp
Size 26KB
SHA256 e699a0d0d93cf2a36feae8c28248c0f6e918e8ff99cbb525ec4d173df7eaf3d3
MD5 6c921724458077f0a7cfa3bd4a182334
SHA1 82067dd5e23a1cb605ec4a19c409ad03f8e1f816
SHA512 7975ae8ac0c9b2ca7a7aec2cf696e053dec0f31b7ec3be2c8121578d864932d27004c99d24f2566527ab1fe1730d7025c70fdd98afd67c31cc7c89747bd4df35
SSDEEP 384:nyiFavqMxsNq8TUNTUlI4ywO5ZTPIvKOwfjYYpz4vzkyRLPPErN1k+5vI+y:5FayIXwgXwOb++YYpqk2Lg+
TLSH
T122C23A31E8A8DAA7FDEB8FD6B71A7643EEE011A3858C4AD8D9D81D1D00971DD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d449b86070a70e1a468aeced6c894ab0fabf640d303703d0a8d70003bf5791b8
MD5 d9cac509ec44159ea16a3c4ec6c81f2c
SHA1 9387a9dc8cc149b5e1aa307c631719a5822baaa5
SHA512 13c5e07e53d21e0b1757a6fe2faea412f89d6086183e40f8b8c9aad2f68fa8f1d1527cf60a95ce0e3b9e137b656123a75f89479a1b1dc2a6fdb325c832342ace
TLSH
T138D0800525B3DC74D055847018D77B4D7555CD6B4D4657163473283D3C4A4604D911DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 030978901609c12837a9b1afdcd1ee9f12ef19339fd94725f17a7cdb1e945f36
MD5 35e76198d1c2c61d3c2a49119ba65747
SHA1 a5ae8329c9e762bed0a3d6bc5584e8faf6d26a77
SHA512 8b21ab6c5e29ab0ea7652b7adadb04a05eb734a52faa779252fbec4acd45079c7ad3f83f36227a419f0a59fc94eb1cf408bcd782459cf4691b6eb727be746fd3
TLSH
T136D0800925B7DC74D059847018977B4D7555CD6B4D4657163473283D1C4B4504D911DB
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 4adc757afc40130336062f6da18baef2e64eb2836fb894ee29ee5b9a1a9de751
MD5 039f4c5e99bfa5adf778fa8ee7c1df35
SHA1 2aa81d85c14665230620bf918fed6226f86864c1
SHA512 f7ff67ebb24aab96c6adf780c453be5a0acca0cbe996add3ff360e4e1c6ba876ed281abe05175ccdf17ce4cf4041599fcb64f7d7e784e2c4f9e6a7d9f0e19303
TLSH
T15DE0DF9C86D1C5F88101FC9682A5AB5BDAC33417DB8C97D9B614E2A46A00805DAAE8E0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 406fb76837388ebabda02b1103c47e8f7020da589197c1902adfc79dd8753c6e
MD5 62ad910436b2e7b8eb98a1ee0e1c384d
SHA1 184973b5c6c9ba5f51a8ae9050153180cfc6027e
SHA512 dad46d919400bc80a35d67bfbfcd5f2bc047fc9c6ef1dfd55b6e27761869c3622bb1fa253fc99a56828d89d46275dc722797dc4abe560514039cf1205e7a3e34
TLSH
T152E0D81C02A5D5E46100EBDBC2E7E75BC9C2F01B958CCAE57606E0D91F80804EADA8B8
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 386B
SHA256 06b98f00fb91280134f14ab46bffbaf6282b44ede917017027a89014c00cb732
MD5 dc5deca13ce3ca6dafc739d06757e986
SHA1 2c56e5233c201221e548e5a78ddbb6bd1957caa9
SHA512 f55bbfd40e54c535a3eb9e8ffaa1c21038401c61598b89f252f0e8a5e6c545dc0d3fc36a737305922d832d22e52da27574cc7c56f7fd4358472a008ea4b150ac
TLSH
T1C0E0129EFAAC9B9ED7E8487EA7B6B5510B8912A2D40F9B2305347EC035917B01E35424
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 11ee5f0d6f292329638c43bdb1b27ec2b5bdb8434fed679a5ec6e5ab3251c394
MD5 a6e808e1f1f2ce691312ef67d68b9e42
SHA1 27c35fe819e4e1d9040af84efdff9dc94f987014
SHA512 cc72d25d4bb9b96aedcc4f153c253d855c87362df561e4b48da6ec692bb412b4fe83a1cfe11ac89083c7ebb42a4e399505e82a0158f3c4931ce65f9e18a1137a
TLSH
T109E02BA5C962AC3708FD176890505642E74513876BC1888F3A3C834C8FB1937459E85C
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000a4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a4
Size 65KB
SHA256 cd347596a47263afe619ad7ee58737bdd5069a9261405fc4c67a78dfa733f711
MD5 ee1ebe10db135d3b548ac590d9004745
SHA1 355af879919aebd7bcc766cb396226a691ed73d7
SHA512 a26d99dbb65cfb65da3e5ab26f0f3c5253050e4ac5d642e64ac2e9af4dd0ed50848e6109714849ef9f526f76461e442a9ffe3aafb25932abec86b1c00d14598c
SSDEEP 1536:JaRk+fsstTyErqE57pmqYd3yPnZvm8ZO2nttjlEOHDzo9MOZtr9n1YY:Gs2TyErt1mxwnZvDAOjl9HDzoiObT
TLSH
T13C53027034E4576B2A9705209108D0B9DC2C57A32BF3C25F9F82FA6F3B7521FDA4612A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a5
Size 68KB
SHA256 4ad601c70ed7615e044931de2d0d9c24efdb78df38eeafb5b31128b73c608705
MD5 b5062c2c09682cdd63e4fda053acf12e
SHA1 7efe12fd7283fc6aae2cd1206f5f04d36ea6de6b
SHA512 86a64354cb92f4f507f1da0e3315b02d3cabdaca349121723cf4e01b480401062027ec5f9f53e94835e7b44a6e7de35b185c5e6fd49aca7f8c1a0e60070a0ee8
SSDEEP 1536:Rimoq0CZYVaNUf76Z+AGYguWv03e30iIiV43s6WFYlXx:8rmyV8X9GjuW83BUV43sTFYlXx
TLSH
T174630223FBFB076A70E95438F13D632146E1BC5AF00B57061A77AAC67D32E62248430B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a6
Size 64KB
SHA256 34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92
MD5 d6b36c7d4b06f140f860ddc91a4c659c
SHA1 ccf16571637b8d3e4c9423688c5bd06167bfb9e9
SHA512 2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487
SSDEEP 1536:Lm4AGqOak9IP5qOYV7SofryJiRB3xVcVXsIBGCrmQR:LITk4qOq2oDwuhpDCaQR
TLSH
T1C55302D5B8E93222BDA947C28B442085CC6F367CF53F3DD8DE31AD2AA5909DC41847C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a7
Size 19KB
SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863
SSDEEP 384:/Und3PKicut4yiFkC9RWzlJpa2/CKYOyDJmCZyXJTW4PO821GyLjSoBwNeS:0UizQDYlJpaQCKYOyDJpI5Kx821DS3Nz
TLSH
T13692E1670BCE314E422EE25FA316A51733E41BE1EFE49640D6AA70D81C38DA243179D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a8
Size 65KB
SHA256 f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4
MD5 56d57bc655526551f217536f19195495
SHA1 28b430886d1220855a805d78dc5d6414aeee6995
SHA512 7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb
SSDEEP 1536:654NcGosP0w+UcGoanS2RR/QwNdIvEsgXn:6iRsw+UkC5QdEfXn
TLSH
T1055302E4123CA75C49FC43EA5434D635BA4B31ADABD4102FB69BC4258F6EA824447CFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a9
Size 38KB
SHA256 afd6ed6501f0e9c02a23aba559a8c64e2d3280f3c630834618da3c0c2b0e1a28
MD5 f52adc3d8222820d7bfa4486494eac97
SHA1 e829c54377987c82c305501722e809a59c2e3804
SHA512 f55bc5181400e51aa950e733614add3ca7898847c88a628ee903362daf300f7ea45067f6c291f57b842a07bf679dd2a848c6f4ea585599f466b0d738d5c81de7
SSDEEP 768:EclScUPPhajylJPWlFuCJ+rOGod93BRnskCE6HIOtTryKHPIKTadU:16RQ1J+rRodRZCIOdryKvIiau
TLSH
T19D03F1D22133479EB229F601D11021923CDA7CF462A73D385B9F4FE214916397B95BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000aa

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000aa
Size 37KB
SHA256 346ea97ec5aa47587d93e6347417ac2f9f9e7c85adf447c627a04af5926d08fe
MD5 336366f1121f7cedc056a917bf0f2fc1
SHA1 1d79799f95cdae8946042d09c056c5075e3babf9
SHA512 e730cd5de6b898ad719f905cc8d488945393206baabd17cd1e0902e55b46f71c2de9fea9e1b72981697f979ba084596dc09687e31cfe89c2ad1184e37f0d13b0
SSDEEP 768:zo30e1yjwXoHp8WOPEyD2l5QYnCmqimlrL+78O+fktopf:G0LjwYJgP1DY5VValrL+78O+fktKf
TLSH
T1F103F11C0F934D4984A3DBEAFD5C2B0068191E0F687C4666F3DD67EC3469DA6203B0AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ab

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ab
Size 25KB
SHA256 961098e81f3d18a90ec9cdcf85fffccb2657461a81ebc164f4816da1863ecae0
MD5 75b697f81b1299e4a82958c9ec63fc8a
SHA1 05a5577eca648a02a03ad8f25ef0989ab3528e35
SHA512 4755b4b950b74757520c47b9efa2ea95dab0beeb44e9fbaee3d958a250184926e3fedf2f69eadc2cc262f79a86d95b397149af2bbfa37d7d9c8e64e98b9a02ff
SSDEEP 768:+qxgcRHEubLR6uLTxa1Bj07wKc4t6N3K6IO7mNYJDwYk3E:+qthLRhv0BFKBt6o6IO7+aMYk3E
TLSH
T1D2C2E18B366460DC72D00011892A97662514CDA78FEEDB3EA18077FD0F64CFA95B223F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ac

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ac
Size 17KB
SHA256 40fa90d8977404841f2391c01ca7c0aeea9af5cdad80c6f399a19d523085d253
MD5 09c4a2e133416d8d81ba638a3c82e3a1
SHA1 c5e4e318e70c0ffd892c6605e2ae1c96392d876f
SHA512 e53cc830e1bf3d6ba3d48b5d76fc055e1f100492af65586c02c962cfebbad3517d20d341727340dd7597e864fd6d5e4bba1605ca9ee36e89929a96ea107fd978
SSDEEP 384:OoPMiiia1+Lf2VTciV7lBxbpAePHXbu0+NVuH5SLoj8SmFJ:R3c+L2TcyHbAefX7sVuNE
TLSH
T19C82D1CC0E9E8D41BEE6FE09B9CE1C796A0E0A21749F493181ED3571B4569BD3B8C706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ec

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ec
Size 363KB
SHA256 987520c161d9a0a6b78a6a2e9ac48fff7df21258a76f765ec62e3d7d872330bd
MD5 b889c4491374b48bd54967089c47b24f
SHA1 a4a0dc062539561c1cf4db1f4eeead5182d86e6b
SHA512 daaf9a7078b7ee13a69823aac7ad50c7dc417d5287bd53b838b11ee99c290a9d8f7cad868703041478e1acd000c7a2e2a97b8d742acce7ba3d933cfae4fba1ab
SSDEEP 6144:Md5+VYpEzQqG1X55Ay0K4P1ucWp6qD//wwgVfDhyeGHBdmtPWVkjOQV3u3:c+VfQq8DITWpNwxdhjGHBUZWCjOQto
TLSH
T1FF84233119E1CC63AC01838B0E0DB54FDA677D697BAC153E1042A8E7D1726BE5CB25B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ef

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ef
Size 50KB
SHA256 41bf4332484156746dd9bea82fdd907d70a605934458383be3d5aabb0721ba47
MD5 655df4724b0e84cac305dce980820c89
SHA1 54f579d2973361d3cbcd54c831f6e67922c40326
SHA512 cc59087e0bf212875bbb14f2185d47bca0b1ae8feb7d356be03dc1ae1891ebca6cd8563205d46f848e100daf19c775f6876897c6f32ea4d2f784397284470ee0
SSDEEP 768:0qjCFhHLFOkGSHMI9MppzhDHoye9icTMO41TChf0kfmK9enBkh0N90xwUv7qX:/jYhrUozCD+0cDaGV0lK9SX0xwUveX
TLSH
T1F233024C3E7C47E9B462D812DD638D71A90BCAE0E344F18442EE63CFF5A1A5215AE835
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000f0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f0
Size 26KB
SHA256 443294d3f0bc0bec0655818b05cb8f70d8f1afbed000829524c5d359997bdb04
MD5 cf69a88ea64af18a16fcdc3f05fa0021
SHA1 90d8fd946a04fccb9c17c84edcdfbd4b46724605
SHA512 3659043480a61fa1815164e90cd710bd5db81fcbf754edb34fde50def6a08619f5266c6ecd751b74536b917d7f904e81d78439c90c4162ca778787e52df4ea0c
SSDEEP 768:P5QWHxuA22qRNlcGuC3SOSovJx5Nin5svTKwevp:PPHwAtq/+G7PPBx5NinuveLvp
TLSH
T145C2E1062468DCB18687AF8B339AB57B635B1C79F8CB3D6219946D72327B031205E03F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 9KB
SHA256 2c1c98590e1c04f006efd949b9226ea362222417b69cff3f35ec2f8d88fa6134
MD5 0b76dc4ec944010192ee765ef334906f
SHA1 835f35f4bb2b6ff2a707ffab393d1dcc88ee1b21
SHA512 0e2b8278e04f22768fae6ddc2fb3b4fcade50bdd6bd83c48b88641c6e026386b2ddf287140ecddec6c7e7228e4a51f5045350fd3ecb9cd44939d1256eedfb267
SSDEEP 192:FDSRsZZS521k0waU12FtjyhbdGp+gdzHbp/SrvXK:FDSRsOo1k07U12jmVgp+gdzbMvXK
TLSH
T1D312FE07A190849BFBE0C570E5D32B79337BA208494BBFA7069F663D1D93FA52157438
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 90e59220bb1cc8064506fd40fba6d92be5a2460e7d92d39eea0885dd9e20a909
MD5 a5927abed888885e0e6adf0e35fe2fda
SHA1 3221f9fdad81816507917888fe02616502b30a79
SHA512 0838614c4283b7b8edd61ab794def710ac9717bb5e77afbe9dead6b40ea8470f530ac6ea7524d97aa5f198e581fca0c4c8ebeedeec3fc34635d9dc8808b7e11f
SSDEEP 96:fUqCKQ6ZpKK8vJD0pPe1VuxFKaZMlFRZ8QuNGCA+Vgd3XKxKMjTtd4e97h6MeUsR:fbteeD1fy+U12W6jSEbag/MtGSNctXm
TLSH
T19AE1B617608184E7FBE189B0CAC32B7873BB56188907BF57069F573E5DA7FA02257428
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 7b9daee3f1d76ccd2a589666c4a57e14a043b8884f92e5a5d7f0b39ce20cf1dc
MD5 f09a4fb7908a5e2672cb15736caa862f
SHA1 fe3c5f06ae399aaa5fe4df3c2063fe5b29b1f4be
SHA512 4968810f2c5d79dec134956b94db85afb1dd68da6733145b78453eec7cba8c6521295ffe1a1da1126dd626efea9602789b57646aa5ff0d8a3c90324ed0422cdd
SSDEEP 192:wRsZZS52sk0waU12FtjyhbdGp+gdzHbp/SrvXr:wRsOosk07U12jmVgp+gdzbMvXr
TLSH
T17B12FE07A090849BFBE0C570E5D33B39337BA208494BAFA7069F663D1D93FA52157438
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 06d30617f4d52b03dccfeeee6dbd23bd5b9be23254c4ed6bfc513d3139e85441
MD5 7b073a635a7451d83729bddfcdb481e1
SHA1 ecbdee477da00b490210416a4157581f1f869962
SHA512 acdf401fda7c4791b08aed84c65909f841c4fa04911a7b4f0ca5dda40a0ee726b9ab22d39d4a6b798d2ce5084961dbee0e6c0754e2ddab327e86122eb2e418a9
SSDEEP 192:CrP6OG1S5Ge9KjZTU12WojRTb/H2o+rs6uRrspzaDDXc:CrP6Od8e9KjxU12pNXv2o+rslsQDXc
TLSH
T113221D4760908097FBF08971DAC73B39337B6209984BAF67029F1A7D5D93FE42197428
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 62f8dfdf4e7f055626b9c75b74b40df9e4b2e11378b5da135aa959f6ef0f5f21
MD5 76eb16c71d7d0ec2259553e4d68aa954
SHA1 d104e895d339949c8f1b2de1ce002c24003129d2
SHA512 af6265364760b07451beb74ba1ad22a1a5018ba5b4d766dc58f290dc2bf0d9170e0eaf0335130b2c34290db701e6a4f1da652c216de0bb2ae48c930a1af7c638
SSDEEP 192:BRsZZS52sk0waU12FtjyhbdGp+gdzHbp/DrvXa:BRsOosk07U12jmVgp+gdzbVvXa
TLSH
T12612FD07A090849BFBE4C5B0E5D32B39337BA208494BBFA7069F663D1D93FA52157438
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 d3e0af805c150c6e567f408555260e5437c22961c3118c2c7021d2e9f5d6f793
MD5 748c6543668a8d483e9c635b548b6956
SHA1 fc7d05154bdfa604f2ce8ce0b3e52c1addccc4a3
SHA512 4be75b0de1e318b12a84710b738ed707115be55b92b67d9d8125fcefa191c4dd8b33000f6515c57a5919604efac5cdef4789abca404bf4f33e119aa1c358ccbb
SSDEEP 192:ERsZZS521k0waU12Ftjyhbdlp+gdzHbp/SrvXB:ERsOo1k07U12jmVDp+gdzbMvXB
TLSH
T1D512FC07A190849BFBE0C570E9D32B79337BA208494BBFA7069F663D1D93FA52157438
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe595421.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595421.TMP
Size 3KB
SHA256 2c579705705e4e046eed9028656c96d1d6a1445f238835224ffb1231252f9bcf
MD5 f1bde3d952eafa5690757a67f2ad8751
SHA1 ae31debf0b85f33f84045a63e420c73f32c10ebc
SHA512 7b8136f0e35207fce5f4d23d531ee56289e019e22dbf8c9c5b155f6d6d091018e74974dc1fd83f4f5b07a16e5d777e8eeb4d432863241456f2891675b401286a
TLSH
T10261A284504480EBF7E0C1B6CAC3237C72BF85080E573E2912CB5B3DAE25F21118B438
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 109KB
SHA256 2cb2ede5d88aa316083ef8e0e01c04266187d253cf449de4a5969e9c2ff12167
MD5 03dd5c94977d688d168910d3eaa2c06d
SHA1 fe09ff9fc42c04c3b7a49eebd153be7d539bd403
SHA512 4516cb7badee1f28d4af8f8ef125fffa411a05acefaac57f255747b7ae36208ed353e8c6d8f1f8e51efb63e7bb50efbbb0f7d788425b35aa8ac0e7098124b623
SSDEEP 1536:wfEEjpHOefzGZqW3HkPDuVqpBOPcevcZsL62UpPq:JkH0aI5myUc
TLSH
T116B36336D6A54C7B01F16268EC651382F325036F9282A92F3A7C6D5D2FFD93A5502F2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 73KB
SHA256 5477e4c68c250a7a1a4616bade0af020dc13c2b5385e0113449640fef205789c
MD5 69c792ea753374ef8b493a93e125bd59
SHA1 0f869b03e9dedf4706a981179e5b9191abda0b09
SHA512 01e122a8536e3b48b714f23c809ce7cd16c96839cac613d75e71dc9ca920d040ec98b105b9b9a9bb9c5ef28ead33c730c4b3740542c506e4d647e2b58f680eef
SSDEEP 1536:7+mOyAievkX41qiqQQGFJFaCNSXxXFCvqd7PkBHxRTEAUFZgK6f4a/:7+mOvvko9qHGFJXNShVCekDhEAUFZgKc
TLSH
T11D73B52F46D059DBC759C1F149250FA65B7A1D0A68E8A0DFF0CA736DF976AA00332D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 351B
SHA256 fd4b0a2270795c55e3ac45b7d0092f968dd0a895df2e2692764c0a0ed43c67d8
MD5 21411361db3f66eda77024d142286c45
SHA1 0b22fd2d03bc74d2bfa887a98268010f27043d7e
SHA512 1193a3b5779e1da96da5d1b16eab1371aedcbabe328f7b1cf6afbdc6a8c20fa4bea1a85611685b43e4012cc7f54ac25e2ca15fc6d91a2cdf66bcb0a8b7cade4b
TLSH
T1C2E0D86C84C9C15F511464F716347B0ED6D7760E97CCBEC54F09D810B186048A46E2B1
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 831fe3c68ba66801fa14360ef6286110ec767ced10377962941c56f2ca4e02d7
MD5 2e886547c746568dcd6f3cc1a4d909e5
SHA1 3e88d803528199877b3ccdc8b3bcd26d19c32bda
SHA512 b613cadb7a1d2b0ef0fda6942598d838bce6db0d4574a40a703abca22d2acaec793ca5d2b6e6c43c841f76c0982d6f1f8fc7310374af9471852e04fffc2fe0fe
SSDEEP 192:D1cSTkHTu0JEe1j6es47g5yFaTizAbCmUgClve7g+lsfC2qpMeUJ81XFIGydjZ:D1cykHTuQEe1Ges47g5yFaTizAbCmUg8
TLSH
T12602CFF3C3E5466EC91196F0EA186F1FCE1D0556436C3D4A85E4AF0BA3F2870E191A9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 e2f37d688796f8aba48d8584e9f38d4c445f4647835047594c2307f2cdf2baad
MD5 8b6ab83dc81ae23a05071441ca95065f
SHA1 b28c3ec215677f18458590a2cbc07df4704ecf02
SHA512 d4ab6b02ae9405320a16c339308765a833f5f76c430954867ea56666114274be7494e660310756b422c15d4e258a5ff607b104d9cb254ea9953f098980496f3f
SSDEEP 192:D1cSTkHTu0J4M+eMmJ0AJ0muRe1j6ei7g5yFaTizAbCmgClve7g+OxpHJ83ywLci:D1cykHTuQ4M+eMu0AJ0muRe1Gei7g5yZ
TLSH
T1EC32BCF3C3E5466EC91156F0EA143E5FCE2D0956436C3D0A85E4AF4BA3F1870E291A9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 4182cf69eccc1404aeda04f9c2ba75eb1352f9d6f9ce2401205d30363b5c8925
MD5 8e6bf47fb20d630785db82a69e2b3a58
SHA1 0c76f0185d1864bf8752c624ec3538655005b4e6
SHA512 cb68ac13b627af99dd938ed6d0a3f8562379ec7a2300bc8e06d094226017246ad6f9674470a273299ee3b44d54129776dbb9c62074156a908e3b3452d396ef4b
SSDEEP 384:D1WB6xtlUpfVeMu0AJ0muJE/Mdt+1ha1Gei7gTFaTjAbCC2e7q+OxcHJ2yULcfgD:tYIkLVG1Jt
TLSH
T1C352CEF383E4866EC91166F0AB187E1BCE6D0525436C3D1B85E4EF4BA3F1471E191A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 2bb6733ec94117a6ff65a0e141c615a91e42b7503c1c4b89197014c754120a69
MD5 a50c67b4054dd4a5298a1d4745fe9f2f
SHA1 9ac00027be2d169c1a5ac125ae3ef4c75485ef4b
SHA512 1d0bf565706829050cbf71ade61d012af0eefc091cc59c11b21f886d45333d636048076bde56bc6261bd849a610723482ad90d9bf3ce41dfb1bf3cf91f86fb64
TLSH
T12331DFF3C3E8856D8A0185F0BA187E1BCE6D0954932C3D9AC5E0AE1B93E2471D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 8da518841b4ac27654dd8382a92acbc65bf6aab4620e6277475f91fabfd9d139
MD5 5edd2d142c90e4f2e7ae35a990ee144d
SHA1 b800a26d139191242125d5af88d77315adb4675e
SHA512 ef05ea3b1cb5102c55b076a1df2bdc020d1eee42d018fb8c47bdf49b48925467279ffeeba0d2743778fbcf934b82591c65fa924d1cb2b7cbcda9d03a6eb1fcfd
SSDEEP 384:D1WBxtlUpfVeYyw3JfLoJE/Mdt+1ZTSa1Gei7gTFaTjAbCC2e7q+OxcHJ2yULcqs:J6JkLVr+Xg
TLSH
T16252EFF383E4866EC911A6F0AB187E1FCE6D0425436C3D5A85E4EF46A3F1471E191A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 98c7a45307ea3146620d6ca0cd3e0d3791acf68c8d067478298f5e5e0a7d8fae
MD5 34235f10e5d049a3aa07361b9bb0ec1e
SHA1 29b5d4230acc66e9744d77a9ea95b1977d393db7
SHA512 ad5d244299409938aa9d80dde065c7ac0da6370ef6349af5aa4ac37033543f9cedeaf52334cbd4ad921d2c844150d64053fbde3e416b0f7501131019ade8839a
SSDEEP 384:D1WBxtlUpfVeYyw3JfLoJA/rqhTqKdRZa+i7gTFaTjAbCC2e7q+OxcHJ2yULcqgg:J63LVr+WEh
TLSH
T13952CFF783E4866EC911A2F0AF187E1FCE6D0425436C3D5A85D4EF46A3E1472E191B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 38acde7aef4d76cb36588ffe306499e971d0daa238457d218c496cfc12f7f380
MD5 661d06d9285afd046da4745ac8cf45a2
SHA1 3362f09899c6fa221e94125aec4d8130931bf1c0
SHA512 1d4a7eb76d47e5128646d2a28d58798fff5168d51a5a5c09df85c7f39f46f612eb0711576c5f95f1286e1d771ff0b7c2e6dc9cac19b29ab39850bf1dd99470af
SSDEEP 384:D1WBxtlUpfVeYyw3JfLoJAH/rxqhTqKla+i7gTFaTjAbCC2e7q+OxcHJ2yULcqgV:J6tLVr+klN
TLSH
T1D452CFF783F4866EC911A6F0AB187E1BCE6D0425436C3D5A85D0EF46A3E1472E191B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 20KB
SHA256 54c76a0075af5515d611afcb760276ced3e9589389e0e468bc9b8716029916ae
MD5 810390e830c24743ac44f0a3c7185971
SHA1 e14e9f044bc1171ab494480acfa2555db60e6b32
SHA512 0c599b094a4bdae360c91513432c149864bac5b7b38240a21b308a107223f8eb9bdb0fb709eafc63b6728f43875c3f3a2294c6e5d939aae3d935c66e3c510ebf
SSDEEP 384:D1WxtUpfVeYyw3JfLoJA/rqhsqKdRBCHRWf05n5+FeEK5Szta+i7gTFaTjAbCC2/:V6mLVr+OYcM
TLSH
T1F592DDF783E4866DD81166F0AB187E1FCE2D0924436C3D6AC5D4AF47A3E1471E251B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 5ae582e6e311a0fd5d654812c7bcecbc10194323dc51e305fa53e2fe24b54a20
MD5 a8276a27dae3bda10196e6f39ffe7b80
SHA1 a480de3a8017009ab6a6311c0bb4042e80923bb8
SHA512 4f32230201ab9409cef70a93f6c1409e72c3b117fa04c83ab33ffbfce0b63446c9c1ad1c62379ea873abf40f6ed342b753da38324a70b5b3f42ee7aa723fc8b8
TLSH
T199D02223230A71F6B6BC6E89C07ABCCFD73670242C82DAE620E098D9353656C8507145
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 79ca7876ed3c9d397bde82183721a765e891e261820e2607c88f5da25855a1b4
MD5 8215f7a9d5868b2f5c343c04b464d923
SHA1 2a6056d38f3980e69a1e15331bfae4fbbdcc4d73
SHA512 c42789067c4688003ff95d56a423e5fdd105a89e8a6e4c4078c546a1fd85507a49f274084f451c235a0fb473f005d80a9e5656ad22531cc382f58b7c51427b73
TLSH
T1C8D023631305B1B56AAD5DC58176FCCED73520240C4199D510F158DD353645C1517145
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 6c27f10e5a27359120ce9b9b0a1f163b742b90c2f192d853e2c2c34db01212a8
MD5 7ff0750f21f0c113c338aa15e26fb8b9
SHA1 94001f5a7404e6a3288d931f6a0535e7ba3b8a05
SHA512 a242ce40d03e937b5857d125b0ae7860c3e300aa1e97a47f93371f9225dd456eeb78d3792b8953929383229b7b920476cb416187c81cb3ce9fe48e254e49f8ec
TLSH
T1A5D022A3230531B6A7AC6E9EC07AFCCFCF3630680C829DD620F158DC263786C050714A
MD5 SHA1 SHA512 TLSH

Submit Download

ab2f81f9-2d97-4a14-9eb9-2ec37f9e4f94.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ab2f81f9-2d97-4a14-9eb9-2ec37f9e4f94.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 1effa002c659ca82f6e8feca07f57197fd0b0860ae734fbaf7e65b7c52287cb8
MD5 accbb880402f06a5111b9d7777ab3f70
SHA1 f4354f72022f7d05eddf43111a61590964de34fd
SHA512 b717fa21bf2a3449a55871b31be1e03b980fde8cb0131d311dc2b2ddb378f672ab27b8c1943e3bad2aafb4e4e5e0ee071604f2807157bd0a0678905dec6dea0f
SSDEEP 384:sxZ9lamhQ/fas9jcKiCVH0RA/8QN/HbaVT/nQPzWsCNER7y:sV8mhQ/fbjc9CVH0RA/8kHba9nQJC2y
TLSH
T1C1A20A57656849778CD6C629F925BF63D7F90423D9904E8CAAFCCA0C00EA6ED210BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 51f819b063f4c99805fee16f24055a06f9e95d21647ab48e52454359436b3ea2
MD5 caf659f6a3a8664f92adb55e108468ad
SHA1 a72e0dbb4cc5cc8a794a73327e4553c4af33800e
SHA512 f3b0f66b368d3a5519b28a1800f2de17d36a00813cafebc7977a01640ab2472af88ce908bf874adce7c7e2e7bd58e6ebdeb4f5dc94344525fd98b8e245db1c76
SSDEEP 384:sxZ9lqrmhQ/fas9jcKiCVH0RA/8QN/HbaVT/nQPzWsCNER7y:sV0rmhQ/fbjc9CVH0RA/8kHba9nQJC2y
TLSH
T1ADA20A57656889778CD6C629F925BF63D7F90423D9904E8CA6FCCA0C00EA6ED250BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 751738723d88a6f93fe93e9e9270f7f85d19ce1b4f0a9b6dfccb1b2dd84d1473
MD5 1f2b59f2fcaf95d5e3db1d81d503e634
SHA1 55764315361b2c0a85dc0dccf285adaa55936dbe
SHA512 ec8ff5531165224ab89052305e9330b858c4b3a99b34de7b244029d8e4aa7d487c2fea571573f687a15bb99766a69f31ce0aa701d8768db242d6969636121ac9
SSDEEP 384:sxZtluPQ/fas9jcKi1VH0RA/8Q9rHbB/oOcJrS:sF6Q/fbjc91VH0RA/8kHb1k4
TLSH
T12782F8066A68597BCCDBD229FA457B93D7F81473D1904E48A6FC8B0C04F6ADD220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 e6b5dd53ccf282496ab05c42c25673dbe31bd922be519bf9ec4af9969e944f02
MD5 8e78fcd6a6f00ad75b0353d7f6e4536a
SHA1 b3ad9040898bc457f30bf82f254e0f09e427c001
SHA512 bbc79267c95883f63b57e80b3abb743c4f75502188a0580e095c6e82dc844da6ff6d600416536fe259faf87b54250b120a6eec803500d144ce21a4d8bedff992
SSDEEP 384:sxZ9lsmhQ/fas9jcKiCVH0RA/8QN/HbaVT/ezklNER7y:sVSmhQ/fbjc9CVH0RA/8kHba9t2y
TLSH
T111921B1665288D778CD7D629F925BF63D7F91423D9904E4CA6FCCA0C00EA6ED210BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 23KB
SHA256 7a1c7673923fe87f98284937e0b2af1a82dd2535006fcb2ee794296024d4ff62
MD5 ec2a44a3009102e72cb45abd2b06d194
SHA1 406dc872f677fb71e217b2e9aa7c4afdef7cea03
SHA512 a2e0104336bd454f1e4dfe3bd835ca3d5bc89b6c2c125c98698410c5b5edb1cc467b258a4f922aaf8038b23194f6482b36e611ed8769fabbc7d94f6a996bd667
SSDEEP 384:sxZSlqrmhQ/fas9jcKikVH0RA/8QN2Hbncjq/8/nQPmmsCNE8Xy:sq0rmhQ/fbjc9kVH0RA/8tHbnc/nQACq
TLSH
T1CFB2F9536568497B8CD7C225F965BF67D7B90423D9C04E8CAAFCCE0C00EA6ED250B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 92bf049aadb60c86c03046a7e3763070e65dd79c8063a861423b9619ffdb622b
MD5 993033268e1082031afc3c24abed279c
SHA1 b12b89ce6508a70bbdd2862b62e72ad9071ac091
SHA512 d28d1784008f92ac2ab99127bbe4f57e4d3fb53367972e3a1aef104f483e8c9575878b04794502b40248437835f5b6440a9af17ecb3a8398e9b86e0601f8b308
SSDEEP 384:sxZ9lqtmhQ/fas9jcKiCVH0RA/8QN/HbaVT/nQPzWsCNER7y:sV0tmhQ/fbjc9CVH0RA/8kHba9nQJC2y
TLSH
T143A20A57656849778CD6C629F925BF63D7F90423D9904E8CAAFCCA0C00EA6ED250BC1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 38KB
SHA256 59e5c5422060e5745656dab3f91f345425189585da6c75494ecf4cf69a909c77
MD5 0204e0527a22782c68fe875f462eb07e
SHA1 718d0a42f8fe94b267b9c8a8803be96a2ddebb9d
SHA512 85648897e4beb4feb089eb1aae2ee6ce2dc55e6f0410e2fd309f09194a5faa374b73e39c8fe92941c05de3b1e93695350cd46976cb92f10d7ed502d34073ca3a
SSDEEP 768:s80rmhQ/fb14Mnc7WeT+Uc97VH0RA/8uHbncgnQECm4:z0rmhUGMmWSW7VH0RA/8Kncgz4
TLSH
T10B03E942A424C87B9AC35E29B43DBE379BAC145296C4CEDE56ECCA0C00DD5FD6B0B857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 39KB
SHA256 8b9366c86c00e5d3fa97f41e59db2fe597120ce3f8b55b381e3f962fc39aa7b7
MD5 076e0dee0121d304799023e2b03ec4f8
SHA1 9ba7ec40b39fd29f317cfef51b678bd91426256a
SHA512 d17f097102a91e2d9bc369f2080b3b69465b24f7189f1b475cf3ae17c231dceb41b5ce7298d87731fc40f6110eb25c3af76bf8ac29987dfd876a51f5dca9c2d5
SSDEEP 768:sW0rmhQ/fb14Mnc7WeT+oc9+VH0RA/8sHbn+aNQ8Cm4:F0rmhUGMmWCW+VH0RA/84n+aZ4
TLSH
T18203E842A424C87B8AD39E29B43DBE3797AC145296C4CEDE5AECCA0C00DD5FD6B07857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 e0a23371fcb8cdd9825ce5753eb3875cff98f763a1df8c7ca23ab8a1fca2d9ae
MD5 46364dc016bac62f2ecb22699b0fbac7
SHA1 306361b07b23f2567f4691da092a46f59f745665
SHA512 58dc2dd53b94fcb464a81995b4d8c7630661ed69df14db1070aa7ab96c328313a680c1ae4875b2b2c3bec53e3efaeb25b718a0e7b01e599d61db5c9ecbf06ea1
SSDEEP 192:sxZtRIy4pBKOMl8MWPrU/fas9qA/TeqrjvOq9oJpLHW6+WNGYKSI7rIg5/rGJ:sxZtruPQ/fas9qcKiuLHbGJNrS
TLSH
T1C862F9156A78997BCCDAD219FA457F53D7F9157391900E48AAFCCB0C00E6ADD220B82F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 059ca945187602cbc3231508da0089c7a64e0c63acd07c530323dd0cbf85b1f2
MD5 f9001d6cf12c36dcc8b53d0d0b0041b5
SHA1 91cb515e915606fab1830ba29b386e76ae5070f7
SHA512 abede169b5da5b911464d3d59bcbde694e14d3960e246220c59920edd69ec4dc16aeb1b2103ec507a688252255ad68d251cccaf369de4934f3633e51f73ca1d1
SSDEEP 192:sxZtRIy4pBKOMl8M9rU/fas0qkvqrjvOqzoJpLHW6+WNGYKSI7rIgjrGJ:sxZtr1Q/fas0qaiwLHbGJjrS
TLSH
T16562E8056A78997BCCCAD219FA457F93D7F9157391904E48A9FC8B0C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 bff691fc140adb6d90b0e27238555d716602bb815e37060ec158d1d7406a40f7
MD5 6f7f105ab6e30bfa3445dfe591e14a99
SHA1 78a830258da1901ea5d78a818f7594e46f775d8a
SHA512 59fb9974287453e40f339332d6b32196701cba0e3d867c3153e492cfdaaf95ac696071c691655b187fcaa77f9cb999472c7391ffe3bcfb84c4ff5b28c2cb305f
SSDEEP 768:DcgLiAo7pLxLcaeWvaShq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVcMKJLlhzCpUroc:DcgLiAUNcaeWvaShqu1ja5MKJLDOp/c
TLSH
T1D8F20D3B2C0CCB7E4F844E9CDC2ABE8E6DE8028B9698C95447FA445C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\2de6550c-cb65-4d8d-923f-0ba87d3d5230\index-dir\the-real-index
Size 576B
SHA256 05cfada3f69e53fe6b0eb243e5fa46f94e7867f454942427450dfc66deafe707
MD5 22875b6e8e37a134aea272f01e8668d7
SHA1 597b076c5db605a045328958e0ecc11163b1ab63
SHA512 f3dd4aec8b9f65f95f7f0535039c59646db337ae9f0735345bff297c8364e6f850f3ce7a72b641ddf3f99171ca4bbf5b4001b8eb715fbff8776bdf8f22399205
TLSH
T1A8F0AB354E7AD4CBEF1028720431186C623868063AEE2AE360202467AB6B6738E02205
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe654ed7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\2de6550c-cb65-4d8d-923f-0ba87d3d5230\index-dir\the-real-index~RFe654ed7.TMP
Size 48B
SHA256 0df5bd826b3ce8614a8322a42016c2c2b121b87953394f32740acc074c8a8859
MD5 fc48227b286d6727c9d50bc73b05de25
SHA1 191df499e51df80ed553ea93b7f45d48bc90ed60
SHA512 2b4bf0b2946cf352dcf0ba17994dc993694993ba6218a2ef0a79ccfe978771375900472bee5b0dec70fb51b1adf2bc8d0eef97c4f5e92ee04686084348ad4dee
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\384af103-a46b-479f-8e2a-d17507cdb46b\index-dir\the-real-index
Size 2KB
SHA256 a5814b1dda6252c6bfebdb7fdec9e5998696954c5338bf7467765346818aaebf
MD5 1e332e85144e53e7f3d1c20bc134f7e3
SHA1 c17f76c5b637b5f5701d939fd80ef82fbb032ec0
SHA512 1fbef14536bce54e74fa79c99b1872d3a7e22cd38178d01ed8e86497e0bc3a396c28953721369746e2c6050cd7ff2217ad726cec7a3772be1c923a0fc368ac66
TLSH
T1D941314CC990AB9EEC7551BA2DA414B557752D28FC1CC29245A8B2A434032640B879FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe655f23.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\384af103-a46b-479f-8e2a-d17507cdb46b\index-dir\the-real-index~RFe655f23.TMP
Size 48B
SHA256 fd1b2052e460018681b4b5c4ce94bea0b29f009b65b402a18b11409a254be01e
MD5 7a07caa56e9b950afd22f1fe56ce89fd
SHA1 76c6426263f8cdd55904c214ef63e9ee66455322
SHA512 a84b4938b5846f38e5fbc4f871cf13e57850d2abc12b7ae911e2225de8fbfa76ccb435f6e4c08c6952c72f512a3c5aecb1b0473b241f5f969be6ac6c769297d4
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 bcfc25afe8b6014368aa6af5421837a8c4d21a92b8d3115d6efa1ce11d288ce0
MD5 cf099553137d74355b2f2fd33364ec0e
SHA1 6785361822d301940a2087ddb672ace6ad2919ee
SHA512 c93363511426d937a1216fa180d7163aea2c7ac219165e8d70281f1711983355729b6c32804d6609b75999dc2480d0bdb2cb431c698e63b3c0f19be84f0ac473
TLSH
T1C0D023D59530445A1D30EEC4103C129D811BDD199CC0CDDC4900B1973074617C502D36
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 241B
SHA256 2fc20f69be2c15ef302c6cdb8309d7f0c94b0083b8d0e9c735e964afcff55124
MD5 d6ae472b43a12f9350bfe09e4a02bd98
SHA1 90b9c9213fbeca4f42303fd3e74f8b8b67f7542c
SHA512 147ff7b38f6bbe96e22a8d26a3e983046d90aee683dd5ab766ce7c47e1f696a14c98c701a97dedbf63b3d13d10d732e548eb71226f53a950d298cc3d3a5b5f1f
TLSH
T1AED0A797697184455D715DC8217CA26DC21F9E498DC6CCDC416570186474D13C112E38
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 239B
SHA256 adbb7b283832330c1b6edef345b3d9cf48d3b8a893e14153d52118a6e4924102
MD5 44700b66843568bc6d8223d68108aec7
SHA1 f265ac5f445e69796f24aef18ec69f4347296c7b
SHA512 38e259a995f9afd43be0bdbf167d6177f4a6a6b1b9ba7e6ad170bf35f0901d29b75c82a48d5520f5ae119c0506a9b15f20332b1540611f712a46a6c9a8cfb8b4
TLSH
T190D0A7979E6184455DB19EC831BCB26DC24F9949DDC6CDDC566461192174923D012E28
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 2498d37dc9a37f46276e318ada6193954eafae1c1222f5e0f1b00afccd0318aa
MD5 de93bc9585bb39391db0a8bac65978de
SHA1 ed5c3b2f8b0a03dce765d5393c610235a74678ad
SHA512 7dd5286ff7007162cae84c78f5b7ae6192306c1e3c9c96720440e17ce2b330d8640adcbb6d46abc96f3b7d348f42a40ea691b02ca55bf80f1c0e249fdb5302cd
TLSH
T17EC09BD75420858B4D71EEC8113C672DD71FC55898C4CCEC5014A0452434D234403E35
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe64f492.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe64f492.TMP
Size 137B
SHA256 d319c2ca7ed616ab298fa68024303cbba518b4acd4f11ac07f61a4da1bfe2583
MD5 e1141be419d7e856dee423a7fae0ad56
SHA1 beddfed270eb456a04b5f5c9ab9bdcd27c4da1a6
SHA512 c8ef937b71ead65332931812e7faa94a34d84d1e25194e3b57bde4fc2c49d5fec059c5fb5ee41838ae832c183766bad0c4d8734f2291f6a16b818fb4c5d0b3cc
TLSH
T1D0C09BD7443045D64F71ADC51138675DD72FCD59DCC4CCE85015B05530349238502E25
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\494b952c-85d6-4869-8f83-68ed97a13e01\index-dir\the-real-index
Size 72B
SHA256 974eaf0c6e71377498a655cd7fa9decf381faa468ea70fcb31671a035273d494
MD5 3de66cc1d4194831226d766ecad8e940
SHA1 3542b7d08df3d78a66118025fe82103b198a985a
SHA512 ca4c3b97fc9b03952b627c35cd48323742368d439f72d05fb7de83136d6aac28f59fb85a2da617bc88dc18153d833ad7fe50775bf0a91b69eaff644c7a184ee2
TLSH
T151A0025413A64561D13407715141066123A0CA2147C1132B94B8506EDE947C94D0B051
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c525634b-d4e3-42ee-ba7f-48d143c62b85\index-dir\the-real-index
Size 2KB
SHA256 44dc04b230919d55a6ccbda39d7ecf581c2222cabf2299fb6de2556fd06962a5
MD5 a2bfa7c6d8a8789de7623b8e0939b2e0
SHA1 755560255070b2f61c29f3d741c74ecc58d5e91d
SHA512 18ccf48c08ce261b28a40ccb9359401cf6877a1b5d53d58d2a942d2804b2a6f653294c878db8a024902ec3c39f5a647c9eead8dca37e675692149a850701cbee
TLSH
T12B51C38D2D4B6B6BE8AC52B204B31498337848CC6B8456236CAC62366E5362D1D1F3D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d84a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c525634b-d4e3-42ee-ba7f-48d143c62b85\index-dir\the-real-index~RFe58d84a.TMP
Size 2KB
SHA256 92aa77314faad58efaab2ebf0c0aa2232993067019237dfd9ba00ec097521c6c
MD5 fec815c1edde774266e05bda8ef1758a
SHA1 af54fe702454a821e3fafd8d8830f8de263f1541
SHA512 42cf12cb3282096f3c6f56b15656a54eb1c053fe11819d0515cf8dee980a3e80b4999f92df2f4445637a1d08502cca1bbffd1b73d971e7b146b0aaf0de35678c
TLSH
T15D51B75E9C830A31C9A491B359CA5469333D68958945AF0B35FCCA33ACC36AD3D66384
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 5cebbf28b9a2a5c0ebbe4904ee8db2cf3ef245d7c188c9ae162fd11e0c73efaa
MD5 6340b83f76857f979e8d540ab6cb6f9e
SHA1 9e0d1a9d706e81bb037af4d63c953b14fc140eb6
SHA512 ee68d0f9a00b28a0d319294274e9bb39f4fe5a85eb93860b9f464df745ff2a84c6c9b9edc4ac04883098584e89b65dce2e4f3751f6f4211b28fb970a316ab566
TLSH
T163F0277B3FE71814BCBFDBD5247100A50401795A8954ED8F1416BA97A0F52142499C72
MD5 SHA1 SHA512 TLSH

Submit Download

fa813c9ad67834ac_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\fa813c9ad67834ac_0
Size 168KB
SHA256 02a1d8cf59fa99ae14472d8a9abe4ea2b14546f4de1dc395d1154456f09a3382
MD5 67d49aaa942909266f19607c372301cd
SHA1 ac803563debbfcbba7da78e21493180da6b2a192
SHA512 104a2228192e0622a727eb664bc6b2caab9e309ef5d8664e3ec9ace8a04571b0bd222de2c06b200fbfb80fd7c56ab15fa0b267febb3a5fdcbfd5315bd9dc3322
SSDEEP 3072:+Qe+sswSjnxPCA1jOTuDK5NvawiHvwRUt7m1KULC1Hsy:+csswT5MwCvwRUbTmy
TLSH
T121F38346D1F8D863AF7B0053E8967E82F32C3147E619DAA0F587BFE1501E62A70B5835
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa813c9ad67834ac_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\fa813c9ad67834ac_1
Size 241KB
SHA256 31bb450df7f8321d24580e6dd2577b1d39dce6a5b5c90274a2c26b7db3122c28
MD5 a5bc2274f68c73aea5feef251795f8db
SHA1 8267beb1715f57337aa8229a404f38aba4e2c8bd
SHA512 18f8008653ff0b266207b89d83d0979472581891f48ff4c01cb9f842409a5c97dedeb786176225ec3e0d7bd2f470b9ed2726f4297e5f85812b5a57134ecb7963
SSDEEP 6144:lh7Vhld+M/ZuHGeOkmclDgJpusceFWb/1DQ+OBCU1:zdp3OblQ
TLSH
T161343D9A6326137FDF3903B95007BE1163210141AED3C1D6334A57A6282EAD776BEE3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 024336b0653073b63b73d2eff830e76153fb402c947b56d521da7ae5ba66d47d
MD5 cdb3f239e15b113ac85b93e83081b8f4
SHA1 a42ebc8d4232c14d2cecec209467cd01273513c3
SHA512 250d564ec08c770b905b3c60c0c80da25d36226b5faaa4f5c6be9b33ae74a15e2de37d2c8553f539a48bcf6a0374bd67092b995dcf6f0323b9235e003ed429bf
TLSH
T12FA002D395A4946DC158067450D317A4661858FC1F2A530250B841C4E9A554595AD08B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 898e1d9df726689ab385c47df92386c4291dc1b9cee97ae7238c5751f522a606
MD5 8702da31dc6a91e9a7010822eae0a99f
SHA1 dd569176c4b53ab4299922956f6969c8b4c11b9f
SHA512 6ddd0101b519257f3081cab04945c58f551b507131a9fed4a70259c305b48707da296445e114adc331b140210b8966845642fb3ef1ac46e1aebe517da52d68ea
TLSH
T1BCA002538159105EC1102674E5D356A42210899D1705375141A80059A861195417384D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 eeaf6999360b7fd316cde1f82306891459f69e7e3a0301aee9fd445b903d50bd
MD5 7c2f3ecf84131e85ed42e886380fb4df
SHA1 6a98f9c15bc3a5b01dc70d646ad4780d92381f1d
SHA512 03fd99971b91df2d6302e1955749b45a6ce80a7053d844157625c6efcdb3558ad68432983aba3bcc09084060a2ebf103db54bf496963bc4d32e35c90ddaf0398
TLSH
T121C092AA81499574D1580339508B94E8A2696470523A52AB20E892A4A479410807EA86
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 1cb671dbd165e5b07e3a0ed562197a8c37ed177a9cccdc099a1471931df8dd36
MD5 0f0d66e2bd1df52208fd30f5b1e81def
SHA1 d829b5c65056a1a07bf33287a70f177e3a5b9b0d
SHA512 417e95fe894afc42dcabab66b1bed50a2ef2e4979690c035a94e83f8a6357142a406ed135c8e47cc8c22b4899bbf236c6a2ead84b5d3c5da47ae49d918187a0c
TLSH
T155B012520104A125C05E03711082449432180A34C3290185006080688535500809D002
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d3f5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d3f5.TMP
Size 72B
SHA256 1c83ede46b2268097aa6a14721f06d71fbea3bbe5cdf116034f45aefdee753bb
MD5 79a1de35346028104fcc9e1001508475
SHA1 06974748b730f208b84551399c89337b4df59c0f
SHA512 7e763309050786eff440cdf4ed9ae0681c52a9a788118b3de415f184e526de9fca04da1296ed148be7555627333373c3d54d4b9c1eeb6f88f62e01a5cb1618e0
TLSH
T187A00210D75B1401C459D5B92047236063608869400022124890D1DCEC910C0ADC1103
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 3c586e0a7d928b0193faeeccb74d8504e44b5bf9ae892231680e6d048a9d4c4e
MD5 245d0e532e8c45587d4faaa2063e40d8
SHA1 1c2b4ce8c97776197217930db0689c65a0929f16
SHA512 9e8c716448e5629e0b35f2092e4cb5f132727cc55a5e191f11d1004d5f7d5f9d56d9bffcc0f1fa06179c5916c9f350e551371df854fd4b6fcbd2e509eb1ea373
SSDEEP 192:kBhNHfIVfhRXF4B6W4KqV2j6Ok4pYLQobOyzcp/KLNDFdxLfajR+:krN/INhx+kcxKBD7xDa9+
TLSH
T1A9C25811317A16D13A7E298E8595B42F66C230A33098B53B7BBD04B61F6BE20DDFD4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions.dll
Size 83KB
SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
MD5 956f610121cd5827fd5549097b79cd9f
SHA1 dbd23f99895a3a92fbe04c3c35d475a6f6998fd0
SHA512 3cc4712f64474497495d229ddd743c6bf25c30c3fbfca2525f46227d99a59a0f9e80e2119ffb40bc8a707b539f65f907e2e1565ea937e0387db47cf7269944e6
SSDEEP 1536:sNGnmI1FOxAdgxBf8paY3JQzQik428fKagFVbydki8yyafuzWk:sNG91FPgrfrPza428fIenya2Sk
TLSH
T16D83F180DF58411BF86F4835E0B269857A78E6B50FE092DF2376C9590E12FD1AF39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.6\data.txt
Size 145KB
SHA256 44dda6faa8220666a11a09301932b82c5d89ba5cf60227ae3b5c3a0a7518bbac
MD5 370210ebc9e63f6f39a4185846435533
SHA1 17b63f65390d236465b6952953a7df4cbc6fce1e
SHA512 e594ebf58d19f6d9e7024f98107c738142c6cc2504a0ba89e13f8f771c6a600427e75951ccbfe105983c21b735dcde6e6e173f4da37745c4de51bb9f5e86b989
SSDEEP 3072:7PAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEI/tLZjUd6mG:LX1aI5aZoKzMJ07NI/leBG
TLSH
T105E3F1108EC41FACDFA8291C70BE0B1D63E1C79D84676585E773FE0AAFAB90462275C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-checkout-eligible-sites.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-checkout-eligible-sites.json
Size 23KB
SHA256 2abefae3d72e7c4f5cdc94eb0ee552612d843a26faf4a7bd061c73839e19d7eb
MD5 ed22bc3ded6df0109b9e594867473559
SHA1 ee39eb80dc23f7fd764199cbe4a153c4edc2e768
SHA512 fb337c0a0107dc37a3067bcd6f60ffb8f63ee892a0ff729dcdf67c7a21fec95a742a274853e8947489108d7543c13b9479e02574f490bc217e8a182f08543aa3
SSDEEP 384:rQR5dkrKzmQWgFlhpyZv8CTi8I6kxAvh0mD:reKrMP8d5JIVAvhV
TLSH
T18CB21064C9210DE11FE4412B6878224B1A3C951B8F90FAFE3B6D928C1F5E06F61B95FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-notification-config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-notification-config.json
Size 804B
SHA256 bb26ce6fe9416918e9f92fcc4a6fe8a641eceea54985356637991cf6d768f9fd
MD5 4cdefd9eb040c2755db20aa8ea5ee8f7
SHA1 f649fcd1c12c26fb90906c4c2ec0a9127af275f4
SHA512 7e23b91eab88c472eec664f7254c5513fc5de78e2e0151b0bcc86c3cd0bf2cb5d8bb0345d27afdd9f8fcb10be96feaa753f09e301fa92b8d76f4300600577209
TLSH
T1AB0189EEC8800EB216C24A3A163985C31A3756576C953D147FC9741C2F5D62F22FB98D
MD5 SHA1 SHA512 TLSH

Submit Download

wallet-stable.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-stable.json
Size 81KB
SHA256 c1611bb1872456d5ba656cacea801b833ea43126a6ad7e43e143d52cba9d9597
MD5 46ca0b1726448d9c7ed48735c246336f
SHA1 8e26f1f1c6f909f2f3d34c17e042e579f3b2b449
SHA512 c9ec0465c2c0eb0bc0316163f9a2dab9332c372dfc4ebedb0ef4139fe1195efdd8aa34367155c29e659d97d5a27e2395ce2f6012c115ef5791bad270de26bb28
SSDEEP 768:r7PEXSl9cv2tlNnqSBBoCJkQgXzwb7XARjMLVF2CYgYHFkJ/Eqajvapznp+9l:08W27jLgX2ZLSgYHFkJ/EqajvWnAf
TLSH
T1F283DB29C9120DB11FA4001A28BA290B297C960B4F55FAFD7B6C938D1F0E45F61F59FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-tokenization-config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-tokenization-config.json
Size 34KB
SHA256 0088d5ebd8360ad66bd7bcc80b9754939775d4118cb7605fc1f514c707f0e20d
MD5 ae3bd0f89f8a8cdeb1ea6eea1636cbdd
SHA1 1801bc211e260ba8f8099727ea820ecf636c684a
SHA512 69aff97091813d9d400bb332426c36e6b133a4b571b521e8fb6ad1a2b8124a3c5da8f3a9c52b8840152cf7adbd2ac653102aa2210632aa64b129cf7704d5b4fa
SSDEEP 192:0NOKnK+QXzpTYaDEqIyVZ5mxzrIAfrXKoNKExGI+MmsMR6Q9GMKPrZnfB4FXZ8N:SOKK+QXzpTYaDEq/e5EAfrRoRI+B9wC0
TLSH
T1A3F2FCB1D9009C932F58850A20BA9505376C52237F86F9FA736D424E9F9F58F2530EEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet_donation_driver.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\wallet_donation_driver.js
Size 1KB
SHA256 39a63d56be4f1ca950310f385e8a42f7bc2dcc0e49fefff306176182bfa4f0e5
MD5 03abcce3f9828372d9876aa2e6fcdbb0
SHA1 cf5834e1af5f7143e62a29ae0f7ede79178b3574
SHA512 ef9b7decb4cfee3961006ea5c77299a48fe6a667475772f2a78e93bd4f691dc4700f8008138c574898fdcd8d717d84b8b201527ddb5a61346e05d362aeb15701
TLSH
T1ED217BFDF3806F9C1692021A35BAF5B625200C74B2823DE462D408D16F26D0779773BB
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8b910f0ef0d9f3a72404537ddb7b39e6746e981526e6dd3df3fa29fc8d2e7696
MD5 bfdb51acd0faa334b37affc71e0eb9a4
SHA1 19668ebb5c5ba22c13b837c3bc5f2131635088c0
SHA512 b2b945a9a845f0962a93e0c9d1297edd0ae6ed9f0bef87668bd8778db12270a546a864a734e3286f2d31834018c35878546b8bd744f2d44eb0b474937876ad7c
SSDEEP 384:nTiF9CcmyWC1sNq8TUNTUlI4ysKT3TPmLCL2OwfjYYpz4vzkyRLPPErN1k+5vI+O:+Fccp1XwgXs2tL6YYpqk2LgPy
TLSH
T17DC25B31E8A8DAA7FDEB8FDAF35A7643AEE411A3858C59D8C9C80D1D00871DD130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 e73403f8e016c99f8933cac01ee044307825e8a4e7bb52f0c61c228170c06f4e
MD5 cfb36818d6cff290cc29fd7d57b9b43b
SHA1 7f5f485abeda56fd23f0609fe2d935e9e9ee03a6
SHA512 7d64bf12aa4da1fcc8e17dadff8be396d417c4b2c2a67b4e3904402aa8125d3b2ad190bd28369ba772efbdd4f59bc7525e36374f431aec4187a71b26dbfc54e8
SSDEEP 384:nwiFpCcmyWCJsN38TUNTUlI4WsKT3TPSAe0af3u2Ypz4vrkyRLPPErN1k+5vI+5M:LFwcpJKwgLs2JL2Yp8k2LgPy
TLSH
T1BEE291F198D78976E9AE4B97A33E6D429EFCD153B1884994B7C40D1CCC861BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 74a76d7590f5b4e76503fb34617c4cd34887d1a092c6190bbd871ec75717f527
MD5 1d8dc8948e188b71c079cc8672edb4fc
SHA1 8893d02357fc4e62aa35b3cfcfab5347fb4bea26
SHA512 757e1f029660dfec4450c7562f6ca9b5b601f40ad45ab655cfa87f55d8471a945498502c885d170b28d7d5dee0b8b52b9c9efbf88401697c206b7fc3926c3cb1
SSDEEP 384:nwiFSCcmyWC9sN38TUNTUlI4WsKT3TPcyOOXfeu2Ypz4vJkyRLPPErN1k+5vI+5M:LFJcp9KwgLs2df2Ypmk2LgPy
TLSH
T16AE2A2F198D78976E9AE4B97A33E6D429EFCD153B1884994B7C40D1CCC861BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 5dcf2eea2c1d5e396776e0b2363970cdcc064c2e84a87ca8d92d33006dedb4df
MD5 c176674cc768c35b3e45bac112349294
SHA1 6724385df12336dff6bcc1640f99b154a2701c97
SHA512 5614be9333461ec3ad530500d540750f2741aab316c0f4893d52beed20cb0e299fdbc9e6c595d336ad632d0653376e88164e4b2cf959d840f5eba40290027231
SSDEEP 384:nwiF0CcmyWCTsNq8TUNTUlI4WsKT3TPDMcOOwfjYYpz4vhkyRLPPErN1k+5vI+5M:LF/cpTXwgLs23LCYYpWk2LgPy
TLSH
T15FE2A2F198D78976E9AE4B97A33E6D429EFCD153B1884994B7C40D1CCC861BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 124b0406950ef2c022c4df5f2471f1eeafbb55cac8bb7b4b1d8ebff188ec72e7
MD5 5ae7584ff3c51ed62f7c9d6375c84d7c
SHA1 74b1b811607da920f539b3ce9db05b44a406df27
SHA512 56b2db4b7a69272d3740263f5b3c7c4bc753ec03a13d688748c292c4e0d36f6de3c00b6cee4fdc087b27a4e5d4215d850db57ff863e5609c0ad9f0391fb0280c
SSDEEP 384:nwiFyCcmyWCGsNq8TUNTUlI4WsKT3TPlcOOTfjYYpz4vhkyRLPPErN1k+5vI+5Ry:LFpcpGXwgLs22NYYpWk2LgPy
TLSH
T1F0E2A2F198D78976E9AE4B97A33E6D429EFCD153B1884994B7C40D1CCC861BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 184d609d1ce0101d9bc018c357b37190f225126cebc2b785a984514b395b7788
MD5 e22cc133454b28806cef6b9d692620d1
SHA1 088ad4193e761f4f40d388dfde0a17db0f79f697
SHA512 4159175ae2a6e1288ebd2a1d320deacb80b561918fcca6a175faa7964648e5b8d2b121b804687a95da0d23c827fc791345f62f8ce62e5d5f5b015e6d5dc9029a
SSDEEP 384:nRiFavqMg3sN38TUNTUlIm2ZTPEN36OwfjYYpz4OxQRYV/Vw1mRFdUarN1k+5vIu:4Fayv3qwgH0uYYpxKRYk1mR7L
TLSH
T1B4C23A35E894D9BBEDEB8FC9E7497A03EEE00167D58C49D8DAD81E1E009719E130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c56748759995f6b26ed57911d3fc9994320c22b9cfe9c4bd4cc7a0dca396b47b
MD5 8d6d4ef70d8983fba8aa849a02b5c8a7
SHA1 07849d3a5f5da8a23a6e2069eaf29cd0741b1771
SHA512 dacc54d8acc9d3ac69876fbeddfe4c564132208fc8dea4e52437020b9a87704d595171d761160028a1aac18a88171d414a6f980a863f93fd571b980deb58ac9d
SSDEEP 384:nBiFavqMg3sNe8TUNTUlIm2ZTPPALOwfjYYpz4vikRYV/Vw1mRFdUarN1k+5vI+v:oFayv3nwgHMBYYp1kRYk1mR7L
TLSH
T1CBC24B71D894D9ABFEEB8FD6E7097A03EEE00267C58C49D8DAD81D1E009719D130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 bfe3c934c0fe4be8dbc37ccf4d8ac549bab8da4f43de372f3011e4ae4e00eb3a
MD5 ae02693d9a9363a2e7e025532b089507
SHA1 b6be40ad7c821f1f8827b477861cbbfb7e4dfec8
SHA512 e6de81e0b6e52bc03ac23fa27a1f319b23d673e01671f07877a7d584576ae19bd80d043d70bf24eac0d5673b3f99644f7d5c24dd2df22f31f6e9d2f996813bdc
SSDEEP 384:nyiF9CcmyWC1sNq8TUNTUlI4ysKZTPmbvKOwfjYYpz4vzkyRLPPErN1k+5vI+5Ry:5Fccp1XwgXsem+YYpqk2LgPy
TLSH
T1B0C25B31E8A8DAA7FDEB8FDAF35A7643AEE41263858C59D8C9C80D1D00871DD130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 6e94b30ff1dccff2e982b8a48ae5d6e24045de8fb299784cd97275c805469153
MD5 30260557e3be09fb3abc3c282b4a8015
SHA1 e8d984f86e134e1fa4069302a798fbe453d60001
SHA512 9a7423640fb6c2a342eebfe20d1548adf2555732e8fa69bfcb9dba0935cf00ee1a93052e7d878ce4c7e6c97868841c3cdd0e36ffdd4be1811692843268bd335c
SSDEEP 384:nwiFDCcmyWCasN38TUNTUlI4WsKT3TPsye0qTf3d2Ypz4vbkyRLPPErN1k+5vI+O:LFWcpaKwgLs2buZ2YpMk2LgPy
TLSH
T141E2A1F198D78977E9AE4B97A33E6D429AFCD153B1884994B7C40D1CCC861BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 8d31955c4ec87226df47c9f27ce83c75a18fb1b3ea44e0105bf745d4b094621b
MD5 7b4664ea85b9c820156600c06026eebb
SHA1 0fa871b8a4c6e1471cc9828ab2798b5bff4bb468
SHA512 f4699b81febc09d4869eefb447793bdba3479b3d5eade6dd9cf6fb5f81f84f87495586f89a9e16e1e45ae151f5b1b289384ec4f891c939e562f7083e76a27709
SSDEEP 384:nwiFUCcmyWCasN38TUNTUlI4WsKT3TPpAe0af3u2Ypz4vZkyRLPPErN1k+5vI+5M:LFfcpaKwgLs2iL2Yp+k2LgPy
TLSH
T184E2A1F198D78976E9AE4B97A33E6D429EFCD153B1884994B7C40D1CCC861BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 45ab1840c1b2bbf9f0dd8ff8614e9b3e8d24566224bf8ef9360a9b11e9815844
MD5 dbb6c0293dfbb8745e36c1794b706eef
SHA1 f965d5bb221ad7ffd2f43f7766c04ee219389d9d
SHA512 d8cfa9b7d13e8feb13fa6595309fdfff4037d992d7ba38e897642077a29b1c61fc003c95bf276da0d176e3ea9daf0a924a84caeee12001fc528241ad98585fbb
SSDEEP 384:nwiFoCcmyWCPsN38TUNTUlI4WsKT3TPzye0af3d2Ypz4v+kyRLPPErN1k+5vI+5M:LFLcpPKwgLs2i+2YpFk2LgPy
TLSH
T174E291F198D78977E9AE4B97A33E6D429AFCD153B1884994B7C40D1CCC861BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 f788d1c6b25559b438911fa65fb9e62a7025219e98691c19167c08d3e9eb2b1d
MD5 64c25aba3387d4fa70ec2dfc6384485f
SHA1 a65729e3f2dea49cda936feef2edf53f89c9b100
SHA512 ac20264bdd260bb0f52776cc4fb0490bfa183b7b7fc17c283198f57818a5c079f4ca31e8cbd2cc5cf6fe146f0942a22b02a520d305cb82e73e70186e0e7ad3b9
SSDEEP 384:nwiFpCcmyWCMsN38TUNTUlI4WsKT3TPWye0qTf3h2Ypz4vykyRLPPErN1k+5vI+O:LFwcpMKwgLs29u12YpZk2LgPy
TLSH
T195E2A0F198D78977E9AE4B97A33E6D429AFCD153B1884994B7C40D1CCC860BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crs.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\crs.pb
Size 233KB
SHA256 c132e2ba94619caf6143b3bbdd9c32944e80cbf3bff87364175c42801afe2584
MD5 8bbfaa2cd5cdd9a5019da146cf4deed5
SHA1 17ed2fb07543c5d4bc196a1989dd16a9dbcaacc1
SHA512 cfeee2916f19648ed408b4287e234b4140cf82254cd4b83d918c0a4c3bac2b0467d921915aec290823355be4a0cc82017557be588f65134b466b7192f795f6c2
SSDEEP 6144:KKiD4F7BVps9YpVW+J2i/P66k8GyST+uUP:KB69Vps9C2GAQb
TLSH
T14A34AE9A0F3C3A11BFD2DEA466C8D9377D79B3E06A6928172111C4F169927E07D8C12F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ct_config.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\ct_config.pb
Size 16KB
SHA256 aaeeb46cd91a4a392223cf2885f449bf532f0878c087d50bb0cb3fc7fa873a60
MD5 ca6e253c3fc7718b4455493460053be3
SHA1 4085dcccd29a931b8ea9b74f008e26409edf78ad
SHA512 0004e83a845bdab07f01df32094c202c9f3b8767a6dadd707abc19796f917221f869791673315e9d2c5a6a1fc50b922cceb622db98601055df5949818dd6ea58
SSDEEP 384:7tomWvvtJvzm9myvg+FN2VOhikm5hV5+QiyA94pDmiDyDS1c8CazaUhszz:7l5Zhk5hV5+Qis2DS1cbe7Kzz
TLSH
T13A72C9BFA1169F000383D558D6E157AAA12363DACCF3763DB1E1C005F5423E6B1A567B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kp_pinslist.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\kp_pinslist.pb
Size 10KB
SHA256 b5b2a45a5b25becb901916b13752e3477d4126a42d088f29863bd8672320ecf6
MD5 8061c7027f406f3e20ea5d26969f00bd
SHA1 635d6260e16d1ac595f760df9c5bdda8279629a4
SHA512 7be0be7d59ed46b7ce6adbc1ddc42119426b3223491a03ff068dae66d13a261cc954640916ff4379a6040e021689f070b33dc82b45c010b728ee59abd42f3610
SSDEEP 96:Bxk+yBjecaikDBwrBnnoxGwMAy5z5tBT6c5MacFwn2Xh6g/gw:I1IDCrBnYQ5jlMacFwn2c9w
TLSH
T1362204B37904F99350E7E0BE1041F59AE93343A540ADF98A528C4A7635F1F0719BB4EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8e8d0c279ef0ebf669c8dc54f7035fb25fa8277857c86fb58fbd349d868aa32c
MD5 a4759be7624082a0a9dfb2b68f5e7c92
SHA1 8fb14522d74ae32d50560246a071ac16dc04f07d
SHA512 c779e5efd57cda3aef84574c520994dc95a0c4f2e620a9323ae9ade71e16ac6085e54dfe09ecf2b443aee99939c61534a70b90e68e1cbcbc44d3b56470a6a52d
TLSH
T1E5E00262D31062F3E02C033001C717163B72D06407D343570A2101783C727042D72C80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 aeb8659b827cc459293229a9a58177d016b1ac5ee2f62c7c10baa0a937f82843
MD5 3cb976fc8734156b9aebf7b9b3f07dc2
SHA1 2afd5dbc64c9d16454f75177a8e2442bc5b6a905
SHA512 e7d84a924c2f1d5d3ba537348af96ae8f64bc1ab08a1c75eb0d533d08e5526a38e7060abb44d2627b10987e6607f427e19ad3eab1b6a47ed37f03f060c7239ac
TLSH
T180E00262D31052B7E01C033001C71B163B71C065039343170A2101783C617002C31C40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 3cb58079de501ada7f71de7dd6757aca189b761568f8be5b8d111e117924bd25
MD5 5cecc14117e8579c5203cc5731b157c6
SHA1 0a4ea64a47a8cc9cc3737bbf493ddf5c5ae212dc
SHA512 058bd1a042f38e254e29820aaf01b2157e4ebd219280a062095a3d8985495a24e9a84522f0b4750d9976e1fdbcdaf62768603531ea9d6860121f67557004d2ac
TLSH
T16BE001A2D31062B3E02C033001C71B263BB2E16407E343970A3101783C727042E72E80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 2186d8d408bf57a0e4255360b097262ba2baffc043bb186ce604f249e4e5eb09
MD5 83d02dde9efd7da822f7f433c141ffb2
SHA1 6deffdd5722a6ab56280d929d575a16aea919d7b
SHA512 313c48b62adde607a79dd647a458172f1bd43a188ac8721731361bc646b58f37ed8b6290703cb2353a1b7a2df5627b5388f14b6d474df3e5e8cb2ff70ab17faa
TLSH
T1BAE004A2D210A2BBE16C077002CB1B267EB2A1A40BE742A60731457C3CB27582A72E80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b2e0559ac57b3cefa49ba6710df63095cc117f4fbea8d27768e96394724af7af
MD5 9e7a2b2a8b46043d613bc951ed147b82
SHA1 da1c890621e67f495c1999cc48f6c91cd4453236
SHA512 2a9f969368aa3a52220a7e9e6e860af415d0a787d8ed6e205f9ac9038375568662b93583e93ea99848e8f3bc0a85f817e06ff0e48bc539b08bd9bf7ea51fe017
TLSH
T1EBE009A2D31062B7E06C037002C71F263EB2E1A40BE343960731017C3C727483A72E80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5bedd6b52b65a74571fe695ffc5bcdecb60c24d7ee0645323d5189e7f7c69ab1
MD5 6b1d48f26412221a13cfd39a354c263e
SHA1 29e18f6ffafb31e69e1bf4aaf6a0b144d7c5c46a
SHA512 8cea021fa805d90924b0de744c2a66fa0f0582b35755d24719c81f0b47d8bb9f85fed49377f96c0066bc2717cd6277a210b7f07a3e85561916c6df505d94a548
TLSH
T180E00192D30052B3E02C033001C30F223EB2D4A00BE302520B31443C3CB23543A31E80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c7e729bcd3cd71b4114c54608c6cf0ce9bc480aeff2709647036faba8d973546
MD5 95b020b8f407d06a2a747005903fa7d3
SHA1 b267c362a8155d2feffa4b0c7a9bd501a5073380
SHA512 d6d5d4d3ee69e448c66f51f1a077deb142358d88f0adfc558b1e5acf71a1b28081b0473fd46c0fb7eba8bf41e0a71d3c3c2a0c667f9178cae6a25541c17e9dc3
TLSH
T12FE00213E71112FBE06D033541D30B267AB2D4B417E713575E1655383C527582D72EC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 6e2fdf854428979e52653f91815d0f2a29143a5d03916b807d96da843ae58581
MD5 e611c857f7b7aaa1c03864346fd54bb4
SHA1 562a1b6cad7855fa6db4efdab1226f54e476a52b
SHA512 a7e6dc567b04991a170ceac3e943d150b6109c600566895624b0ca184406360081a177048d702b595c79e8cf418845822ca4be1eae0654b69e8c7a7893839258
TLSH
T14EE0EA13E71156FBE06D033542D70B2676B2D4B423E7175A591655393C567182D72EC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d5ed62877c8b1ebb0be75ed1ec6a5959b8e7f54942fa8fd2dec833a24a16843f
MD5 cee6d7849d24decfd0f98f9d247eff84
SHA1 8dfb55343fc2d48070fb472c048582bfb9ceb9a2
SHA512 509bb0d3932b9dd346261cb058d8809ecea73c1d62c5df9900cc7fa8ffe932f6c1bdd10e0dedbf0b75069ee61f5bd617daf5c3a6ae79c2835d1d6fbac1c3b00e
TLSH
T12EE0CA03D31006FBE06D033002D30A2636B2D4B423F303AB4D1226393C523082E72EC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 196416e8a03e012021509bb81a07582b0b50709d54c42077ec95bf7c86985a2a
MD5 721217b2e0b6df0e8313cbcda8bd4250
SHA1 98d47116a66aff4ac179889126954fb2ee4f5459
SHA512 7e331e6ac902d657efedcbf4e521ff93088ee15fe5b1ad364b5f9cc232ab38bb9b2db62625a1353402d52f42b6d2d448aa2a9f5d317383e892fd6841ae5f4682
TLSH
T1B5E0EC93D72052B3E02D037440D30B267AB2D8A407E302574E2258383CA23582E62E80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9d9206ad1ad78c1c1f95c890703d1c1e0260621d4f42d5d18a72b15886fdf432
MD5 8559d98c8caf53e32636f0fd055ba769
SHA1 21c6a4ed8ecb9890c3349df3fc54b42032f442a2
SHA512 834062b76652309fef974968221f40d39949013b14a226656f88f3329d87e4f3f4433ff2e77377c71e7bbb05826c17422c2cb04429fb1e3a950260ce75f09e6f
TLSH
T125E0EA53D71152F3E02D073440D30B267BB2D87417E312574E2154383CA27582D72E80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 a4d454d1a0efe65422e9133e45d6ed8237a8e8e4ea1dc7e6466e456ee722a523
MD5 314b55de1176a62ae67ded5eb2ef6212
SHA1 ac3fd3ab6be40d87018362e68e2d1e461469ee66
SHA512 2b5b26ae27dcce0925fe66e5536f867750896fed0f8351f93a6812f3f7c8d22baa8ef17c3c80caf3aa3250bd0d2f0cb60d079ed0b24737d9523b26127bd89e2a
TLSH
T1E0E00891D31052B7E56D077001C71B257EB2916407E742561731457C3C767543A71E80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8e79c6a16d539ee05b131f21f8e955101451c2e6b22d85db63c20a0ffff6642b
MD5 bdd6164df55db7a506de80afc1a4f9f3
SHA1 31f367212b40b4288f3c0d4fb381645228559b58
SHA512 caa07910bff6338bcec0715296c518c5fff440fbb6e70afbc26f08b603ad9eddcd4667d61d3bb3f03b39904b7950496a9f43c82ec5a7d4c5fcbcfda08d5ca84f
TLSH
T1F3E04892C30052B7E02C033001C30B213EF290600BE302521B30003C3CB23443A31EC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 61f1ee540b40a08a3e3d27817b20e11807709c6e5c4fa2d5aee1442f33af3cd3
MD5 d81ba890ecb2df65e64f80740cf81b83
SHA1 7aafe2e4df107623ae4732edcd0399397ccb4788
SHA512 22b3a63db674e17f35d7e5f0c520621ffb49deccd25d4b83c1dafdad0d9b7a12e6318c4eab23be6c106d7ab32e36c3d0e94b58fe688fc30b2f2eb58c9d47a629
TLSH
T141E0EC92D31052B3E028033441C31B227BB2D8A00BE302520A2154383CA23582E22E80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5c41151532718c14bbc5319f96b37ab5a73b9c39b4b3c6a4bc6cb0cf36bb7592
MD5 daa6a110defa8e39ae8bc46ef67e2e94
SHA1 7d3c8d437aa7e7da18de93001ea04541e3c8933d
SHA512 97d4d12d7c468bd5d831e3b9935ff961ffb8e4810911fb1dfe5f4bfa4d3ec92e9b5ce8278cf27f3c7bf00595000aa057ee1317df9851acf9abc95adab0df5472
TLSH
T16EE00213D71152FBE02D073440C30B2677B2D4B017E313574E1255383C527582D72DC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59162e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59162e.TMP
Size 392B
SHA256 3ec64cd06fbd7dbee932046630d47e0bd531819b2ef6669fd4e05976ea102eab
MD5 bd0e20503166f52aa0f2ece944c40e16
SHA1 3fe5a625c8ef3ea585d26d7e66cba5a2fde3c002
SHA512 eb374ead30ad240932a4c942c07619ded5914de3fdd2cf88584c7d0b7362fc994f31879a5447985d33df7216f15bc7e5f1ddc2610e1dd2768f86de5a21ad8be9
TLSH
T106E00471D31053F7D01C033000C717143771C05503534317051001743C517001C31C40
MD5 SHA1 SHA512 TLSH

Submit Download

Filtering Rules

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
Size 2.1MB
SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
MD5 43f62d9f35fa6597cec4e2ad5643e282
SHA1 8dba6404724ffd6a2e89901e8dc6e5e55fed3374
SHA512 91891d23464f89e6769d9ec7a28867e28f77925e6e3b3b75fb628d8672157ba239676c07699c931ac307a21ccc4dae95dd707d410f988ff82be4015103d4d6a3
SSDEEP 49152:ua2qP9SKIrivd04TxN/7Uw+zJEhs6dl61n4Kmq9SL6bbBT0HjTsQc8cxjw:u8d
TLSH
T1BAA55D237518BDF45BB31F3EA44B6D48823962A483E3EDC5EA2BD10ED5E014F79601B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\LICENSE
Size 24KB
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
TLSH
T140B2526EB64903731AF30116AA4B64DBF31ED03F362A4564346CC1481FB6E7443FA6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.4.17.1\typosquatting_list.pb
Size 1.6MB
SHA256 805d8d74e6a3b6b2fe689e200868d7fa4781089d5f6fc830487ed1b5a9017049
MD5 acc4a11e2e7ba213daa0f5e73300f694
SHA1 979463888ec0a9931499a9b1bf6cdedd9bee0872
SHA512 cd81ae9130a4df9ff95932ab57a6f8410aaf6fc0df0979f0d54c2d8332f0c15dc860d0e59d3d6b32e2b14c47a89179c79f935f75498634fe7cb904f3374db907
SSDEEP 12288:1Po6kw86Bm53N/m9hb0dleifKXYXHX0Wi5QIQ6E7JOPo1oQSc9paunY:1PZq9+9hbHifKXYXHX0WwQIw7VSj
TLSH
T1C985B5F9DFC00194DAB8112D20BE71D8081412A540E5EFEAFE7C855F2BC6AC977E49E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ranked_dicts

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.2.0.0\ranked_dicts
Size 865KB
SHA256 5820d0bf9cfc363ff929492b1eb6df430039f4ac0e212a5b5411f7c2614f79d0
MD5 959460a18173908111523bbf4c39073e
SHA1 c42a9a7042f6d87a6a9de7f9bf378f1fe9485fcc
SHA512 291decc0f58cf71d7929a52d2c21a07590c02bcd202b73fb20391d6d0c7dcbe3aec24e02606f22dbd589ee2546a0eb8414c232f74ec646a1f26496c280705600
SSDEEP 12288:8WG0mOflZV35OtQm/b1Ed7pJPR3cjqKMjgP/pwH6sKFbEb3d4CPLsVQCcekWpH6m:k0m0lH35mVb1AJPtOl/06s6Wd4iBSsG
TLSH
T1AB15B071E714177E5A9F23AF98856B4546799302982204EAF7A6034D810BDCC63BFB3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 9c5175c07653fd57995ca89e1512539162fab35485b0e10e47ee63d961f77b51
MD5 c578875dca6dd387757cac851f146dd6
SHA1 cfabfd033f2218579dadeb57dcf1af8768177644
SHA512 a4938ec55d2f524ee62f8a0c61664502d571010091d2186eb6b9269005849774a09914405dd994512406d65898947b493d4ac3fff97b58ef8de7137b6d156682
TLSH
T147413FD04C3C2AD1D0BD0E6EB48B34EC85D8D726F1A4747D6C58EA98067D54D248583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 991b9f93117701e57e14915af3d800c21ab5c8b22bca75c0cf6c3657bc746cad
MD5 9f84164a2f788947be2197708128730a
SHA1 b650f3952145efef5b953a44e6b3c7e7f063864a
SHA512 d92709570bec91940d799ebc02c78fc35c206bad0a7f326c2a454134c386b049c0d5b051acfc7b5a415abd4f458b614d260e89aa993b6353e648b3461783c655
TLSH
T19E4162E15C3D1AD1D0BE0A6FA04B38FC84C8D32AF168347D6868EE984B3E94D240143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 222a36b86c694de45354c195d72a05a038472415a0b290371668b4bb31bf06ce
MD5 c9799fd514ca6e5ed19a013f57cade64
SHA1 d02325104df36be79c21e10a46820b5c4867e365
SHA512 3eeefd0f9c3254dd31e05c8ce3c3a2a0f26006e1f6a733cf8994fd26b59ea90dcdaa4132b45c28cd3bb6ef50158ece3c98e5eaed314ab14d03e106802eae9013
TLSH
T18F4142E0883C2AD1D0BD0AAFA44B34FC84D8D326F568743D6C98ED98477A54D254143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 d4d3d367dbed92af02a9e922ff69c96f99ab9e97faf22c0c87626cbed108aa29
MD5 46827a1af8036ffe4592dca134cc6a7c
SHA1 fbbc69c584eedda43d64fb1acb1475265acfc1eb
SHA512 7c55a965e5d045447e40031c86e59d5f28d6eddabab63758427a789caea0398a3ad28171b0718c4481abd574eb37f124010a74a4623cb91c0df1912a57eaad33
TLSH
T173412EE05C3D2AD1E0BE0AAFB04B38FC84D8D726F568747D6858EA98473A54E254143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 a9fe80091a31bea1d5685c9b9f79dd3a452cd09e36e47872155e3f8ebb7e7b6b
MD5 7ac15374f80a0cb754b493a401a27497
SHA1 84ae1436eabff50370719227f0c46119e4bbc304
SHA512 1051c33e5428491d61d522024494e0c8fc0f24ba75dc0e2533efa0066e1a4dfb1da7022ae852e56b2ac4b1cda1cb53af872e30b052ac02493ef7db922a03ccb8
TLSH
T1014160E0583C2AD1D4BE09AFA04B34FC84DCD326F568343D2868E9984A7A54D244143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 10bdc0d1f10d730f19245ff3cfa3ea0369c6ceb49b562347b60e8bfdd3b6db6b
MD5 d88358f9e23fc6cc5427804c4c4d5672
SHA1 14fb4ff3f82123bb910b8d3291a0b59c5ddaf0f2
SHA512 b801c4585e614cb218f65a84cb3370cd3e11d77ab2931e1bf0258e1dfe46c60d13f82c336aaca4cb045ed611bfe6385818a0b4363b3eceb0b299c1c0cab6cb8f
TLSH
T1864142E1483C2AD1D0BD0ABF704B34EC84D8D326F168747D2C98EA98477A64D254183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 bbe2c3b39e49623e5954c8d70cb67f5818c628b28ffd394c779416a6f205b69e
MD5 dfba34356b68c81ff96adf1bc9103627
SHA1 7122bbf6d0a60d76befb5141060eca2737625d5e
SHA512 8b659514e48617bdcf386a956f867e3942b26d48a89a209d1c29e3a7d1811bc7ef4c6e950845a77387edce15d167af202f1d59670a24113ba10d8a09e3956fa6
TLSH
T18C515DE04C782AD1D1BD0A6EB08B34FC81DCC726F1A0347D6C58EA980A7A65D248583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 551b5d45674e685ce42bfad9fff59c2b88013f6b55f022edbc16b0f3c5331515
MD5 dfadd3bbcae128d4205fcb6c178f3aaf
SHA1 005be079c2cf9d7cc57b17192391298786f0cd6e
SHA512 ccca0bb1a5dda3e846892598fcdd5961f95b6b76e8677699fb846d206cef5b8a3a9e3dad59b6d18bcf83adc115474e843a457865545a24a5e42003b77e227ce1
TLSH
T15F4120E1983D2AE1D4BD0E6EA04B78FC84D8D326F178747D6868EE98463A95E640143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 3ef0851bfe1f143c2770c70ee4991bef4ceb4761d3f8677a826d5b282d56e764
MD5 9860db5d6dd039ac6fa427c74238d2f6
SHA1 1baa61c60c39ef590528f8c8ffbbab6e26895ebc
SHA512 10f859e1b888eb21b136063db04dc9436db17cd319677d043d6d38ce16c418c37b42b6b95c1748f654c3332d8489dd07162c85402d175a735b74a93ca2eb3666
TLSH
T1EF415DD09C3C2AD1D0BD0A6FB48B34FC85D8D326F1A4743D2898E998067960D248583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 49b95826413c0e44707a4062e088d80e273c8ade3f85567999a09dca36764b06
MD5 76ee6ba6af33048301d4ca74d37e167b
SHA1 be3d63b580b276da34047a081be0e7a3953982f8
SHA512 0ea60c11307500d3c6e9e4a5488d23f280ae5a23c8f91c66e8f00e9690df034ffd985ee4b9a1aa6240376560062bb1336e4e0165282bb5f89a44a9f9dcc07db9
TLSH
T186413EE05C3C6AD1D0BD0A7FB08B34EC86D8D726F5A4347D6C58EA984A7E64D248583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 307c41b0c992ff00762e9b20d29c85b89b692eff0c35492747c3385a3b8c2e15
MD5 f5c04770c66e3ecc20251c6a2f6a8762
SHA1 89e5a500b1720ce61b554a3d10189251cdcfba44
SHA512 b8e00f4141cd349061eabe96a425ce632c6b2ec8f8d7af2c26e98456bd35ed796aca0240c05d2c477e1d9c58543e09bbee7abe9720bfcd1d4e98267e69db875b
TLSH
T14B415EE0983C2AD1D0BD0EAF748B34EC85D8D726F1A8707D6898E9A8067950D648183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 80292d168978f8e9411ac6b35d45ee1762df471ab651f7b4f02f1d20180cccf3
MD5 54a7edade761ef69b077b067c0729e1f
SHA1 a8b09baad3cf34e499881bcff110d8cdad72762f
SHA512 f3854b73869be6f1f87f0de6b85e351c8541bcda1ad2a42d0cdbf55c383bbfb5efce9981c7dc1dc6b193f7010292e10b5ad6628deb5fe9e4f76c2f97287be441
TLSH
T1B6516FD08C7C1AD1D0BD0A7EB08B34FC81E8C725F0A0747D6858EA990A7961D348583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 7f61da6229c57f2b460c55f219e2c89fffb6b0d1b3a6af87c802afb984e9bf59
MD5 fb4447213d61900108d523977e0497fd
SHA1 8f2bcfafee56e77b0052c130bb87e0d6eb6a189b
SHA512 f382bfc13704891743f85f3e6d0efc74c579087d94fdf79546b80eb88e971899c64ae3cc920414fd1252b314575e2b25b9249a52ec092064f1ffd22d580e2ed3
TLSH
T195515ED04C7C1AD1D4BD0A7EB08B38FC82D8C726F5A0357D6C58EA980A7961D348583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 787a6770f441e5134ef18a274fddb239716e46956cba2d38cb0508fb2370e2c6
MD5 228ec0c3e15390096f1d7118bcd04910
SHA1 7ac980b75824076521c2bdfab60d9839ce0a2a52
SHA512 45ac9704b1ef1abb9f5ceab8e37bfcc3c640140874c6bbf919b746c98a936e921309347aa76a5b91429b1bf7b770163b3e4bbf372aba0cbc45139c8766742963
TLSH
T1535150D08C7C1AD0D0BD0A7FB08B38FC85E8D725F5A4747D6898EA890AB965D748583F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8d72580df42b5efab1beb891481de425482d13712a8506492a1810c7605732fd
MD5 a28ab01ded62fbe31b9811bef3471f42
SHA1 3f9ad017be07b3a949f3638893cbfcdffc4d8533
SHA512 52315c6d36a317a8399b2d93ee0ad563a663076a38f494b65c54e3368e011f8369c3d3d6f4490bcb48ec338ac1d96b2073acacf470664d5807f7e63686bc9077
TLSH
T14E41176CA6F91148B3777E169BF6A97E847B7D731E06D46E00010E4F0A62B41C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

COMDLG32.OCX

Path C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\COMDLG32.OCX
Size 137KB
SHA256 64c6ee999562961d11af130254ad3ffd24bb725d3c18e7877f9fd362f4936195
MD5 b73809a916e6d7c1ae56f182a2e8f7e2
SHA1 34e4213d8bf0e150d3f50ae0bd3f5b328e1105f5
SHA512 26c28cb6c7e1b47425403ab8850a765ac420dd6474327ce8469376219c830ab46218383d15a73c9ea3a23fc6b5f392ee6e2a1632a1bf644b1bd1a05a4729e333
SSDEEP 3072:3ESIiWD8uq4hCqUt6mqD1gRshBgH/voqJrwo2CocrJbQN6N2TRqEydzdHv2:3ETz566VgRyOJ0oDxQRHH
TLSH
T1DBD31A9273F66222E4B73B31297A27A06EBABC115D39D54F6710724D0832AD0DE74F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSCOMCTL.OCX

Path C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\MSCOMCTL.OCX
Size 1.0MB
SHA256 09f126e65d90026c3f659ff41b1287671b8cc1aa16240fc75dae91079a6b9712
MD5 714cf24fc19a20ae0dc701b48ded2cf6
SHA1 d904d2fa7639c38ffb6e69f1ef779ca1001b8c18
SHA512 d375fd9b509e58c43355263753634368fa711f02a2235f31f7fa420d1ff77504d9a29bb70ae31c87671d50bd75d6b459379a1550907fbe5c37c60da835c60bc1
SSDEEP 24576:K2woQX9+gWX6b+SHQjxnRC33Oej3zR/QhF7OnVz3S7HM7BHg:5kX9+V6KTpcPhkgVSglg
TLSH
T1F0354B0277E58122D0F726721A7B27A6ABB67FA56C35E50F17043A0E2931F81DE35327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSFLXGRD.OCX

Path C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\MSFLXGRD.OCX
Size 238KB
SHA256 f2a67eb2888d8889c45576c037197c310fbbb00bb79089760508fdb132c690d2
MD5 06ee7bb3c681b9fa8af4280a154ee133
SHA1 479eda4aaa877cdb0e27583c43209eda9a474acb
SHA512 c3909b35ca4cdae2e1f947a30874109d44c8b3493ada46a2f05a4d7c3bb420c74e70bfb0ee42a0bbc000f674f94f7efedf20f5c80aec9311210d7b64c7499940
SSDEEP 6144:JMV3LOqB4GvoBOCzYRpHGbBFYe0SwX6ktCfh13cBO:JMzaGKOCzYRANKX6kQB6O
TLSH
T191343A42F3D59162E1B7B730AE7613A16AB6BC5A1D39D58F5304328C2E72E64CE35323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PedStat.cnt

Path C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\PedStat.cnt
Size 1KB
SHA256 947508f2a145fa68ec8456502fb4c619935d328f0c2efaa9c607069e9c7074d5
MD5 d5f60c5cdc539a40b6d8d675c78b7d03
SHA1 93b75776cee81fc243d46653f0de2114c50ce450
SHA512 9185ca86d50f8b21e7b7a59879cd1594d9a5d47c2f374763cbd6ee23d2596f6301ca9c26cfc02f0446f86a27017a40bc7beae3d0961398518f47f0216c16400a
TLSH
T18931AC9691158682FF292EA85AC6D9101C9938D3BECCC2E13C77E43112523CCA77BF5D
MD5 SHA1 SHA512 TLSH

Submit Download

PedStat.exe

Path C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\PedStat.exe
Size 272KB
SHA256 dad20400f032c32ea4f0e87fecdb58c69c44fa69867b968ff607776e5c4d2b5f
MD5 2b9e3b202eb4f2c3900056b8f9d35cf4
SHA1 c20e0d8c71ec83108edd843a7162188c2810e70e
SHA512 148555816666878f4a7c912fe3a604d503499e6fceebe4941437a06ba190310e9eae4b0fa1e92c22c692fa2578a5afa5011759eb9f0d02941d6985cb40ef2957
SSDEEP 6144:Z7ppZJ61A6LIXxd/8xpJeI9WbFgH2qq1dxEWXqN:/pZ8cXxd0xpJeI9WbFE4He
TLSH
T1FC440827EB107105F51340701A699AFB282AAC3625429C07F786AF9D7834AD3F9F671F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PedStat.hlp

Path C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\PedStat.hlp
Size 5.5MB
SHA256 3dd98ce8a856a2df519ced527e9d4572d9f94183b736935e0dab051e7fc5c7de
MD5 cbd4eae8611a4824279b3e09c47e1596
SHA1 6bde99f4746fbd733c9c2a16ca9412078001d011
SHA512 f3aa0189de95e7aa31742fac80bf9dec491e6340bb8d57e1d15441aa7130d23a2823e2fda41164ea7a1421e5b781b724ce96e22af2571ade200846e8cb0c29e1
SSDEEP 1536:7JcN2t23scqBfmqiT1v1ybizyZVT/YCS22+yZVT/Yjj+0mmUgoy18MoFLq6ApwJp:7GNG79fhiZ1ybefKENgz0Lq6Opk
TLSH
T15D46E7607E0BD9D8F0E6A535AB7C84DC3D613F12AF029E13A4C97E4EA933045D365A6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PedStat.pdf

Path C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\PedStat.pdf
Size 270KB
SHA256 8aec8289e16c8544bf261183250bf2064586b1619c7c3c4915ba4a0edb459b82
MD5 98360fb7353683ad2493a49d1cc6b01f
SHA1 9a55aafa94bed9a29a9e45fc8d96bb0700e9f6b9
SHA512 d46b8be2a89e2a84030ec7274b3fb2ddf9e46a40de624720f1ba2ad5db0b381dbabe8feac52b7997b8a59130c906e056773a8853ddb28e82038213dbbcc1aa2a
SSDEEP 6144:ypThUxHXQktNmG//32EYx4ZyIHpQPPdhas14Nr4nD1vXU9oxDEHFaN0eNo6Gh:y1hkgkyvhJ1n149+v9yaygo6A
TLSH
T17044E136D88AE4ECD8C78BC6A75D79EA458DF30387C818F2207C0B85449AEEDFD16591
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ROBOEX32.DLL

Path C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\ROBOEX32.DLL
Size 1.0MB
SHA256 3785cf518318789ac99daf9b30fe3e8aa02214b83d0e0653f4add2e5ae0194fd
MD5 bc015ff7c2a900c1a3cd8dfd9fe968e6
SHA1 e3f34e576d42df687831ca6a2b13a7f6a9faf721
SHA512 220183e313f34eb27a4702e1f15b2c386329db52aa16be3b363fe07412562127cdb82b29e15f2b2978d8deb20670602ce0efb09d104f80054627d0d8108fcea9
SSDEEP 24576:+xx7gZIj7NSMlRJKsWAoqDdrieNLbOT7ULPfkIUvW6:UZgij7l/thiep4kRUv
TLSH
T1FA358D027AE280B3D66622300DF9BB7AA379E9D94F318F97139CCF1D5D369C14536226
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TABCTL32.OCX

Path C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\TABCTL32.OCX
Size 204KB
SHA256 40cadbfb2eb5732f025d687664f34239db7153a192bca0287f9208852b201fb6
MD5 908938d3ba2d870ee9fc6238a4c6af95
SHA1 e8648d6d69fd5cf900c4bf98b210f6921bed3ef5
SHA512 f9433f48330f7ddc64edb8a64229c1490fa31978e9f4ffdc5fa5ff8b18430317a39a07a559d560051ba195b730429acfb18edb38bf712507b00ac788ffca0b74
SSDEEP 3072:kBOrV7gwFcKneF9s2x+eDYIRXDc6VNeFjzBB9g3A/Vt8DbtUfREm/UmL/8zc8N9R:k0rVdCVrsEncIRXDdVNeFBIk2DgR4d
TLSH
T12D247D0273E19132F0B327701ABA7BA1EAB97D215E36D64F67402A4D1D31EA5DE34327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VB6STKIT.DLL

Path C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\VB6STKIT.DLL
Size 99KB
SHA256 df6e2f111773adec3b33dcb0b31e2a4d21ef7d51740706335f411e2c999c0e6b
MD5 cff867572b44212b01b711c1fa009537
SHA1 3978c9f7a3d77c0bdff4353949e2143757eebc79
SHA512 1b77ef24b1efb4939e4625deb1f8ebccc3c2edbb49b412dadb8a3c293a265c77ea84d8eb725d3af5bb84d9c040a91debe5890f57ed8750147e91f30c1a0630c4
SSDEEP 3072:c6v5KkE3OEc4dUN5KgzIED1LAOWOa+dSogCh:csKkE+Ec4dU/KXEDunOaC
TLSH
T1C1A36C40BAD1C0F5F0D106BC01E66B7AAF3B69754B9295C3C710EE776C722F1A53A24A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Пример дихотомической шкалы.psf

Path C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\Пример дихотомической шкалы.psf
Size 920B
SHA256 cf1dbac9974832fe7587ab615bf60e4dc0298d3ed59a1e7d6117a082bc4c2c45
MD5 982b0e012afb8b0077fd6cfd75f3f75e
SHA1 03fc6abe8ac9b89cedbcb6ad0bef69547670a506
SHA512 f5872083b028bf7769d28f4da89d00c85d359e758c68692ae7c8eefa43657269e5884a987ea985345a791dea5edd97c8d96b9f0a719cd27eb7625da734888bc2
MD5 SHA1 SHA512

Submit Download

Пример порядковой шкалы.psf

Path C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\Пример порядковой шкалы.psf
Size 920B
SHA256 23eae827b87c429e97deab4a32426bcd30a6f839b57b8e1cf06dcab65077aed4
MD5 e4df179bd33cc568acb4681dab5c0062
SHA1 2b1b354ed003e4b9207cebb10a6245aefefee280
SHA512 9b761722efd57ecfefcc590603ea54754a0269b88ed99236a5310099218e63db0019ab5e4de118fbb726530190521a0d65c2dd0974508d284ffc65dcddce2647
TLSH
T1F8110213DF0480DFC07404F003140C3E35030037467409374C640B1387EE0010ED10F1
MD5 SHA1 SHA512 TLSH

Submit Download

Пример шкалы отношений.psf

Path C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\Пример шкалы отношений.psf
Size 920B
SHA256 206fd418ebad45b8ee0fab647834c73cac057877836b2ddf180cbf58362d7e0f
MD5 a5b205b699e90e756c3fdfbd1db7a7c8
SHA1 df8950b59c49c0c4f2d58f35fd13c33d824d7d0f
SHA512 7f3b61eae76f7fd88119627ec3c970db4422f9f772b4a2d500e8dfa3f0acf02166465926f853250ebf725002dd1fc209e5a69d86a6ceeb4a31b695a714a76214
TLSH
T1BA11E297EB021FB6E3C042B4912FD724D68711B6D1EA6705CEB9C924164326CDECF986
MD5 SHA1 SHA512 TLSH

Submit Download

Ручной расчет критериев.xls

Path C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\Ручной расчет критериев.xls
Size 44KB
SHA256 8dfe005406fca13ea086e69f8a29f4644e249e4e3970a870704443e1127d4de3
MD5 02a2e12e4769341915961d213b7133c5
SHA1 4ad7d41e0a1b761918e21ac1ebc16aac50d9a777
SHA512 3a02772b999030d49c4d276c9398627a8f656513cc8c1885b786fa758cc519f5638a53f6c0cf2bb79cc38fbc9e993ab494f522b134b53e13ef0aed6a8c56cb3c
SSDEEP 384:0H1VSB/5f7J+sciX8e/KBmrpFRlXwhB6YYz/QN17:0WB/5ftrc88kKBmrpLlXdYg/QNV
TLSH
T14A23AAC2E104AC68C185DBBDB8A2DDF55920AC7DAAE3FE09214CB52FEDFD4A147016C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PedStat.CAB

Path C:\Users\Admin\Desktop\stat\PedStat.CAB
Size 3.0MB
SHA256 99841695d5f67be6b7d8f40324d5f0770f4a266d25775b65faa1f1c4617dcd51
MD5 8c332ba869c137c32d3aba543259ad61
SHA1 50d00fb32fc962311bad8ceba25b4396871f5e9c
SHA512 58c64a8f5b7363786af8ddcff10eb9fa63974c93cd8e8c6dfe176b1e2390d13454d770401db22fbc6e4e1628dbda03e705a8ce83d738acf70fdca3fa249c1789
SSDEEP 49152:5fT+OliQKeCkMEZhnbxQRTgrFk5r9odvmSoPNGQ0QzF3wLVEekSNJ8vXS0jcVo:hT+UL/ZlxcgrF2oZk1GQ1zNwpppgSEV
TLSH
T16BE533A8793A7B82CCBE8EFF90F1DC20C21B72E5483E85A5A2D5474D21C31C7D57A15A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\Admin\Desktop\stat\setup.exe
Size 136KB
SHA256 7052d75548d0f34e290baf29aa7281b44b4eb38327a9078354e15a3dc8749da4
MD5 ca4d56abba85c97023f2e236dc82c4aa
SHA1 5c4be7cef4082adae0e187ec140c0f10dd113260
SHA512 42b895b8ca244d4a5dc3b662f6379073c8ee893a3a56b0e77b9eca3be4c3242bcbc9f97a2cf2432109c13fdfa842e2d73f14c7d1b328b4f6a000202af8215562
SSDEEP 3072:WARAEzUI3AOGfte0D9P9HjT0rIm7f1dZJZgJIK/J:WARdb3NGfYm9VTwImJdEX/
TLSH
T1D1D3285672E5C071F5F2277116F16A31AA3A7C356B36C2CBC700DD6A5C306A4A8393AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.lst

Path C:\Users\Admin\Desktop\stat\setup.lst
Size 4KB
SHA256 96efa18adaaf03258f1a55e923ef389b54d3a5f6f256090a3720606aa7171d68
MD5 7d6c7dbab697cf19b2c269a179257392
SHA1 c4d260c00e569c453a81fa5214b2afed2185f98c
SHA512 3652e3317c6566ebf2fdb25bc80f9f3be521fd7d628bfd3a2d1cb6ab6cb3cf9587364088991d84e5e01bf3e4862c2c100cd4a17347652bf774cd56e7cc156972
SSDEEP 96:iZTSrEZpM2cyqiOG5e42IjOpD9qQVO4SBB:WS4ZpM2cyqiOG5CIjwY40v
TLSH
T14DA1CE9AE8CEC9E6FAF4BF4E96CC64135A1F245550413C9CF5AC6C3C15A84335628AF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stat.zip.crdownload

Path C:\Users\Admin\Downloads\stat.zip.crdownload
Size 3.0MB
SHA256 cf97efe44799b0deb03fc318cf63eac149fb668a6c17c5b83a0a099f32e367af
MD5 8e89fadb96d599ebc524aa3aaca766f3
SHA1 9d664b25b4d5dcf933556dbe49baf8effdae2a0e
SHA512 52b06409248c886d03f4cf6c0ececccd2e2ee12741bc45c1e0faf8697f72becd5aeda59d42554471e12254b4e2cc0fdc84e5c6c87c33006f828d037014ec674d
SSDEEP 49152:0yT+c9QmK2SOAZQTbhrUZssVeL34HmNP+voPzS0QEae47LVKhpNeeKS0duVGq:zT+UZ++hrUqsV5Hi+QrS1EaeEpMaS4G
TLSH
T152E533BD4D3D38458038968BB4FC6E85C22B65D9493B86F6A3D58D8E6013542E83F3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ST6UNST.000

Path C:\WINDOWS\ST6UNST.000
Size 1KB
SHA256 2596a0cca5fc01977757539c7ac28a8094467464b2aab2eee4bd1132a986aae1
MD5 4f91d1ab3735ad58bbf179a43b0951ce
SHA1 5f040f7907077c08485be6c91ad97d9b52d8fb24
SHA512 c48fa8f3b460202451570e6869248ba35be07c15558a31e9ffb50856ea4c14290b2e1bf9206464d80a5fa124f5947b41ad77cbb4beb28eed4ba150cc5e11e9f5
TLSH
T1A031BCAE1FFA91D1DCC10E2C1F7993081274E058F55E871B50F8AC44518AA68EB6F6D9
MD5 SHA1 SHA512 TLSH

Submit Download

ST6UNST.000

Path C:\Windows\ST6UNST.000
Size 1KB
SHA256 227f4ad67bed9db6e0a0a30c7dda624a443773484f599c6967392ecc16c40131
MD5 45dfd1758e22e4635ad12f9ea4d89309
SHA1 d3b7b238fbfd1814aedf4a33138a6f832a46c9d2
SHA512 09af62d0c585499e6257549f4dbbad984d72b3214d11d352ce7369b55dbe8e18d801e37dcccc9a3fbcc3510be06a8287850e2a3006f3430012ec76d751fff9f1
TLSH
T1E621A0FD0BB79190ECC10F252F79930C53749058B55A875A20FCAD44058AAA8A3AF6E9
MD5 SHA1 SHA512 TLSH

Submit Download

ST6UNST.000

Path C:\Windows\ST6UNST.000
Size 1KB
SHA256 2eb604dc60bf1f3737c4ad570ca48763bc2aa8123f05fb6c6e51219b1a56ad11
MD5 89cbcf5fb3f90f88392aec61b6677ac9
SHA1 22b9e782dc2614dd7fc7a56b4871b7eed5ef6b06
SHA512 c7f667567355bccefbcffa244d2315942b055c7cddc8ac9ea20d4481f5fb6ab42e90b9283c4606ca774e1e7a58b63ea72e1ca8db69b1455a846ec9f1ef988bc0
TLSH
T1A931BEEE1FF65191DCC10E281F79930C1374D058F15A871F50F8AC4451CAA68DBAFAE9
MD5 SHA1 SHA512 TLSH

Submit Download

ST6UNST.000

Path C:\Windows\ST6UNST.000
Size 4KB
SHA256 3c3b7d228603217425707272b4111ed70e700301814539551867a0de63043b3a
MD5 a66227bdc06d9caa0f948bf1a13bc142
SHA1 98a06169f5ffb19f507190bb656eaf7041bdc5c2
SHA512 d2c19a46f9e672921692d965769a73fd25a9c45fbd44c7e25803d5c31921ad72ee1df4e55bf685f07e508f7dc137c496f39045606eb55c9d4f5c469f816dae8b
SSDEEP 96:sidNTb2wTQq0fvrf7f2pfffA5WhfWNhBNpFSfHf1f5f8kM:sifb2wTQq03rTOpX4WhfWPBNpFSPdBC
TLSH
T19D9115AF5AE7A2D1A8819E253FA9820C571C7458B018077671A4FA446440A5CFFBF5FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ST6UNST.EXE

Path C:\Windows\ST6UNST.EXE
Size 71KB
SHA256 b7f9ba5ae3a6590a0e08117f90825e4076e295ab407b85c2ed42a20df478df83
MD5 d422839c99927db561f5c019643eacec
SHA1 e6c1322baebf818092af991de744ea1081cfd062
SHA512 1025b96bfb2d21da0289524e45b88a46e944f38cf7fec0abfa58e57d39515b8e399d8311a94c0566ba0774b0c2fe0bb6a478a8544469a0696c1b618bb9c66e7e
SSDEEP 1536:EGTJG3gY1xqNUi8tUUoC2RjJ/j8a6tgyQHG:39Sx8UHUUoCcj5ktg5HG
TLSH
T173632C42A6E848B3F6F1373124F667759A36FC1B1B34C6AB9350D9BB1C32640D92531B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup1.exe

Path C:\Windows\Setup1.exe
Size 244KB
SHA256 4c7ea1f0b856125a1316e7dd19a2702de959a048fc9f2556ec3de351067422b7
MD5 b9917fc4c836776765e311fff84dd534
SHA1 63cf6b3992f2058f6a5995293e1017627569f8b5
SHA512 f092cdbb595814f58240451017f1f392ad18b4dad931694937f46936062579edb01bbd3f0b515c2e3dd1c31afae78af5090433c1a72e07e16b5970a76c647b0f
SSDEEP 6144:AnIKlBmT0LNn3moSAj0UTp1bDQwZefWnwJsY:Anrdj0UTp1Xth
TLSH
T16134E92263E47B16F2668BF05D760690843ABC314970D94BA6C21F4D7A73E43EB35367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2276-4381-0x000001F59DC40000-0x000001F59DCEC000-memory.dmp

Download

memory/2672-1467-0x00000247F04D0000-0x00000247F057C000-memory.dmp

Download

memory/2996-2186-0x0000000007CC0000-0x0000000007CFB000-memory.dmp

Download

memory/2996-2121-0x0000000007CC0000-0x0000000007CFB000-memory.dmp

Download

memory/3276-206-0x0000019721800000-0x0000019721F3F000-memory.dmp

Download

memory/3844-2024-0x00000000001C0000-0x00000000001FB000-memory.dmp

Download

memory/3844-2022-0x00000000001C0000-0x00000000001FB000-memory.dmp

Download

memory/4288-4517-0x000001C7B9F90000-0x000001C7BA03C000-memory.dmp

Download

memory/4288-4520-0x000001C7B9F90000-0x000001C7BA03C000-memory.dmp

Download

memory/5004-1435-0x0000025DA3ED0000-0x0000025DA460F000-memory.dmp

Download

memory/5380-2023-0x0000000005100000-0x000000000513B000-memory.dmp

Download

memory/5380-1939-0x0000000005100000-0x000000000513B000-memory.dmp

Download

memory/6916-4604-0x0000018027430000-0x0000018027431000-memory.dmp

Download

memory/6916-4605-0x0000018027430000-0x0000018027431000-memory.dmp

Download

memory/6916-4632-0x000001801FB60000-0x000001801FC0C000-memory.dmp

Download

memory/6916-4606-0x0000018027430000-0x0000018027431000-memory.dmp

Download

memory/6916-4594-0x0000018027430000-0x0000018027431000-memory.dmp

Download

memory/6916-4595-0x0000018027430000-0x0000018027431000-memory.dmp

Download

memory/6916-4603-0x0000018027430000-0x0000018027431000-memory.dmp

Download

memory/6916-4596-0x0000018027430000-0x0000018027431000-memory.dmp

Download

memory/6916-4602-0x0000018027430000-0x0000018027431000-memory.dmp

Download

memory/6916-4601-0x0000018027430000-0x0000018027431000-memory.dmp

Download

memory/6916-4600-0x0000018027430000-0x0000018027431000-memory.dmp

Download