Overview

overview

8

Static

static

1

URLScan

urlscan

1

https://1337x.pro/to...

windows11-21h2-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    436s
  • max time network
    435s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    02/07/2026, 03:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://1337x.pro/torrent/12929408/Desktop-Mate-v1-5-2/
  • Sample260702-ebf7fabw41
Score
8/10
adwaredefense_evasiondiscoveryexecutioninstallerpersistenceprivilege_escalationransomwarespywaretrojan

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 3 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 39 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies system executable filetype association 2 TTPs 16 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks for any installed AV software in registry 1 TTPs 9 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    defense_evasiontrojan
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s) 3 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in System32 directory 6 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 4 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 63 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 11 IoCs
  • Modifies Internet Explorer settings 1 TTPs 43 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 9 IoCs
    defense_evasionspywaretrojan
  • NTFS ADS 3 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 60 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookAW 2 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:3164
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://1337x.pro/torrent/12929408/Desktop-Mate-v1-5-2/
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1952
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ff9f4d0c188,0x7ff9f4d0c194,0x7ff9f4d0c1a0
        3⤵
          PID:3824
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,9461067082673105856,5987509983799284654,524288 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:11
          3⤵
          • Downloads MZ/PE file
          • System Time Discovery
          PID:1900
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,15692484073971754839,17248901174396996202,262144 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:2
          3⤵
            PID:3448
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,12063635403982274356,861749456124784521,524288 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:13
            3⤵
              PID:3948
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3312,i,11584182498051396189,3034664861200715183,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:1
              3⤵
                PID:784
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3316,i,3662205031757200585,10544134472706374061,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:1
                3⤵
                  PID:2096
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,2533546255817535602,10542612328744448306,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
                  3⤵
                    PID:4896
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,15932766267287681725,3497618529227542934,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:9
                    3⤵
                      PID:2380
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4236,i,11614739246660233855,15733493401859353561,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
                      3⤵
                        PID:1828
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4216,i,11121801342833835858,14423185466219564120,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:9
                        3⤵
                          PID:800
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,2820607520812489305,16920128774070468818,524288 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
                          3⤵
                            PID:4420
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,15471693768443574147,5653119481036950955,524288 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
                            3⤵
                              PID:5060
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,5724896057874826947,18119780762659475683,524288 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
                              3⤵
                                PID:3704
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,10850386195148230858,4675987374057557116,524288 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
                                3⤵
                                • Suspicious use of WriteProcessMemory
                                PID:732
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                  cookie_exporter.exe --cookie-json=1128
                                  4⤵
                                    PID:1084
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,5724896057874826947,18119780762659475683,524288 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
                                  3⤵
                                    PID:2316
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6784,i,17982632644304339489,2285168207114677963,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:1
                                    3⤵
                                      PID:4608
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,14311695814285730438,1770277522711327921,524288 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:14
                                      3⤵
                                        PID:3232
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6692,i,6231231277024696396,7649537470899293171,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:1
                                        3⤵
                                          PID:1824
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6896,i,17266004767880606112,9919368031595339733,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:1
                                          3⤵
                                            PID:2100
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4744,i,6204304433624995956,4945259171612337906,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:1
                                            3⤵
                                              PID:5152
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4312,i,8670913280125898429,2498811850164248109,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
                                              3⤵
                                                PID:6080
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=4600,i,4948683356669605340,14925400712373509364,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
                                                3⤵
                                                  PID:3248
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4264,i,8694904954575085914,16958626908253904416,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:1
                                                  3⤵
                                                    PID:5180
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7504,i,8880897942019531212,18177280360740027875,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=7536 /prefetch:1
                                                    3⤵
                                                      PID:5624
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7260,i,2334743882731078168,4980099458293178295,524288 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:14
                                                      3⤵
                                                        PID:5356
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7632,i,5253510329529482176,5005892544882677073,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:1
                                                        3⤵
                                                          PID:5360
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7808,i,12172973404458671989,13270599340518314469,524288 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=8088 /prefetch:14
                                                          3⤵
                                                          • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                          • NTFS ADS
                                                          PID:5460
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7572,i,3760280671179446262,15496718231085261464,524288 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=7448 /prefetch:14
                                                          3⤵
                                                            PID:5716
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7540,i,6437055310458788324,10800703637259783001,524288 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:14
                                                            3⤵
                                                              PID:5680
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7528,i,1123370540423440623,2813395745761100323,524288 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=7492 /prefetch:14
                                                              3⤵
                                                                PID:240
                                                              • C:\Users\Admin\Downloads\utweb_installer.exe
                                                                "C:\Users\Admin\Downloads\utweb_installer.exe"
                                                                3⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:220
                                                                • C:\Users\Admin\AppData\Local\Temp\is-5BDPB37K47.tmp\utweb_installer.tmp
                                                                  "C:\Users\Admin\AppData\Local\Temp\is-5BDPB37K47.tmp\utweb_installer.tmp" /SL5="$402E8,928425,882688,C:\Users\Admin\Downloads\utweb_installer.exe"
                                                                  4⤵
                                                                  • Executes dropped EXE
                                                                  • Checks for any installed AV software in registry
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Checks processor information in registry
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of FindShellTrayWindow
                                                                  PID:5916
                                                                  • C:\Users\Admin\AppData\Local\Temp\is-XH3KJGT9NX.tmp\utweb_installer.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\is-XH3KJGT9NX.tmp\utweb_installer.exe" /S
                                                                    5⤵
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:4748
                                                                  • C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe
                                                                    "C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe" /RUNONSTARTUP
                                                                    5⤵
                                                                    • Downloads MZ/PE file
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Adds Run key to start application
                                                                    • Checks whether UAC is enabled
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Modifies system certificate store
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    • Suspicious use of FindShellTrayWindow
                                                                    • Suspicious use of SendNotifyMessage
                                                                    PID:5656
                                                                    • C:\Users\Admin\AppData\Roaming\uTorrent Web\crashpad_handler.exe
                                                                      "C:\Users\Admin\AppData\Roaming\uTorrent Web\crashpad_handler.exe" --no-rate-limit "--database=C:\Users\Admin\AppData\Roaming\uTorrent Web\sentry-db" "--metrics-dir=C:\Users\Admin\AppData\Roaming\uTorrent Web\sentry-db" --url=https://o127107.ingest.us.sentry.io:443/api/4509880677498880/minidump/?sentry_client=sentry.native/0.10.0&sentry_key=02e41a243ade8e1e7c11a44f20b7d63f "--attachment=C:\Users\Admin\AppData\Roaming\uTorrent Web\sentry-db\29ad7d9c-8fa8-46cd-df83-f98b1d72e8f1.run\__sentry-event" "--attachment=C:\Users\Admin\AppData\Roaming\uTorrent Web\sentry-db\29ad7d9c-8fa8-46cd-df83-f98b1d72e8f1.run\__sentry-breadcrumb1" "--attachment=C:\Users\Admin\AppData\Roaming\uTorrent Web\sentry-db\29ad7d9c-8fa8-46cd-df83-f98b1d72e8f1.run\__sentry-breadcrumb2" --initial-client-data=0x538,0x53c,0x540,0x534,0x544,0x11852a8,0x11852bc,0x11852cc
                                                                      6⤵
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:5052
                                                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=utweb.exe --webview-exe-version=1.6.0.6445 --user-data-dir="C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView" --noerrdialogs --mojo-named-platform-channel-pipe=5656.5832.8139618594212907454
                                                                      6⤵
                                                                      • Drops file in Windows directory
                                                                      • Enumerates system info in registry
                                                                      • Modifies data under HKEY_USERS
                                                                      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                      PID:5996
                                                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x198,0x7ff9f12db078,0x7ff9f12db084,0x7ff9f12db090
                                                                        7⤵
                                                                          PID:6012
                                                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView" --webview-exe-name=utweb.exe --webview-exe-version=1.6.0.6445 --embedded-browser-webview=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1820,i,11566939212834914436,3402448944687611489,262144 --variations-seed-version --mojo-platform-channel-handle=1812 /prefetch:2
                                                                          7⤵
                                                                            PID:4608
                                                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView" --webview-exe-name=utweb.exe --webview-exe-version=1.6.0.6445 --embedded-browser-webview=1 --always-read-main-dll --field-trial-handle=2140,i,11566939212834914436,3402448944687611489,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:11
                                                                            7⤵
                                                                              PID:5244
                                                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView" --webview-exe-name=utweb.exe --webview-exe-version=1.6.0.6445 --embedded-browser-webview=1 --always-read-main-dll --field-trial-handle=1352,i,11566939212834914436,3402448944687611489,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:13
                                                                              7⤵
                                                                                PID:5576
                                                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView" --webview-exe-name=utweb.exe --webview-exe-version=1.6.0.6445 --embedded-browser-webview=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3616,i,11566939212834914436,3402448944687611489,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
                                                                                7⤵
                                                                                  PID:860
                                                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView" --webview-exe-name=utweb.exe --webview-exe-version=1.6.0.6445 --embedded-browser-webview=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3844,i,11566939212834914436,3402448944687611489,262144 --variations-seed-version --mojo-platform-channel-handle=4068 /prefetch:1
                                                                                  7⤵
                                                                                    PID:4520
                                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView" --webview-exe-name=utweb.exe --webview-exe-version=1.6.0.6445 --embedded-browser-webview=1 --always-read-main-dll --field-trial-handle=4824,i,11566939212834914436,3402448944687611489,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14
                                                                                    7⤵
                                                                                      PID:2428
                                                                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView" --webview-exe-name=utweb.exe --webview-exe-version=1.6.0.6445 --embedded-browser-webview=1 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4228,i,11566939212834914436,3402448944687611489,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:10
                                                                                      7⤵
                                                                                        PID:8068
                                                                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView" --webview-exe-name=utweb.exe --webview-exe-version=1.6.0.6445 --embedded-browser-webview=1 --always-read-main-dll --field-trial-handle=4904,i,11566939212834914436,3402448944687611489,262144 --variations-seed-version --mojo-platform-channel-handle=316 /prefetch:14
                                                                                        7⤵
                                                                                          PID:7296
                                                                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView" --webview-exe-name=utweb.exe --webview-exe-version=1.6.0.6445 --embedded-browser-webview=1 --always-read-main-dll --field-trial-handle=912,i,11566939212834914436,3402448944687611489,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:14
                                                                                          7⤵
                                                                                            PID:2540
                                                                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView" --webview-exe-name=utweb.exe --webview-exe-version=1.6.0.6445 --embedded-browser-webview=1 --always-read-main-dll --field-trial-handle=3672,i,11566939212834914436,3402448944687611489,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:14
                                                                                            7⤵
                                                                                              PID:7304
                                                                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView" --webview-exe-name=utweb.exe --webview-exe-version=1.6.0.6445 --embedded-browser-webview=1 --always-read-main-dll --field-trial-handle=4472,i,11566939212834914436,3402448944687611489,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:14
                                                                                              7⤵
                                                                                                PID:5196
                                                                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView" --webview-exe-name=utweb.exe --webview-exe-version=1.6.0.6445 --embedded-browser-webview=1 --always-read-main-dll --field-trial-handle=3676,i,11566939212834914436,3402448944687611489,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:14
                                                                                                7⤵
                                                                                                  PID:1240
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5440,i,11438790755668542062,9903703093749417023,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=8124 /prefetch:1
                                                                                          3⤵
                                                                                            PID:5292
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=5480,i,6972073144746593187,17104042189890163597,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
                                                                                            3⤵
                                                                                              PID:5164
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7800,i,2190012084237532924,8114195227554712139,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=7260 /prefetch:1
                                                                                              3⤵
                                                                                                PID:5792
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7328,i,15298515262016239990,13392627908116970286,524288 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=7200 /prefetch:14
                                                                                                3⤵
                                                                                                  PID:5716
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8956,i,13603729095551836457,2712227562506087983,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=7588 /prefetch:1
                                                                                                  3⤵
                                                                                                    PID:5256
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7960,i,2355057093686932751,14940013487079088518,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=1232 /prefetch:1
                                                                                                    3⤵
                                                                                                      PID:3772
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=4532,i,4373509278516545218,7011233646158593985,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=8080 /prefetch:1
                                                                                                      3⤵
                                                                                                        PID:5880
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7540,i,5201814390651087245,9143149453394374401,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=9220 /prefetch:1
                                                                                                        3⤵
                                                                                                          PID:5752
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=9236,i,706771163122551442,4935888127020543097,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=8960 /prefetch:1
                                                                                                          3⤵
                                                                                                            PID:5696
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=9432,i,3170741310661927929,4143017020698829504,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=9448 /prefetch:1
                                                                                                            3⤵
                                                                                                              PID:2092
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=9572,i,15151292228552951552,3907255618728625611,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=9548 /prefetch:1
                                                                                                              3⤵
                                                                                                                PID:5416
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=9724,i,5853916688225594251,10409022748057625372,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=9592 /prefetch:1
                                                                                                                3⤵
                                                                                                                  PID:3772
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=9864,i,8262664964901927553,16266752209901566663,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=9892 /prefetch:1
                                                                                                                  3⤵
                                                                                                                    PID:4728
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=10068,i,12942995819466382964,5520058460699113341,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=10084 /prefetch:1
                                                                                                                    3⤵
                                                                                                                      PID:6280
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=9548,i,6847426357830546720,3537493660652374438,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=9572 /prefetch:1
                                                                                                                      3⤵
                                                                                                                        PID:6440
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=9616,i,7499269653362581855,1792349987999595762,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=9608 /prefetch:1
                                                                                                                        3⤵
                                                                                                                          PID:6508
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2720,i,7029588803929330919,16361265393478831404,524288 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:12
                                                                                                                          3⤵
                                                                                                                            PID:6816
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=9468,i,14998409609465848715,18019426904074558871,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=9776 /prefetch:1
                                                                                                                            3⤵
                                                                                                                              PID:5880
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=9604,i,1235913333461721077,2275900672351452821,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=9608 /prefetch:1
                                                                                                                              3⤵
                                                                                                                                PID:6928
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=9096,i,15484775935053587836,14174598987128739840,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=9136 /prefetch:1
                                                                                                                                3⤵
                                                                                                                                  PID:6156
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=9000,i,14691893121490037994,11728592961551613163,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=8984 /prefetch:1
                                                                                                                                  3⤵
                                                                                                                                    PID:6308
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=9648,i,17150622753157924979,663562052529512068,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=9012 /prefetch:1
                                                                                                                                    3⤵
                                                                                                                                      PID:1328
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=9996,i,7293540131750698268,14061600194432581810,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=9956 /prefetch:1
                                                                                                                                      3⤵
                                                                                                                                        PID:6552
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=9616,i,12340608547396555845,9999831400540663353,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=9492 /prefetch:1
                                                                                                                                        3⤵
                                                                                                                                          PID:6792
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9272,i,3149635392748218650,5456763277840509530,524288 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=8704 /prefetch:14
                                                                                                                                          3⤵
                                                                                                                                          • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                                                                                                          • NTFS ADS
                                                                                                                                          PID:1360
                                                                                                                                        • C:\Users\Admin\Downloads\winzip77-bing.exe
                                                                                                                                          "C:\Users\Admin\Downloads\winzip77-bing.exe"
                                                                                                                                          3⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          • NTFS ADS
                                                                                                                                          PID:6296
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\e5a41ae\winzip77-bing.exe
                                                                                                                                            run=1 shortcut="C:\Users\Admin\Downloads\winzip77-bing.exe"
                                                                                                                                            4⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Enumerates connected drives
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                            • Modifies system certificate store
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                            PID:6360
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=8688,i,13650452793901186119,13390549537973280300,262144 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=9604 /prefetch:10
                                                                                                                                          3⤵
                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                          PID:1052
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=760,i,3431523395749603947,4340157816052466423,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=7272 /prefetch:1
                                                                                                                                          3⤵
                                                                                                                                            PID:7148
                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=5820,i,6038019794543773567,7804130478701093899,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
                                                                                                                                            3⤵
                                                                                                                                              PID:5416
                                                                                                                                            • C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe
                                                                                                                                              "C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe" "magnet:?xt=urn:btih:F339AFD03DF18B91208D484FE5E1DE6D8BF164A5&dn=Desktop+Mate+v1.5.2&tr=udp%3A%2F%2Ftracker.theoks.net%3A6969%2Fannounce&tr=http%3A%2F%2Ftracker.bt4g.com%3A2095%2Fannounce&tr=http%3A%2F%2Ftracker1.itzmx.com%3A8080%2Fannounce&tr=http%3A%2F%2Ftracker.opentrackr.org%3A1337%2Fannounce&tr=udp%3A%2F%2Ftracker.opentrackr.org%3A1337%2Fannounce&tr=udp%3A%2F%2Ftracker.torrent.eu.org%3A451%2Fannounce&tr=udp%3A%2F%2Fopen.stealth.si%3A80%2Fannounce&tr=udp%3A%2F%2Ftracker.filemail.com%3A6969%2Fannounce&tr=http%3A%2F%2Ftracker.renfei.net%3A8080%2Fannounce&tr=udp%3A%2F%2Fbittorrent-tracker.e-n-c-r-y-p-t.net%3A1337%2Fannounce&tr=http%3A%2F%2Fbittorrent-tracker.e-n-c-r-y-p-t.net%3A1337%2Fannounce&tr=udp%3A%2F%2Fopentracker.io%3A6969%2Fannounce&tr=http%3A%2F%2Ftracker.qu.ax%3A6969%2Fannounce&tr=http%3A%2F%2Ftracker.ipv6tracker.org%3A80%2Fannounce&tr=udp%3A%2F%2Ftracker.opentrackr.org%3A1337%2Fannounce&tr=http%3A%2F%2Ftracker.openbittorrent.com%3A80%2Fannounce&tr=udp%3A%2F%2Fopentracker.i2p.rocks%3A6969%2Fannounce&tr=udp%3A%2F%2Ftracker.internetwarriors.net%3A1337%2Fannounce&tr=udp%3A%2F%2Ftracker.leechers-paradise.org%3A6969%2Fannounce&tr=udp%3A%2F%2Fcoppersurfer.tk%3A6969%2Fannounce&tr=udp%3A%2F%2Ftracker.zer0day.to%3A1337%2Fannounce" /SHELLASSOC
                                                                                                                                              3⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:1960
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7800,i,12913127880913690876,10280377900118027718,524288 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=9316 /prefetch:14
                                                                                                                                              3⤵
                                                                                                                                                PID:8136
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9072,i,11075855043889855666,15478709949008916104,524288 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=9148 /prefetch:14
                                                                                                                                                3⤵
                                                                                                                                                  PID:8124
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,16140649461648999652,4496430924517217240,524288 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
                                                                                                                                                  3⤵
                                                                                                                                                    PID:8020
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=10284,i,5493775268415889708,2198638037603017454,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=10292 /prefetch:1
                                                                                                                                                    3⤵
                                                                                                                                                      PID:7628
                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=8704,i,8891844375509565540,10182050605079798898,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=7260 /prefetch:1
                                                                                                                                                      3⤵
                                                                                                                                                        PID:7852
                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe" "magnet:?xt=urn:btih:F339AFD03DF18B91208D484FE5E1DE6D8BF164A5&dn=Desktop+Mate+v1.5.2&tr=udp%3A%2F%2Ftracker.theoks.net%3A6969%2Fannounce&tr=http%3A%2F%2Ftracker.bt4g.com%3A2095%2Fannounce&tr=http%3A%2F%2Ftracker1.itzmx.com%3A8080%2Fannounce&tr=http%3A%2F%2Ftracker.opentrackr.org%3A1337%2Fannounce&tr=udp%3A%2F%2Ftracker.opentrackr.org%3A1337%2Fannounce&tr=udp%3A%2F%2Ftracker.torrent.eu.org%3A451%2Fannounce&tr=udp%3A%2F%2Fopen.stealth.si%3A80%2Fannounce&tr=udp%3A%2F%2Ftracker.filemail.com%3A6969%2Fannounce&tr=http%3A%2F%2Ftracker.renfei.net%3A8080%2Fannounce&tr=udp%3A%2F%2Fbittorrent-tracker.e-n-c-r-y-p-t.net%3A1337%2Fannounce&tr=http%3A%2F%2Fbittorrent-tracker.e-n-c-r-y-p-t.net%3A1337%2Fannounce&tr=udp%3A%2F%2Fopentracker.io%3A6969%2Fannounce&tr=http%3A%2F%2Ftracker.qu.ax%3A6969%2Fannounce&tr=http%3A%2F%2Ftracker.ipv6tracker.org%3A80%2Fannounce&tr=udp%3A%2F%2Ftracker.opentrackr.org%3A1337%2Fannounce&tr=http%3A%2F%2Ftracker.openbittorrent.com%3A80%2Fannounce&tr=udp%3A%2F%2Fopentracker.i2p.rocks%3A6969%2Fannounce&tr=udp%3A%2F%2Ftracker.internetwarriors.net%3A1337%2Fannounce&tr=udp%3A%2F%2Ftracker.leechers-paradise.org%3A6969%2Fannounce&tr=udp%3A%2F%2Fcoppersurfer.tk%3A6969%2Fannounce&tr=udp%3A%2F%2Ftracker.zer0day.to%3A1337%2Fannounce" /SHELLASSOC
                                                                                                                                                        3⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:6712
                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=10420,i,15785881674910243729,5850711530897754540,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=9592 /prefetch:1
                                                                                                                                                        3⤵
                                                                                                                                                          PID:7076
                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=10372,i,18091927533122350143,3655186379053180063,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=9340 /prefetch:1
                                                                                                                                                          3⤵
                                                                                                                                                            PID:2104
                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=10248,i,6933067915672607531,12430891938822344485,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=10520 /prefetch:1
                                                                                                                                                            3⤵
                                                                                                                                                              PID:5060
                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=10644,i,10530943478730033095,14370770560295384920,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
                                                                                                                                                              3⤵
                                                                                                                                                                PID:7756
                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=10772,i,16983589391647145764,6309094323308769003,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=10864 /prefetch:1
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:7824
                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=10924,i,9986392442960855229,9024190169609917965,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=10928 /prefetch:1
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:3480
                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=10276,i,5408002557937443252,8536380695573249642,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=10364 /prefetch:1
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:6136
                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=11212,i,16234986233742122269,12462748173254676994,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=11196 /prefetch:1
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:5356
                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=10980,i,2498235599031871014,5462679007558206278,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=10364 /prefetch:1
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:4528
                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=10884,i,17619777834612533558,8217505569341245555,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=11240 /prefetch:1
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:8016
                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe" "magnet:?xt=urn:btih:9DCFAEBAB69C7A0CB4131FA949670A870D5D10D6&dn=Desktop+Mate+v1.4.2&tr=udp%3A%2F%2Ftracker.theoks.net%3A6969%2Fannounce&tr=http%3A%2F%2Ftracker.bt4g.com%3A2095%2Fannounce&tr=http%3A%2F%2Ftracker1.itzmx.com%3A8080%2Fannounce&tr=http%3A%2F%2Ftracker.opentrackr.org%3A1337%2Fannounce&tr=udp%3A%2F%2Ftracker.opentrackr.org%3A1337%2Fannounce&tr=udp%3A%2F%2Ftracker.torrent.eu.org%3A451%2Fannounce&tr=udp%3A%2F%2Fopen.stealth.si%3A80%2Fannounce&tr=udp%3A%2F%2Ftracker.filemail.com%3A6969%2Fannounce&tr=http%3A%2F%2Ftracker.renfei.net%3A8080%2Fannounce&tr=udp%3A%2F%2Fbittorrent-tracker.e-n-c-r-y-p-t.net%3A1337%2Fannounce&tr=http%3A%2F%2Fbittorrent-tracker.e-n-c-r-y-p-t.net%3A1337%2Fannounce&tr=udp%3A%2F%2Fopentracker.io%3A6969%2Fannounce&tr=http%3A%2F%2Ftracker.qu.ax%3A6969%2Fannounce&tr=http%3A%2F%2Ftracker.ipv6tracker.org%3A80%2Fannounce&tr=udp%3A%2F%2Ftracker.opentrackr.org%3A1337%2Fannounce&tr=http%3A%2F%2Ftracker.openbittorrent.com%3A80%2Fannounce&tr=udp%3A%2F%2Fopentracker.i2p.rocks%3A6969%2Fannounce&tr=udp%3A%2F%2Ftracker.internetwarriors.net%3A1337%2Fannounce&tr=udp%3A%2F%2Ftracker.leechers-paradise.org%3A6969%2Fannounce&tr=udp%3A%2F%2Fcoppersurfer.tk%3A6969%2Fannounce&tr=udp%3A%2F%2Ftracker.zer0day.to%3A1337%2Fannounce" /SHELLASSOC
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:7228
                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=9048,i,7303077479484533062,6379739415333506542,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=8996 /prefetch:1
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:6896
                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9804,i,17634731680646169969,10525765922710912673,524288 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=9372 /prefetch:14
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:3040
                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=8968,i,17047529859315896094,13044486966597118552,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=9588 /prefetch:1
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:1028
                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8964,i,9612509107342027200,5397640393469661419,524288 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=8996 /prefetch:14
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:5308
                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,2102533105454883112,5142220468459978326,524288 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:7296
                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=3516,i,4795962065637026043,3113453164807300440,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:1
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:3284
                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=3448,i,7129927534920625019,3892218658594600179,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:5960
                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=9596,i,12675943885555816739,2454524013189376904,2097152 --field-trial-handle=2116,i,5231481332804905406,3096840649496080302,262144 --variations-seed-version --mojo-platform-channel-handle=9728 /prefetch:1
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:7976
                                                                                                                                                                                        • C:\Program Files\WinZip\winzip64.exe
                                                                                                                                                                                          "C:\Program Files\WinZip\winzip64.exe"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                                                                          • Drops desktop.ini file(s)
                                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                          • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                          • Suspicious use of SetWindowsHookAW
                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                          PID:7312
                                                                                                                                                                                          • C:\Program Files\WinZip\WzCABCacheSyncHelper64.exe
                                                                                                                                                                                            "C:\Program Files\WinZip\WzCABCacheSyncHelper64.exe"
                                                                                                                                                                                            3⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            PID:7260
                                                                                                                                                                                          • C:\Program Files\WinZip\SPkgRegister64.exe
                                                                                                                                                                                            "C:\Program Files\WinZip\SPkgRegister64.exe" /reg /cu
                                                                                                                                                                                            3⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            PID:8128
                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=winzip64.exe --webview-exe-version="77.0 (206)" --user-data-dir="C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=7312.6644.8891042306311413842
                                                                                                                                                                                            3⤵
                                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                                                                            PID:4744
                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x174,0x7ff9f12db078,0x7ff9f12db084,0x7ff9f12db090
                                                                                                                                                                                              4⤵
                                                                                                                                                                                                PID:7844
                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView" --webview-exe-name=winzip64.exe --webview-exe-version="77.0 (206)" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1776,i,6926855257739511462,13402640643864589546,262144 --variations-seed-version --mojo-platform-channel-handle=1772 /prefetch:2
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:2744
                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView" --webview-exe-name=winzip64.exe --webview-exe-version="77.0 (206)" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=1816,i,6926855257739511462,13402640643864589546,262144 --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:11
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:7152
                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView" --webview-exe-name=winzip64.exe --webview-exe-version="77.0 (206)" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=1888,i,6926855257739511462,13402640643864589546,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:13
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                      PID:7252
                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView" --webview-exe-name=winzip64.exe --webview-exe-version="77.0 (206)" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3460,i,6926855257739511462,13402640643864589546,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                        PID:7264
                                                                                                                                                                                                    • C:\Program Files\WinZip\winzip64.exe
                                                                                                                                                                                                      "C:\Program Files\WinZip\winzip64.exe" /admincfg
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Modifies system executable filetype association
                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                      PID:6772
                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.winzip.com/instcmplt.cgi?pid=WNZP&ver=77.0.16478.0&lang=en&osbits=64&vid=oemg&x-at=bing
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:4480
                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:1920
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe" /MINIMIZED
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:2540
                                                                                                                                                                                                    • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                      C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                      • Modifies system executable filetype association
                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                      PID:6576
                                                                                                                                                                                                      • C:\Windows\system32\srtasks.exe
                                                                                                                                                                                                        C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:5752
                                                                                                                                                                                                        • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                          C:\Windows\syswow64\MsiExec.exe -Embedding 165295A09ADBE2D837A8D4B08EA3592A
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:6136
                                                                                                                                                                                                        • C:\Windows\System32\MsiExec.exe
                                                                                                                                                                                                          C:\Windows\System32\MsiExec.exe -Embedding D95B8C598754184F625A2CE59AF6BFA2
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                          PID:6068
                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                            C:\Windows\SysWOW64\schtasks /Create /SC DAILY /TN "WinZip Update Notifier 1" /TR "\"C:\Program Files\WinZip\WZUpdateNotifier.exe\" -checkType=\"scheduled_9AM\" -show" /ST 09:53 /F
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                            PID:7808
                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                            C:\Windows\SysWOW64\schtasks /Create /SC DAILY /TN "WinZip Update Notifier 2" /TR "\"C:\Program Files\WinZip\WZUpdateNotifier.exe\" -checkType=\"scheduled_12PM\" -show" /ST 12:53 /F
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                            PID:7920
                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                            C:\Windows\SysWOW64\schtasks /Create /SC DAILY /TN "WinZip Update Notifier 3" /TR "\"C:\Program Files\WinZip\WZUpdateNotifier.exe\" -checkType=\"scheduled_3PM\" -show" /ST 15:53 /F
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                            PID:7844
                                                                                                                                                                                                        • C:\Windows\System32\MsiExec.exe
                                                                                                                                                                                                          C:\Windows\System32\MsiExec.exe -Embedding 189657B9E0FDC2D210E941E0A54A128C E Global\MSI0000
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                          PID:5216
                                                                                                                                                                                                          • C:\Program Files\WinZip\FAHConsole.exe
                                                                                                                                                                                                            "C:\Program Files\WinZip\FAHConsole.exe"
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:7780
                                                                                                                                                                                                            • C:\Program Files\WinZip\FAHWindow64.exe
                                                                                                                                                                                                              "C:\Program Files\WinZip\FAHWindow64.exe" register
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:7792
                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe
                                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /s "C:\Program Files\WinZip\WXFCMBPDF.dll" /codebase /tlb
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:7340
                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe
                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /s "C:\Program Files\WinZip\WXFRMPD.dll" /codebase /tlb
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                              PID:7420
                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe
                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /s "C:\Program Files\WinZip\WXFSGNPDFWINCERTSTORE.dll" /codebase /tlb
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                              PID:7520
                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe
                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /s "C:\Program Files\WinZip\WXFP2D.dll" /codebase /tlb
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                              PID:7564
                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe
                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /s "C:\Program Files\WinZip\WXFSGNPDF.dll" /codebase /tlb
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                              PID:7648
                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe
                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /s "C:\Program Files\WinZip\WXFD2P.dll" /codebase /tlb
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                              PID:5548
                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe
                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /s "C:\Program Files\WinZip\WXFWMRK.dll" /codebase /tlb
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                              PID:7180
                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe
                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /s "C:\Program Files\WinZip\WXFCNVP.dll" /codebase /tlb
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                              PID:1240
                                                                                                                                                                                                          • C:\Program Files\WinZip\WzPreviewer64.exe
                                                                                                                                                                                                            "C:\Program Files\WinZip\WzPreviewer64.exe" -regserver winzip64
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                            PID:2076
                                                                                                                                                                                                          • C:\Program Files\WinZip\WzPreloader.exe
                                                                                                                                                                                                            "C:\Program Files\WinZip\WzPreloader.exe"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                            PID:6532
                                                                                                                                                                                                          • C:\Program Files\WinZip\winzip64.exe
                                                                                                                                                                                                            "C:\Program Files\WinZip\winzip64.exe" /noqp /nodesktop /nostartmenu /nomenugroup /autoinstall /lang 1033
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Modifies system executable filetype association
                                                                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                            • Suspicious use of SetWindowsHookAW
                                                                                                                                                                                                            PID:6424
                                                                                                                                                                                                            • C:\Program Files\WinZip\WzCABCacheSyncHelper64.exe
                                                                                                                                                                                                              "C:\Program Files\WinZip\WzCABCacheSyncHelper64.exe"
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                                                                              PID:7148
                                                                                                                                                                                                          • C:\Program Files\WinZip\winzip64.exe
                                                                                                                                                                                                            "C:\Program Files\WinZip\winzip64.exe" /precreatehkcu
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:3068
                                                                                                                                                                                                          • C:\Program Files\WinZip\WzUpdater.exe
                                                                                                                                                                                                            "C:\Program Files\WinZip\WzUpdater.exe" /schedule
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:6896
                                                                                                                                                                                                          • C:\Program Files\WinZip\SPkgRegister64.exe
                                                                                                                                                                                                            "C:\Program Files\WinZip\SPkgRegister64.exe" /reg /cu
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:7996
                                                                                                                                                                                                          • C:\Program Files\WinZip\SPkgRegister64.exe
                                                                                                                                                                                                            "C:\Program Files\WinZip\SPkgRegister64.exe" /reg
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:7232
                                                                                                                                                                                                          • C:\Program Files\WinZip\WZUpdateNotifier.exe
                                                                                                                                                                                                            "C:\Program Files\WinZip\WZUpdateNotifier.exe"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:7836
                                                                                                                                                                                                          • C:\Program Files\WinZip\WzBGTComServer64.exe
                                                                                                                                                                                                            "C:\Program Files\WinZip\WzBGTComServer64.exe" /REGSERVER
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                            PID:8012
                                                                                                                                                                                                          • C:\Program Files\WinZip\WzBGTools64.exe
                                                                                                                                                                                                            "C:\Program Files\WinZip\WzBGTools64.exe" /s
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:8008
                                                                                                                                                                                                          • C:\Program Files\WinZip\ZipSendService.exe
                                                                                                                                                                                                            "C:\Program Files\WinZip\ZipSendService.exe" /REGAPP Outlook
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:4544
                                                                                                                                                                                                            • C:\Program Files\WinZip\ZipSendService.exe
                                                                                                                                                                                                              "C:\Program Files\WinZip\ZipSendService.exe" /REGSERVER
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                              PID:7188
                                                                                                                                                                                                          • C:\Program Files\WinZip\adxregistrator.exe
                                                                                                                                                                                                            "C:\Program Files\WinZip\adxregistrator.exe" /install="WZOffice.dll" /privileges=admin /generateLogFile=false /CLRVersion="4.0"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                            PID:7200
                                                                                                                                                                                                          • C:\Program Files\WinZip\adxregistrator.exe
                                                                                                                                                                                                            "C:\Program Files\WinZip\adxregistrator.exe" /install="WZOutlok.dll" /privileges=admin /generateLogFile=false /CLRVersion="4.0"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                            PID:7388
                                                                                                                                                                                                        • C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                          C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                          PID:3184
                                                                                                                                                                                                        • C:\Program Files\WinZip\WZUpdateNotifier.exe
                                                                                                                                                                                                          "C:\Program Files\WinZip\WZUpdateNotifier.exe" -show
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:2204
                                                                                                                                                                                                          • C:\Program Files\WinZip\WZUpdateNotifier.exe
                                                                                                                                                                                                            "C:\Program Files\WinZip\WZUpdateNotifier.exe" -showOnly -allowParallelExecution
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:6660
                                                                                                                                                                                                        • C:\Program Files\WinZip\FAHConsole.exe
                                                                                                                                                                                                          "C:\Program Files\WinZip\FAHConsole.exe"
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:6204
                                                                                                                                                                                                          • C:\Program Files\WinZip\FAHWindow64.exe
                                                                                                                                                                                                            "C:\Program Files\WinZip\FAHWindow64.exe" register
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                            PID:7060
                                                                                                                                                                                                        • C:\PROGRA~1\WinZip\WzPreloader.exe
                                                                                                                                                                                                          C:\PROGRA~1\WinZip\WZPREL~1.EXE
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                          PID:8036
                                                                                                                                                                                                        • C:\Program Files\WinZip\WzUpdater.exe
                                                                                                                                                                                                          "C:\Program Files\WinZip\WzUpdater.exe"
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:8120
                                                                                                                                                                                                        • C:\Program Files\WinZip\WzBGTToolsManager64.exe
                                                                                                                                                                                                          "C:\Program Files\WinZip\WzBGTToolsManager64.exe"
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:5652
                                                                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                          C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:6800
                                                                                                                                                                                                          • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                            "C:\Windows\system32\DllHost.exe" /Processid:{E0D79309-84BE-11CE-9641-444553540000}
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:8128
                                                                                                                                                                                                            • C:\Windows\System32\rundll32.exe
                                                                                                                                                                                                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:5196
                                                                                                                                                                                                              • C:\Windows\system32\sihost.exe
                                                                                                                                                                                                                sihost.exe
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:7716
                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                    explorer.exe /LOADSAVEDWINDOWS
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                    • Checks SCSI registry key(s)
                                                                                                                                                                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                    PID:6500
                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                  PID:7612
                                                                                                                                                                                                                • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                                                                                                                  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                  PID:6752

                                                                                                                                                                                                                Network

                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                      Reconnaissance

                                                                                                                                                                                                                      Resource Development

                                                                                                                                                                                                                      Initial Access

                                                                                                                                                                                                                      Execution

                                                                                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1053

                                                                                                                                                                                                                      Scheduled Task

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1053.005

                                                                                                                                                                                                                      Persistence

                                                                                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                                                                                      2
                                                                                                                                                                                                                      T1547

                                                                                                                                                                                                                      Active Setup

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1547.014

                                                                                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1547.001

                                                                                                                                                                                                                      Event Triggered Execution

                                                                                                                                                                                                                      2
                                                                                                                                                                                                                      T1546

                                                                                                                                                                                                                      Change Default File Association

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1546.001

                                                                                                                                                                                                                      Component Object Model Hijacking

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1546.015

                                                                                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1053

                                                                                                                                                                                                                      Scheduled Task

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1053.005

                                                                                                                                                                                                                      Privilege Escalation

                                                                                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                                                                                      2
                                                                                                                                                                                                                      T1547

                                                                                                                                                                                                                      Active Setup

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1547.014

                                                                                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1547.001

                                                                                                                                                                                                                      Event Triggered Execution

                                                                                                                                                                                                                      2
                                                                                                                                                                                                                      T1546

                                                                                                                                                                                                                      Change Default File Association

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1546.001

                                                                                                                                                                                                                      Component Object Model Hijacking

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1546.015

                                                                                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1053

                                                                                                                                                                                                                      Scheduled Task

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1053.005

                                                                                                                                                                                                                      Defense Evasion

                                                                                                                                                                                                                      Modify Registry

                                                                                                                                                                                                                      5
                                                                                                                                                                                                                      T1112

                                                                                                                                                                                                                      Subvert Trust Controls

                                                                                                                                                                                                                      2
                                                                                                                                                                                                                      T1553

                                                                                                                                                                                                                      Install Root Certificate

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1553.004

                                                                                                                                                                                                                      SIP and Trust Provider Hijacking

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1553.003

                                                                                                                                                                                                                      Credential Access

                                                                                                                                                                                                                      Discovery

                                                                                                                                                                                                                      Browser Information Discovery

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1217

                                                                                                                                                                                                                      Network Share Discovery

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1135

                                                                                                                                                                                                                      Peripheral Device Discovery

                                                                                                                                                                                                                      2
                                                                                                                                                                                                                      T1120

                                                                                                                                                                                                                      Query Registry

                                                                                                                                                                                                                      6
                                                                                                                                                                                                                      T1012

                                                                                                                                                                                                                      Software Discovery

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1518

                                                                                                                                                                                                                      Security Software Discovery

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1518.001

                                                                                                                                                                                                                      System Information Discovery

                                                                                                                                                                                                                      6
                                                                                                                                                                                                                      T1082

                                                                                                                                                                                                                      System Location Discovery

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1614

                                                                                                                                                                                                                      System Language Discovery

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1614.001

                                                                                                                                                                                                                      System Time Discovery

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1124

                                                                                                                                                                                                                      Lateral Movement

                                                                                                                                                                                                                      Collection

                                                                                                                                                                                                                      Command and Control

                                                                                                                                                                                                                      Web Service

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1102

                                                                                                                                                                                                                      Exfiltration

                                                                                                                                                                                                                      Impact

                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                      e5ab078.rbs
                                                                                                                                                                                                                      • Path C:\Config.Msi\e5ab078.rbs
                                                                                                                                                                                                                      • Size 33.7MB
                                                                                                                                                                                                                      • SHA256 23dc0c0367854a1c3c9ba858c8aa2bd284ad02df05f1047482375beca4172b0b
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      SbkupStub.exe.config
                                                                                                                                                                                                                      • Path C:\Program Files\WinZip\SbkupStub.exe.config
                                                                                                                                                                                                                      • Size 262B
                                                                                                                                                                                                                      • SHA256 8e2b7d6254d22337ec0ae2f0d480fecbcf9df61ee942ca8d85b8526c163cde8a
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      WinZipCourierConfig.exe
                                                                                                                                                                                                                      • Path C:\Program Files\WinZip\WinZipCourierConfig.exe
                                                                                                                                                                                                                      • Size 112KB
                                                                                                                                                                                                                      • SHA256 bdbc613eeb87ae93cce53d7ca96b129f3c78ab83800e6b9b9d3a11f47319ea4f
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      WinZip Duplicate File Finder.lnk
                                                                                                                                                                                                                      • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Duplicate File Finder.lnk
                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                      • SHA256 97ef655a96f79648b2aeaaeb897dfd274497b478501121694eab7402949d93b7
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      WinZip Duplicate File Finder.lnk~RFe5ae61b.TMP
                                                                                                                                                                                                                      • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Duplicate File Finder.lnk~RFe5ae61b.TMP
                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                      • SHA256 a6206d9da7d204f20137a95ace515447dc98fac2b3a2759be0321a3b87461dd6
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      WinZip Image Manager.lnk
                                                                                                                                                                                                                      • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Image Manager.lnk
                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                      • SHA256 21c16fd1a4afa67627813d75ec3715c1f315f94fe6f2580c80e550b6ecc75466
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      WinZip Image Manager.lnk~RFe5ae62b.TMP
                                                                                                                                                                                                                      • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Image Manager.lnk~RFe5ae62b.TMP
                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                      • SHA256 4eee490e0c94c017dcfac43e0cde66bb47dda99a79d789820e28ba90f1e25955
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      WinZip PDF Express.lnk
                                                                                                                                                                                                                      • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip PDF Express.lnk
                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                      • SHA256 2ad9bd6015ffaa480ad0ec6c59a85c969f0b14a97acff9ab4b886da8082ad235
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      WinZip PDF Express.lnk~RFe5ae64a.TMP
                                                                                                                                                                                                                      • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip PDF Express.lnk~RFe5ae64a.TMP
                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                      • SHA256 19e5dd6149d1b973e99fb4db971ea9a41fb8c39f7d4142b5d883bbcdec9753cd
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      WinZip SafeShare.lnk
                                                                                                                                                                                                                      • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip SafeShare.lnk
                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                      • SHA256 5d363823de50b7285265c14502b5cd65367d8d17ce5c29b84d56aec5835dfb72
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      WinZip SafeShare.lnk~RFe5ae66a.TMP
                                                                                                                                                                                                                      • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip SafeShare.lnk~RFe5ae66a.TMP
                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                      • SHA256 d0da169d3c349c667ff254dbbb965af771bf3654f988c220b0e058f0dafc61cc
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      WinZip Secure Backup.lnk
                                                                                                                                                                                                                      • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Secure Backup.lnk
                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                      • SHA256 cdb0610c73bd50054ba63600fd34b8660d231af138dfce8fce5d1751b2c06ec5
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      WinZip Secure Backup.lnk~RFe5ae679.TMP
                                                                                                                                                                                                                      • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Secure Backup.lnk~RFe5ae679.TMP
                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                      • SHA256 cd748431e4662e8d1ffb359dc402cd4f2c95992c64fa901137e9ab86ba8f28f0
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      WinZip Tool Settings.lnk
                                                                                                                                                                                                                      • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Tool Settings.lnk
                                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                                      • SHA256 230ce0348965ebfad88a9891b8a142bdb1971d7584b3d0a0a6402cdcc61732d6
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      WinZip Tool Settings.lnk
                                                                                                                                                                                                                      • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Tool Settings.lnk
                                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                                      • SHA256 b5739011f49570c5c408c01a95ce1aad426852f50904b4987852bc7ee35fa9d9
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      WinZip Tool Settings.lnk~RFe5ae5fc.TMP
                                                                                                                                                                                                                      • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Tool Settings.lnk~RFe5ae5fc.TMP
                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                      • SHA256 48b542b06ac6361e236ccaa28ac12da88857a5190fe54d9714fafa037a981aa0
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      WinZip.lnk
                                                                                                                                                                                                                      • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip.lnk
                                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                                      • SHA256 63f6932ee0d5fd90046a4489702eebc7a941e98c592c5394cd54bf7dfa81aff3
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      WinZip.lnk~RFe5ae5fc.TMP
                                                                                                                                                                                                                      • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip.lnk~RFe5ae5fc.TMP
                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                      • SHA256 3f6fefeda473fc597cd95e709cd6ebdda5bcfce76814b134ea914911343b0b05
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      WinZip.lnk
                                                                                                                                                                                                                      • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip\WinZip.lnk
                                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                                      • SHA256 36dca56e46c16b4c719eb215274f2ec868cb79b4491a5d13feeee1d525c0f63c
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      WinZip.lnk~RFe5ae5ed.TMP
                                                                                                                                                                                                                      • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip\WinZip.lnk~RFe5ae5ed.TMP
                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                      • SHA256 2e36dfcc9385554191b5bcd2d911cee49da84b37616e74eceb8b0bce7efcf332
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      winzip.77.xml
                                                                                                                                                                                                                      • Path C:\ProgramData\WinZip\DIPUS\winzip.77.xml
                                                                                                                                                                                                                      • Size 857B
                                                                                                                                                                                                                      • SHA256 05e47f259029a23bcb0fe0f94a388704342c19ac4a7eb92a7e015072e6a278bf
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      WinZip.addon
                                                                                                                                                                                                                      • Path C:\ProgramData\WinZip\WinZip.addon
                                                                                                                                                                                                                      • Size 20B
                                                                                                                                                                                                                      • SHA256 3986d2112365b1ddc964b81978cc4461263f4ff40a9d7cd09bff54e235489e5b
                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      WinZip.addon
                                                                                                                                                                                                                      • Path C:\ProgramData\WinZip\WinZip.addon
                                                                                                                                                                                                                      • Size 20B
                                                                                                                                                                                                                      • SHA256 85bb6b20f494818d7194146b1ce6eb7cef47ada66e12f5af9766ddc43fb227b2
                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      WinZip.addon
                                                                                                                                                                                                                      • Path C:\ProgramData\WinZip\WinZip.addon
                                                                                                                                                                                                                      • Size 20B
                                                                                                                                                                                                                      • SHA256 17cc720f15554bdc2ad246cdfcc68ea9cb3bf4d49ed985dcb99378d8f405507c
                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      blocklist
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                                                                                                                                                                      • Size 105KB
                                                                                                                                                                                                                      • SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      settings.dat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                      • Size 280B
                                                                                                                                                                                                                      • SHA256 3d6022b8b09d410224e6f49ce6c5693abe531fcaf66bb13ef03126afd2691fe0
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      settings.dat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                      • Size 280B
                                                                                                                                                                                                                      • SHA256 940cbc9ecbe8080b4f78231e8ea559e5f25ba4586d9b9c7484580010ea141f8b
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      LOG.old
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                                                                                                                                      • Size 763B
                                                                                                                                                                                                                      • SHA256 784e9ffda92a2f15a44762fa2602ae93631e856956615fe0fc7192b010b11c48
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      MANIFEST-000001
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
                                                                                                                                                                                                                      • Size 158B
                                                                                                                                                                                                                      • SHA256 3162af488c283bbdb6565f4200727821b4e60ce0c47948b8d5b3655271a2625a
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      BookmarkMergedSurfaceOrdering
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                                                                                                                      • Size 6B
                                                                                                                                                                                                                      • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      f_000091
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000091
                                                                                                                                                                                                                      • Size 32KB
                                                                                                                                                                                                                      • SHA256 eff9dfe4ebe815c15fa6087a8b712ccacea7a59dddcb55a5c819293252d73c32
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      f_000092
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000092
                                                                                                                                                                                                                      • Size 96KB
                                                                                                                                                                                                                      • SHA256 6c501148aada1207002c4dc6fb8794554897d71abeb97e92d9d15c8cf61a8448
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      f_000093
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000093
                                                                                                                                                                                                                      • Size 67KB
                                                                                                                                                                                                                      • SHA256 69f709366db45dadeaf244049b0a31ec8f733d8c58757de4628cb6cb89a65f58
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      f_000094
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000094
                                                                                                                                                                                                                      • Size 401KB
                                                                                                                                                                                                                      • SHA256 b411114c2c82087b6bc8d2ea8523449d1b91579ecf6690881f8b1a7201a61bf0
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      f_000097
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000097
                                                                                                                                                                                                                      • Size 162KB
                                                                                                                                                                                                                      • SHA256 43e2d43f920c67971b92a27b91c51465ef41f02073f1648ded1aba74f6b62ca2
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      f_000098
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000098
                                                                                                                                                                                                                      • Size 27KB
                                                                                                                                                                                                                      • SHA256 4055c08923c81d63735c1691baa778c332bf680b8c4eb057d7b87e2c00c5578d
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      f_000099
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000099
                                                                                                                                                                                                                      • Size 77KB
                                                                                                                                                                                                                      • SHA256 a45a777a0f82b517510ff234571bad345a092c799622c3c10bf7f1c20cad03f5
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      f_00009a
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009a
                                                                                                                                                                                                                      • Size 19KB
                                                                                                                                                                                                                      • SHA256 175b71e4cc8ff85156e4105e1d2da556afbcebcb57c86299fead697b027717d4
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      f_00009d
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009d
                                                                                                                                                                                                                      • Size 59KB
                                                                                                                                                                                                                      • SHA256 2a43b4cfc47238c170257b2345f451828a25270327bba55db5db07398e1199e8
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      f_0000a0
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a0
                                                                                                                                                                                                                      • Size 66KB
                                                                                                                                                                                                                      • SHA256 00ce90dde97890a2e635db407bae7d8472661a8128a0433f1223a9b65b7a949f
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      f_0000a7
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a7
                                                                                                                                                                                                                      • Size 17KB
                                                                                                                                                                                                                      • SHA256 fe672d5c4e9570c5c4c30f7ffa25027237ec3a8766ec89d377a0f8964ee75937
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      f_0000ac
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ac
                                                                                                                                                                                                                      • Size 65KB
                                                                                                                                                                                                                      • SHA256 cd347596a47263afe619ad7ee58737bdd5069a9261405fc4c67a78dfa733f711
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      f_0000ae
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ae
                                                                                                                                                                                                                      • Size 62KB
                                                                                                                                                                                                                      • SHA256 df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      f_0000af
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000af
                                                                                                                                                                                                                      • Size 68KB
                                                                                                                                                                                                                      • SHA256 90e39936fa4a20f0fcdafc8ce17bd53e662b5ac7fe4c810b28ed5356b9da6d02
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      f_0000b0
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b0
                                                                                                                                                                                                                      • Size 63KB
                                                                                                                                                                                                                      • SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      f_0000b1
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b1
                                                                                                                                                                                                                      • Size 19KB
                                                                                                                                                                                                                      • SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      f_0000b2
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b2
                                                                                                                                                                                                                      • Size 38KB
                                                                                                                                                                                                                      • SHA256 4392ddde86f22a921269feaf788a13509946046047df6926017041ff33d0293e
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      f_0000f0
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f0
                                                                                                                                                                                                                      • Size 33KB
                                                                                                                                                                                                                      • SHA256 c56fae71e42a4adead1a5881434d43ed9263c3e8ad641bd6a84792d9ab8f9ff9
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      f_0000f1
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f1
                                                                                                                                                                                                                      • Size 18KB
                                                                                                                                                                                                                      • SHA256 4e87bf6b58c7fbea38edca8989fdf8878ece4ba7d287b06c34083c7eec6bc5e9
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      f_000138
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000138
                                                                                                                                                                                                                      • Size 21KB
                                                                                                                                                                                                                      • SHA256 10e6cc81dc0860b2bc3fb255058d31837345ecf5f45379317d58b1064fdd0472
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      f_00013b
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00013b
                                                                                                                                                                                                                      • Size 20KB
                                                                                                                                                                                                                      • SHA256 5515689bdc5b64493caec5c67fdf8efeb606ba0707c4062fa312bac0f1fbbb7c
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      f_000144
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000144
                                                                                                                                                                                                                      • Size 2.8MB
                                                                                                                                                                                                                      • SHA256 6e1107820cf795417ab62ffd676142b2345243d26528ea3590d970ecd9d0c4cb
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      f_000187
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000187
                                                                                                                                                                                                                      • Size 16KB
                                                                                                                                                                                                                      • SHA256 0e4c8483e91039738e0e9e77cf711e4ad645fd9f2aeb98b84af6dcadeaeefc7a
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      01805c70faf7f8c5_0
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\01805c70faf7f8c5_0
                                                                                                                                                                                                                      • Size 262B
                                                                                                                                                                                                                      • SHA256 fa2c4f49fe83bf715c75d2ea0bb65af7644a09324c43a62260e395e9483e515f
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      0e56a543b666e482_0
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0e56a543b666e482_0
                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                      • SHA256 fb051452885997d30cb1ad98633b8420d2cb1d56b127b0f3a68a0b7d33b55b56
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      0eb1763f04b21312_0
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0eb1763f04b21312_0
                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                      • SHA256 71d78e691c18c401d3188733f2a229280da6987052454f45836be736c5facaa6
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      1f1c4bba1674fa36_0
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1f1c4bba1674fa36_0
                                                                                                                                                                                                                      • Size 262B
                                                                                                                                                                                                                      • SHA256 4ed83796279bfbd4acc671881756620ad4374e636ddcab7d90a88203a664fb9b
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      1f974568b3b7eb41_0
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1f974568b3b7eb41_0
                                                                                                                                                                                                                      • Size 7KB
                                                                                                                                                                                                                      • SHA256 0a1ccdfa728567f4cb0c98896610a8537a21d7bdf9aede27352c8d4a1886720c
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2692617678c042d9_0
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2692617678c042d9_0
                                                                                                                                                                                                                      • Size 10KB
                                                                                                                                                                                                                      • SHA256 5f6dd02a8860e99da98fee48b6c688a0ab1e4cedbd07494b1ffda63f05a59947
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2f4680e8f8f8a14f_0
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2f4680e8f8f8a14f_0
                                                                                                                                                                                                                      • Size 262B
                                                                                                                                                                                                                      • SHA256 d48b11adf73ff288c807df98e76e03cd84712ea3486b33c6900d2f0e5c51b7a9
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      51438acbcfff1bda_0
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\51438acbcfff1bda_0
                                                                                                                                                                                                                      • Size 262B
                                                                                                                                                                                                                      • SHA256 7a9fb7a13f3c09461691a0353be56597319e650b91c8bfb000e190863d321959
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      61a0b4d20ae0e222_0
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\61a0b4d20ae0e222_0
                                                                                                                                                                                                                      • Size 14KB
                                                                                                                                                                                                                      • SHA256 8564ec9d48ca3af58e4c9672764b043add6a95a4a291459d04f09f11cfdbd0e8
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      688a4b4b23c2152a_0
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\688a4b4b23c2152a_0
                                                                                                                                                                                                                      • Size 5KB
                                                                                                                                                                                                                      • SHA256 8d8897b689eb10dd83349ed9fe1db24809afdd383d24e7201e6995a5f20ecaea
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      6a5e8bb53a565b9f_0
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6a5e8bb53a565b9f_0
                                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                                      • SHA256 ca59abb2ea423a49249df0d5e3e3c0f0c4090e1043e60c52fc4c48e555469828
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      7676d068754b406d_0
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7676d068754b406d_0
                                                                                                                                                                                                                      • Size 4KB
                                                                                                                                                                                                                      • SHA256 7d91f065ea81ed23e2ba64e2f4ba520428f5291d06d486bb72fe7b35a8d903b5
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      7e044207414e80a6_0
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7e044207414e80a6_0
                                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                                      • SHA256 7d96b565246fbde3b7c4c57f056979f680276f4eb95e09ad8e0b1df549d9c595
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      96bc766215a93e35_0
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\96bc766215a93e35_0
                                                                                                                                                                                                                      • Size 3KB
                                                                                                                                                                                                                      • SHA256 27221db2d46a82aa9da50d857637906a0fb7bd319cf56d57ae9f1c6549b27312
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      a067705c689d7daf_0
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a067705c689d7daf_0
                                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                                      • SHA256 9f313315bf3744572735bf130a32a594ec7081ee1f1a63e758dda14308824ee5
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      e88e996bb16c52cb_0
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e88e996bb16c52cb_0
                                                                                                                                                                                                                      • Size 262B
                                                                                                                                                                                                                      • SHA256 9ac3f2f7bdbed0517085bdd0b6a6e8a0cf040cfa4f70437424ac5c07ac847dd7
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      ed2bce91487b3a82_0
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ed2bce91487b3a82_0
                                                                                                                                                                                                                      • Size 11KB
                                                                                                                                                                                                                      • SHA256 74228516501f00970786d44e9a275c4570653044b1597160dea10cbe9bbea409
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      the-real-index
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                      • Size 13KB
                                                                                                                                                                                                                      • SHA256 1ad57312f677a8919048adfb1201df7e5ca90ff7bc7ba0a655714c963bdd65d6
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      the-real-index
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                      • Size 9KB
                                                                                                                                                                                                                      • SHA256 449b1bc72c48f333ad56b9ff2a30e9f7e55b824d21b14fb32703ace4577f7495
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      the-real-index
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                      • Size 13KB
                                                                                                                                                                                                                      • SHA256 43b358eaa0d4dc53320af86ca7881bb1461bbefb5d907ccf6dbad7af0e3be25d
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      the-real-index
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                      • Size 11KB
                                                                                                                                                                                                                      • SHA256 53f34abe1dd1cb002d14b39519be449b094bca36688308b361bbc9d321ce8217
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      the-real-index
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                      • Size 13KB
                                                                                                                                                                                                                      • SHA256 29a29dc9d0ce6e3eec09bdf667b3d157b15acfefcee11e744d914049358ced2e
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      the-real-index
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                      • Size 11KB
                                                                                                                                                                                                                      • SHA256 0a1da5f739f27d7e0c312662026b9b10246cc963dcc7a859fdd8d888daaf5262
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      SiteList-Enterprise.json
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                                                                                                      • Size 2B
                                                                                                                                                                                                                      • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Edge Profile.ico
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                                                                                                                      • Size 70KB
                                                                                                                                                                                                                      • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      HubApps
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                                                                                                                                                                      • Size 106KB
                                                                                                                                                                                                                      • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Network Persistent State
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                      • Size 7KB
                                                                                                                                                                                                                      • SHA256 6c97e8c25218b138aec8f7c8854269cb1af7dea334bb1a8463a0f51db852168f
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Network Persistent State
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                      • Size 32KB
                                                                                                                                                                                                                      • SHA256 49f27a2f122ce32397994932a9275f0cc721206a0faa592208c0671087ed963c
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Network Persistent State
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                      • Size 111B
                                                                                                                                                                                                                      • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Network Persistent State
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                      • Size 25KB
                                                                                                                                                                                                                      • SHA256 0194db9f3f91f4178125c5d0db928e003c0a00d6d81d38b46d84325cd5797333
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Network Persistent State
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                      • Size 36KB
                                                                                                                                                                                                                      • SHA256 a93bea2bc658a6d17d5366ee699735c4cd3937bb0f15cdcf3937849603ab9644
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      SCT Auditing Pending Reports
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                                                      • Size 2B
                                                                                                                                                                                                                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Sdch Dictionaries
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                                                                                                                      • Size 211B
                                                                                                                                                                                                                      • SHA256 64daf125899704dbe71bfc4c916748e017627f3e598b061760d9cf5999463b6c
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Sdch Dictionaries
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                                                                                                                      • Size 211B
                                                                                                                                                                                                                      • SHA256 25a4403364af8059a0c5bfae2d0754d416dfb79db40d6607bd9742e2bfe71122
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Sdch Dictionaries
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                                                                                                                      • Size 211B
                                                                                                                                                                                                                      • SHA256 07ecf6fa2b566261bfc0580ff3db8a97d933c43d90f9f80c578cc94df613f48b
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Sdch Dictionaries~RFe58ebe2.TMP
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe58ebe2.TMP
                                                                                                                                                                                                                      • Size 40B
                                                                                                                                                                                                                      • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Preferences
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                      • Size 14KB
                                                                                                                                                                                                                      • SHA256 943c90f68d14c1002831438ea1f188937161ad69e67cf7ba971acc52bed73bf6
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Preferences
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                      • Size 21KB
                                                                                                                                                                                                                      • SHA256 735bcff58f983e68842b4b4336962b8895f9b7134f009ad5e9d711925b1ded06
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Preferences
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                      • Size 36KB
                                                                                                                                                                                                                      • SHA256 982fbdcf6119b23e2f298afb15f2a88fa5b8bfe07eecc15eef6050ac582972d2
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Preferences
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                      • Size 36KB
                                                                                                                                                                                                                      • SHA256 8f68714bbd47cf8c1a78af8505b310ce477d51b650ae3e9caabd025fb6d498bb
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Preferences
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                      • Size 36KB
                                                                                                                                                                                                                      • SHA256 29f7819b553054068f6b303714a527ab22c8877bc9ff39880f6f43d2a213aa92
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Preferences
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                      • Size 20KB
                                                                                                                                                                                                                      • SHA256 9e3cb1057902ef660f8c6ada1bb80c206eb64e7630831a86c448f176a6498b51
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Preferences
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                      • Size 18KB
                                                                                                                                                                                                                      • SHA256 68aa74ad12e5e5d439fe8ba11d528504b1209c9017afa91f56605620a022bb6d
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Preferences
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                      • Size 20KB
                                                                                                                                                                                                                      • SHA256 3dddc3b31433dcd938ea1bfe57dfc510bc6cb42960bcf7c081680c87cee6f7fe
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Secure Preferences
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                                                                                      • Size 31KB
                                                                                                                                                                                                                      • SHA256 ffde16809afa708a7ccca7702dd0ad736fc2bc12b76b3c51e790996d3914db54
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      the-real-index
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b38f76fc-0bdb-4056-95ec-6b53c77ee934\index-dir\the-real-index
                                                                                                                                                                                                                      • Size 3KB
                                                                                                                                                                                                                      • SHA256 47d43cdcbb900d32ca4015f19b2ea0fa10b3638eaf1df11932780eef4ddef636
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      the-real-index
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b38f76fc-0bdb-4056-95ec-6b53c77ee934\index-dir\the-real-index
                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                      • SHA256 1018af1481f8056434450e392eb4281cff1a6e707962be0cca9a2ea741232b13
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      the-real-index~RFe58a592.TMP
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b38f76fc-0bdb-4056-95ec-6b53c77ee934\index-dir\the-real-index~RFe58a592.TMP
                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                      • SHA256 d91f1f8d9de3811df9b1d5f4fd72e0c828c332b15cb2f3366964ee3f07ec2061
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      the-real-index
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\db051936-6c70-47c1-b269-fb19c118fa19\index-dir\the-real-index
                                                                                                                                                                                                                      • Size 72B
                                                                                                                                                                                                                      • SHA256 cc4c7afd2868aafbff6dd33d37671c47e248815375c522b8e1db51350ec89e63
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      the-real-index
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\db051936-6c70-47c1-b269-fb19c118fa19\index-dir\the-real-index
                                                                                                                                                                                                                      • Size 72B
                                                                                                                                                                                                                      • SHA256 28d80d10b6c1852d8cfab4206dfac64bab8370377ce8806120bc986c2cfee169
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      index.txt
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                                                                                                                                      • Size 371B
                                                                                                                                                                                                                      • SHA256 a67633532f5a54a90e044fc9e1904a8bcee193b27ede9654935a89a8321d80da
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      the-real-index
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                                                                                                      • Size 72B
                                                                                                                                                                                                                      • SHA256 686b67b683cc2f45af1902291761f86a708aa6a8519d896e1a2e67795d5c2f23
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      the-real-index~RFe5907a7.TMP
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5907a7.TMP
                                                                                                                                                                                                                      • Size 48B
                                                                                                                                                                                                                      • SHA256 7649d2558502aba5a2aa24b8d14591d5426adb762ca6ddad42d518e2709ab7dc
                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      the-real-index
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
                                                                                                                                                                                                                      • Size 72B
                                                                                                                                                                                                                      • SHA256 1180fa46b57af160665474028b5dcf74ca3e2c70a710e68faffd9b77b827eca4
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      the-real-index
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
                                                                                                                                                                                                                      • Size 96B
                                                                                                                                                                                                                      • SHA256 9f3cb6b9629bdd071cc85dfe2670865b6f8bb255e86732872d62c7e4f1808b73
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      sync_diagnostic.log
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                                                                                                      • Size 5KB
                                                                                                                                                                                                                      • SHA256 fb0fa8c3dee5666d85647ea06b2ddef9537c4f82912f868e32e4c0ef584c5221
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      OperationConfig
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                                                                                                                                                      • Size 22KB
                                                                                                                                                                                                                      • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      OperationConfig~RFe596edd.TMP
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe596edd.TMP
                                                                                                                                                                                                                      • Size 3KB
                                                                                                                                                                                                                      • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                      • Size 19KB
                                                                                                                                                                                                                      • SHA256 c27b4a489bca9f196933af14ff93c6088e9785816b7e665d3b3a9c4832ae3012
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                      • Size 20KB
                                                                                                                                                                                                                      • SHA256 76fc5675b9e559b93389a029189d4fcc9ccd1f19f606ae91486da309b70ceb5d
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                      • Size 28KB
                                                                                                                                                                                                                      • SHA256 5cc6eb4e44459b2b9abae1acb0bd4f9e78307a93dec491fbc763da438fb7eb95
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                      • Size 27KB
                                                                                                                                                                                                                      • SHA256 de254396e9cc47fc69d7b8c58ce61316617f6a9964b9c67eac92c1125422d441
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                      • Size 28KB
                                                                                                                                                                                                                      • SHA256 5bc1c86aeace8d59e396636b15d888b9e8eac7e7e7acab08c293d150a8fb84a7
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                      • Size 27KB
                                                                                                                                                                                                                      • SHA256 5480eea3d56dc4ae60f25ef5b721d8ecb18e8ade46eff2a2c4b01a0f067841ca
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                      • Size 19KB
                                                                                                                                                                                                                      • SHA256 4a6e1c52a1ab95f88bbf40c01bad70e7352425fdf24102e93e7a3edb06b8e73c
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                      • Size 8KB
                                                                                                                                                                                                                      • SHA256 67e9e45f4d237ec5c4dcf5fba59184b0b8e5ab175db7931db82a0d866329f034
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                      • Size 27KB
                                                                                                                                                                                                                      • SHA256 fd93a6d99b8e5fa5e9d7decbf926de0138fac2aca9c02581f2da38353660e5b3
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                      • Size 20KB
                                                                                                                                                                                                                      • SHA256 d90fb4589d7f4c598b040482cb3c24343c015cadfebdd669bf33e51495bbb918
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                      • Size 28KB
                                                                                                                                                                                                                      • SHA256 81613f65abcf2ccbb990ddf4d7e4a035d83bbecc09d13d2ffee4534ef857f9cd
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                      • Size 8KB
                                                                                                                                                                                                                      • SHA256 017ad6c53314ab29bb3cb7f3293b269ad2fa5f721b50c5e7af416eac9348db02
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      RevisitationBloomfilter
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                      • Size 392B
                                                                                                                                                                                                                      • SHA256 9214aebb04078ec8c96f94868f647f752dc5d04d6220e913cc8c1531ae65e273
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      RevisitationBloomfilter
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                      • Size 392B
                                                                                                                                                                                                                      • SHA256 ab7a3b7e43425cf53b8395c15a2539885743214cbc64c9f701e36e4a4048ce2c
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      RevisitationBloomfilter
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                      • Size 392B
                                                                                                                                                                                                                      • SHA256 c39789541ae6586df4920d0f765a01e36435f92d7e5d11a0cc9e7fe298e9265f
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      RevisitationBloomfilter
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                      • Size 392B
                                                                                                                                                                                                                      • SHA256 e69f21c8f63deb6594ddee31ea8ae5d14b7d38e76c3882a4224cbf3244140d0f
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      RevisitationBloomfilter
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                      • Size 392B
                                                                                                                                                                                                                      • SHA256 246bdbc315a93bf3a750fdfc6ac8a1ba8dfe5ee503ef1f9d45bd286d3285d4bf
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      RevisitationBloomfilter
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                      • Size 392B
                                                                                                                                                                                                                      • SHA256 01ede66504bfedeec1525f78bc1a7fd53dfb589513844796f91190d99db2352b
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      RevisitationBloomfilter
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                      • Size 392B
                                                                                                                                                                                                                      • SHA256 121dded414cc4a289077b282de8c3e562f5962fd2f46020bf8c774b8f8c4208b
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      RevisitationBloomfilter
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                      • Size 392B
                                                                                                                                                                                                                      • SHA256 f6e090be42ddbac4b13e5ac11c351b25e449dd0dcb9a215c6dd916f2c60986ab
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      RevisitationBloomfilter
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                      • Size 392B
                                                                                                                                                                                                                      • SHA256 0e6dd4f4adf54055b5f0a427aeb8f010da10be078e305e0f8a5fbc189d158532
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      RevisitationBloomfilter
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                      • Size 392B
                                                                                                                                                                                                                      • SHA256 9ad567a652c8fcfdfe5f9e9cb4e85f18c99edee6569131003a2dc107cc806fe6
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      RevisitationBloomfilter
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                      • Size 392B
                                                                                                                                                                                                                      • SHA256 9121f9ff846261a25fb5b29058810be688a5a1d644f671a81653eb726ee6815f
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      RevisitationBloomfilter
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                      • Size 392B
                                                                                                                                                                                                                      • SHA256 2247a60236ffdd1da9000083a273b137b868202af893dd91c96ce02e93aed633
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      RevisitationBloomfilter
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                      • Size 392B
                                                                                                                                                                                                                      • SHA256 70c0875349fd77b85435abfc4bf8d60b28759471bdea2de11f021105036f2584
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      RevisitationBloomfilter~RFe58e3b4.TMP
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58e3b4.TMP
                                                                                                                                                                                                                      • Size 392B
                                                                                                                                                                                                                      • SHA256 1021b3c6d8ec85f592ca564c74368debb99522bf948ee1d8383d6a8645187c9c
                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      metadata.json
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                                                                                                                                                      • Size 13B
                                                                                                                                                                                                                      • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      ipm.corel[1].xml
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\W5PGCX03\ipm.corel[1].xml
                                                                                                                                                                                                                      • Size 4KB
                                                                                                                                                                                                                      • SHA256 e82bd3b32d9916123d11fcffc227afc07bf48a4916f00301711c602c73c8c8cb
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      ipm.corel[1].xml
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\W5PGCX03\ipm.corel[1].xml
                                                                                                                                                                                                                      • Size 5KB
                                                                                                                                                                                                                      • SHA256 5ca1f171855ca5ca013fac24ee424a96e6c74ed9fac1cb1e52e54fb89ae9328b
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      ipm.corel[1].xml
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\W5PGCX03\ipm.corel[1].xml
                                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                                      • SHA256 0d15486088cabaaab83ab259ab0492ded3156317fc396399adc5f56a24195f2c
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      iconcache_idx.db
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                                                                                                                                                                                                                      • Size 56KB
                                                                                                                                                                                                                      • SHA256 6d794b97430972c0b1eaf0d26f3c6160fdb2da453545253ebdd4e506d003aba4
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      iconcache_idx.db
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                                                                                                                                                                                                                      • Size 56KB
                                                                                                                                                                                                                      • SHA256 558409e36230e2fda66f7cb2ddf8414ca357e07dee70b764a338a03d8a7175d0
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      gtm[1].js
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ETWPGIZA\gtm[1].js
                                                                                                                                                                                                                      • Size 447KB
                                                                                                                                                                                                                      • SHA256 1c41d03d790a2034f6ea9f11c8984de1b4b888dd778c4ca4280d13e7423678fe
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      AppCache134274378659513429.txt
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134274378659513429.txt
                                                                                                                                                                                                                      • Size 88KB
                                                                                                                                                                                                                      • SHA256 5004ac06f06798dac964a5bd8c228a781fc8f3f70c5ebd4e631eaf8c27f5e7c5
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      IPP_GMT_1782964111.html
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\IPP_GMT_1782964111.html
                                                                                                                                                                                                                      • Size 924B
                                                                                                                                                                                                                      • SHA256 5015fca846ee6ca805238276bd772b52a3f95893dbd7ab7107b84cca7dde6bc9
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      installer_log_20260702034753.txt
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\e5a41ec\installer_log_20260702034753.txt
                                                                                                                                                                                                                      • Size 11KB
                                                                                                                                                                                                                      • SHA256 6bb64f2f6bbf53ace6d7baa00461e62316470430825280f8f6655658a2980d7e
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Load.html
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\e5a4298\Load.html
                                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                                      • SHA256 3cf5674efaaf74beccd16d1b9bcf3ffb35c174d6d93375bc532b46d9b4b4ed35
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      common.css
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\e5a4298\common\css\common.css
                                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                                      • SHA256 265d280bad44060c22a6caef0140bb8085b994cdd8d76789f3a43a6e7f2a16ea
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      jquery-ui.css
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\e5a4298\common\css\jquery-ui.css
                                                                                                                                                                                                                      • Size 20KB
                                                                                                                                                                                                                      • SHA256 95f4c300d84eedd0c43a30a1b6f0dfbbf7b8c47725511981e4cfe12dfaeb0e93
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      button-normal.png
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\e5a4298\common\img\button-normal.png
                                                                                                                                                                                                                      • Size 14KB
                                                                                                                                                                                                                      • SHA256 a768c604ae9ef96d0f26d8e6c46b0c24515ada8945c9bd8a86b8173eea730653
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      centerImg.png
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\e5a4298\common\img\centerImg.png
                                                                                                                                                                                                                      • Size 711KB
                                                                                                                                                                                                                      • SHA256 8627777c53a31448c9e61705478b77edbaa2dcfd55ef930eb33f840bac014781
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      close-normal.png
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\e5a4298\common\img\close-normal.png
                                                                                                                                                                                                                      • Size 16KB
                                                                                                                                                                                                                      • SHA256 dd727b90f3c6b053fa5b4c8401440e5d120dac6b93305573caaefecedc5f0c5e
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      footerImg.png
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\e5a4298\common\img\footerImg.png
                                                                                                                                                                                                                      • Size 124KB
                                                                                                                                                                                                                      • SHA256 ea52a6f973100cbdd3217a609ef3737dae42597dd112165fc8a0c42fbd37a517
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      headerImg.png
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\e5a4298\common\img\headerImg.png
                                                                                                                                                                                                                      • Size 205KB
                                                                                                                                                                                                                      • SHA256 a9b420a106adb6b09e5dd39a864dd00519aade91ce6f500c179e9e6652b0fc51
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      header_logo.png
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\e5a4298\common\img\header_logo.png
                                                                                                                                                                                                                      • Size 5KB
                                                                                                                                                                                                                      • SHA256 ec9d030b3f64cedc4645f8efea56baff55f1b13dfb0db6eececdb9612676f893
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      common.js
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\e5a4298\common\js\common.js
                                                                                                                                                                                                                      • Size 45KB
                                                                                                                                                                                                                      • SHA256 38d94300f8b4a82899eaeb4b2e8583fdd8f8040c0e5d8c666af4270b74c13e34
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      external.js
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\e5a4298\common\js\external.js
                                                                                                                                                                                                                      • Size 36B
                                                                                                                                                                                                                      • SHA256 25df7ab9509d4e8760f1fdc99684e0e72aac6e885cbdd3396febc405ea77e7f6
                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      jquery-1.11.2.min.js
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\e5a4298\common\js\jquery-1.11.2.min.js
                                                                                                                                                                                                                      • Size 93KB
                                                                                                                                                                                                                      • SHA256 2ecd295d295bec062cedebe177e54b9d6b19fc0a841dc5c178c654c9ccff09c0
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      jquery-ui.min.js
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\e5a4298\common\js\jquery-ui.min.js
                                                                                                                                                                                                                      • Size 12KB
                                                                                                                                                                                                                      • SHA256 2e5f9b159be16a83d09c1dc654c73737e10d2a6f8372b51be480b1ba42b7273c
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      config.js
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\e5a4298\config\config.js
                                                                                                                                                                                                                      • Size 5KB
                                                                                                                                                                                                                      • SHA256 30c3d0e8bb3620fe243a75a10f23d83436ff4b15acb65f4f016258314581b73d
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      installerlist.js
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\e5a4298\config\installerlist.js
                                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                                      • SHA256 df2f68a1db705dc49b25faf1c04d69e84e214142389898110f6abb821a980dcc
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      installparams.js
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\e5a4298\config\installparams.js
                                                                                                                                                                                                                      • Size 561B
                                                                                                                                                                                                                      • SHA256 2936a5c55e266a0240a20bd381911022585c569500ee87738eca628c80cd7374
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      stubparams.js
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\e5a4298\config\stubparams.js
                                                                                                                                                                                                                      • Size 37KB
                                                                                                                                                                                                                      • SHA256 823f4f8dfe55d3ce894308122d6101fed1b8ef1eb8e93101945836655b2aed1b
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      features.js
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\e5a4298\pages\Agreement\features.js
                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                      • SHA256 2a1591b93cd0b7c8795b04aa47404c4a1c0b8857e7adfdaa2590aada61133802
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      page.html
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\e5a4298\pages\Agreement\page.html
                                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                                      • SHA256 41700cceb0226f9198b1e09be78e0a2942cfcb71529f679cca390f7385502a2c
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      page.js
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\e5a4298\pages\Agreement\page.js
                                                                                                                                                                                                                      • Size 3KB
                                                                                                                                                                                                                      • SHA256 934c949b9369958c7c2fb293283fce40f08dafd63841f7ca46d7e46c552e9c03
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      features.js
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\e5a4298\pages\Analytics\features.js
                                                                                                                                                                                                                      • Size 267B
                                                                                                                                                                                                                      • SHA256 7b19373f0e1b5bfc2499da6c4e0d8584b0371ead066f09aa5df132528334deaf
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      page.html
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\e5a4298\pages\Analytics\page.html
                                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                                      • SHA256 ca8c664cbb210ebd14e92853ec9f6067512744158c795cc4dd510e99fb32e036
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      page.js
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\e5a4298\pages\Analytics\page.js
                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                      • SHA256 dccd51191cd0c6a31e5692944b394f8f2c6596d4dd44982a362db26342d373d5
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      features.js
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\e5a4298\pages\Downloading\features.js
                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                      • SHA256 f234498755b699a077ef73c1c82973d39078818bfb7f68c35f2ed0202807cfe8
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      page.html
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\e5a4298\pages\Downloading\page.html
                                                                                                                                                                                                                      • Size 3KB
                                                                                                                                                                                                                      • SHA256 c4d316dc0b7988a7e4bfd8dfa9f69670132a4fb3918ebe38306f75c6c63b93d9
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      page.js
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\e5a4298\pages\Downloading\page.js
                                                                                                                                                                                                                      • Size 11KB
                                                                                                                                                                                                                      • SHA256 4c5f5a13046daed4469c21edbe655e5d9dc9e91bec7df9ab87de44809d1094b3
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      features.js
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\e5a4298\pages\Finish\features.js
                                                                                                                                                                                                                      • Size 587B
                                                                                                                                                                                                                      • SHA256 f1c05ddb3ba731f2587f01c978168c76297880896a262eee77575fc5ff72a951
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      page.html
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\e5a4298\pages\Finish\page.html
                                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                                      • SHA256 3005b43a1147d9dc34acf39e5f925ab2350de83615bc5c71586de5bff088d57e
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      page.js
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\e5a4298\pages\Finish\page.js
                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                      • SHA256 e320f7cb3108985a24979ad77283a8576da6f95b5a3623432d64f565f213379f
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      features.js
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\e5a4298\pages\Initialization\features.js
                                                                                                                                                                                                                      • Size 506B
                                                                                                                                                                                                                      • SHA256 cba5152c525188a27394b48761362a9e119ef3d79761358a1e42c879c2fe08cc
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      page.html
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\e5a4298\pages\Initialization\page.html
                                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                                      • SHA256 4d0bdf44125e8be91eecaba44c9b965be9b0d2cb8897f3f35e94f2a74912f074
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      page.js
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\e5a4298\pages\Initialization\page.js
                                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                                      • SHA256 0135163476d0eb025e0b26e9d6b673730b76b61d3fd7c8ffcd064fc2c0c0682a
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      page.js
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\e5a4298\pages\Installing\page.js
                                                                                                                                                                                                                      • Size 11KB
                                                                                                                                                                                                                      • SHA256 40640c3065f17ad7f736ad72f2f30ac6b7cf5e882c32bc7ba527d99dfbb41763
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      features.js
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\e5a4298\pages\Welcome\features.js
                                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                                      • SHA256 a3dead0aa2b886493733f48ada2c20aa3185fadd9d696104b1e3d6c21c37d433
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      page.html
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\e5a4298\pages\Welcome\page.html
                                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                                      • SHA256 308d7eb472a0af7f045ef22ca108c7ac7eba002ca4b9d31cc0a0854afbeb7542
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      page.js
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\e5a4298\pages\Welcome\page.js
                                                                                                                                                                                                                      • Size 9KB
                                                                                                                                                                                                                      • SHA256 fb50127f5669e8f32762b734267487c3fe572c598afebe7a948921e60281e7c2
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      utweb_installer.tmp
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\is-5BDPB37K47.tmp\utweb_installer.tmp
                                                                                                                                                                                                                      • Size 4.2MB
                                                                                                                                                                                                                      • SHA256 c526d819581949bd38d92624a353cb0042731db5eae37da4e8c4fe590e7158da
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      106.png
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\is-XH3KJGT9NX.tmp\106.png
                                                                                                                                                                                                                      • Size 47KB
                                                                                                                                                                                                                      • SHA256 0c430e56d69435d8ab31cbb5916a73a47d11ef65b37d289ee7d11130adf25856
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      utweb_installer.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\is-XH3KJGT9NX.tmp\utweb_installer.exe
                                                                                                                                                                                                                      • Size 20.6MB
                                                                                                                                                                                                                      • SHA256 004af255b2098a163c26ef0c9ad65f7d364ce05d6df72b8eac15109c79971856
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      FindProcDLL.dll
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\nsi3DDB.tmp\FindProcDLL.dll
                                                                                                                                                                                                                      • Size 3KB
                                                                                                                                                                                                                      • SHA256 c0948b2ec36a69f82c08935fac4b212238b6792694f009b93b4bdb478c4f26e3
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      INetC.dll
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\nsi3DDB.tmp\INetC.dll
                                                                                                                                                                                                                      • Size 24KB
                                                                                                                                                                                                                      • SHA256 c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      System.dll
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\nsi3DDB.tmp\System.dll
                                                                                                                                                                                                                      • Size 12KB
                                                                                                                                                                                                                      • SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      UAC.dll
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\nsi3DDB.tmp\UAC.dll
                                                                                                                                                                                                                      • Size 14KB
                                                                                                                                                                                                                      • SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      nsisFirewall.dll
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\nsi3DDB.tmp\nsisFirewall.dll
                                                                                                                                                                                                                      • Size 8KB
                                                                                                                                                                                                                      • SHA256 53be5716ad80945cb99681d5dbda60492f5dfb206fbfdb776b769b3eeb18d2c2
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      settings.dat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView\Crashpad\settings.dat
                                                                                                                                                                                                                      • Size 280B
                                                                                                                                                                                                                      • SHA256 c48798a28c7893500c79108a807498c11a83acb82937ed64bccbce5d574fffba
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      index
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView\Default\Code Cache\js\index
                                                                                                                                                                                                                      • Size 24B
                                                                                                                                                                                                                      • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      the-real-index
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                      • Size 96B
                                                                                                                                                                                                                      • SHA256 8cdd7468b20fee1071dfe8506a37cd2859deba0086540f806f9148277b92057e
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      the-real-index~RFe5b7924.TMP
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5b7924.TMP
                                                                                                                                                                                                                      • Size 48B
                                                                                                                                                                                                                      • SHA256 df9f93a9bbb8c60fdcce1e17972890d14677959ab3f1fae240688da137267a44
                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      ExtensionActivityComp
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView\Default\ExtensionActivityComp
                                                                                                                                                                                                                      • Size 4KB
                                                                                                                                                                                                                      • SHA256 8c471cab38a1696289186d01b06ff6af2a888852dc18d6fb8d2a0e54898104ed
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView\Local State
                                                                                                                                                                                                                      • Size 16KB
                                                                                                                                                                                                                      • SHA256 0628944a14e21341b7f8d78488f1e3772e4a4b69bb5de1e780096e32d6e5a953
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView\Local State
                                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                                      • SHA256 8dd9b2bc0de6aa320755fad33d579684c780042434aeb021b270312f73adce92
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView\Local State
                                                                                                                                                                                                                      • Size 3KB
                                                                                                                                                                                                                      • SHA256 cdf0936eea630d2d202a00b1d098a2685538d652e7c7c3c8883106d088eada60
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView\Local State
                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                      • SHA256 6694db73588f6d30c16aea827a6a8721bbccb937b070cc1820e0e91df4724bc1
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Local State~RFe5b631b.TMP
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView\Local State~RFe5b631b.TMP
                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                      • SHA256 65d31391827a7a92e6fcfff6fe3838abb4a7fff6289e60bfdb9a3a1c00d77e75
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      WzRecipientsCache.db
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\WinZip\WzAddrBook\WzRecipientsCache.db
                                                                                                                                                                                                                      • Size 24KB
                                                                                                                                                                                                                      • SHA256 a8234c904d043d45f76f66d97c5a04d08c9b8dd75da899fced142413ad6ce4a2
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      default.dic
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                                                                                                                                                                                                      • Size 2B
                                                                                                                                                                                                                      • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      db53b23fd1edbd46.customDestinations-ms
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\db53b23fd1edbd46.customDestinations-ms
                                                                                                                                                                                                                      • Size 6KB
                                                                                                                                                                                                                      • SHA256 69158c9ff3d8707e84e5ef642867081b75fa3c8a7a265082dddff88ad3ce8ad1
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      avcodec-58.dll
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\avcodec-58.dll
                                                                                                                                                                                                                      • Size 1.4MB
                                                                                                                                                                                                                      • SHA256 8b527770e0580ee328f8c91aae05016b174d15e13f28befff5a6b6a6f4837084
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      avformat-58.dll
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\avformat-58.dll
                                                                                                                                                                                                                      • Size 927KB
                                                                                                                                                                                                                      • SHA256 4e8d418e6b1345c05e08a4b88e78a84a97c9a8179ca851bd87c93836c2409f31
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      avutil-56.dll
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\avutil-56.dll
                                                                                                                                                                                                                      • Size 620KB
                                                                                                                                                                                                                      • SHA256 47a1c21d501b81a93088ae081da08e74d098ac82e0dbae7a909f39af5bd24815
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      crashpad_handler.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\crashpad_handler.exe
                                                                                                                                                                                                                      • Size 874KB
                                                                                                                                                                                                                      • SHA256 3aa650eedd45c00b250c5267ab3cc32e3a0fe44a9c7d3650f83e78b9cf7cf853
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      helper.partial
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\helper.partial
                                                                                                                                                                                                                      • Size 7.4MB
                                                                                                                                                                                                                      • SHA256 4325244a7c1b300cd6006c6d4d8ee6335c4b04284b3677748de614d6acfae86d
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      libcrypto-1_1.dll
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\libcrypto-1_1.dll
                                                                                                                                                                                                                      • Size 2.4MB
                                                                                                                                                                                                                      • SHA256 b8453da0de5aefb1b775486cec41011c4877ebd1ffa8089d89bce2ee8e3d5eb5
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      libssl-1_1.dll
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\libssl-1_1.dll
                                                                                                                                                                                                                      • Size 525KB
                                                                                                                                                                                                                      • SHA256 2129c263ad08f415ac40abce658e13327ab5911f59a21767dab56d3167083020
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      swresample-3.dll
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\swresample-3.dll
                                                                                                                                                                                                                      • Size 149KB
                                                                                                                                                                                                                      • SHA256 11771c928aff73893e72de8e01912dbbb8c5d8643f23601545457c96d5b8361f
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      utweb.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe
                                                                                                                                                                                                                      • Size 9.0MB
                                                                                                                                                                                                                      • SHA256 b119f7faae70d72dc9402e4fec2205b13f0cf5dd9ea85db11d80720ee990792d
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      protocols.json
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
                                                                                                                                                                                                                      • Size 3KB
                                                                                                                                                                                                                      • SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      settings.dat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Crashpad\settings.dat
                                                                                                                                                                                                                      • Size 280B
                                                                                                                                                                                                                      • SHA256 f09adcb56ce0f10909bf98051f3a6054611c6fca6b3df86ec3df8f5e80c51819
                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      settings.dat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Crashpad\settings.dat
                                                                                                                                                                                                                      • Size 280B
                                                                                                                                                                                                                      • SHA256 b40c33ab6935a8258c84745ff1d1975c221840807bb52e873cfc7a20e3ef1879
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      throttle_store.dat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
                                                                                                                                                                                                                      • Size 20B
                                                                                                                                                                                                                      • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      f_000007
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000007
                                                                                                                                                                                                                      • Size 107KB
                                                                                                                                                                                                                      • SHA256 c6bf11e8a93a6b136577822bdd9924c4318b2b339ce99eff42a73aaaf3771bc4
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      f_000008
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000008
                                                                                                                                                                                                                      • Size 53KB
                                                                                                                                                                                                                      • SHA256 b03cfd11d9410ad8b7433ee2688f626d3823b1ee4f0032482a8555f9f7733838
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      f_00000e
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_00000e
                                                                                                                                                                                                                      • Size 30KB
                                                                                                                                                                                                                      • SHA256 4a0645fd5873f990610fcb0074e5bbeeee5a861515935b50dbaffdb003b58a28
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      f_000010
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000010
                                                                                                                                                                                                                      • Size 92KB
                                                                                                                                                                                                                      • SHA256 b98bd7bf22bd59d586418d2cb8068ebd0298b9ab5571300091cd4987be0673e5
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      temp-index
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\temp-index
                                                                                                                                                                                                                      • Size 912B
                                                                                                                                                                                                                      • SHA256 fbef6bca9ccfd3730e0b0e2adddc22e836e4a9567dec220b4080d21b3ca544ad
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      the-real-index
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                      • Size 912B
                                                                                                                                                                                                                      • SHA256 6c2d9b32c439fcc1536984547cb2ab2c49f681c6e748e9242de5eda7b1651864
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      the-real-index
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                      • Size 816B
                                                                                                                                                                                                                      • SHA256 c51f2def8bc6e5164e50e208f5a564e9ca08b9b99b66d29c59f9cb917f4327bc
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      the-real-index
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                      • Size 888B
                                                                                                                                                                                                                      • SHA256 6676c1dfd683077353e95c9af3387a583b996be4f2327fe23476c4e247032721
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      the-real-index
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                      • Size 720B
                                                                                                                                                                                                                      • SHA256 f73027691f6bbeb589d598fd6e428905fe567ce801019ed6d9e04860798644f2
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      the-real-index
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                      • Size 912B
                                                                                                                                                                                                                      • SHA256 6c0a891e1b68f0401897010332c9bf4820a5f946bbb88c4fbca3609265b1e961
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      the-real-index
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                      • Size 936B
                                                                                                                                                                                                                      • SHA256 9ac3fe260e2d1d74612c2e35920e04af303ce18ebec43c44e050534003371084
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      the-real-index
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                      • Size 888B
                                                                                                                                                                                                                      • SHA256 89b4023b52cc37fc8e6fded13ab282f2547c952478d69c7fcf38fcd19be2797c
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      the-real-index~RFe59d99d.TMP
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59d99d.TMP
                                                                                                                                                                                                                      • Size 48B
                                                                                                                                                                                                                      • SHA256 615bd13196c628a9655a29e3844e551f176ac5b40dfc263ac0c95a498af7e4c5
                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      data_0
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_0
                                                                                                                                                                                                                      • Size 8KB
                                                                                                                                                                                                                      • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      data_1
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_1
                                                                                                                                                                                                                      • Size 264KB
                                                                                                                                                                                                                      • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      data_2
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_2
                                                                                                                                                                                                                      • Size 8KB
                                                                                                                                                                                                                      • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      data_3
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_3
                                                                                                                                                                                                                      • Size 8KB
                                                                                                                                                                                                                      • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      CURRENT
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Default\Extension Rules\CURRENT
                                                                                                                                                                                                                      • Size 16B
                                                                                                                                                                                                                      • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      MANIFEST-000001
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
                                                                                                                                                                                                                      • Size 41B
                                                                                                                                                                                                                      • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Network Persistent State
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Default\Network\Network Persistent State
                                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                                      • SHA256 7f138dabaf11805ed36af437d97a35f9e0d99b1a6603439d9dcaca10a3f3c764
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Network Persistent State~RFe5a7783.TMP
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Default\Network\Network Persistent State~RFe5a7783.TMP
                                                                                                                                                                                                                      • Size 59B
                                                                                                                                                                                                                      • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      TransportSecurity
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                      • Size 685B
                                                                                                                                                                                                                      • SHA256 5dd3d08937de471788a1f45ae35f4b9220725294578891b23693516ecdb58502
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      TransportSecurity
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                      • Size 685B
                                                                                                                                                                                                                      • SHA256 0eb9cd422c59543528cab25bab7d6cbef9f3600202dff856fe0c9051e6a7d3b2
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      TransportSecurity
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                      • Size 685B
                                                                                                                                                                                                                      • SHA256 e772220c9f0933344435a62a481c3441bf5b1bd3ec16b29910abe73bfacff233
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      TransportSecurity
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                      • Size 685B
                                                                                                                                                                                                                      • SHA256 6f8e830e3846c8513a5342af130cb718a9d0c56f61f749e546863efaa05fed92
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      TransportSecurity
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                      • Size 685B
                                                                                                                                                                                                                      • SHA256 f39ed1e5f2898b29107387c2e072886370a22c17c9ee5adade23ccb313661532
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      TransportSecurity
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                      • Size 685B
                                                                                                                                                                                                                      • SHA256 4e7a38f7709b6ff821d31b1a655c57189cbfe539d37aa53c020389ac277abc5f
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      TransportSecurity
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                      • Size 685B
                                                                                                                                                                                                                      • SHA256 5b58177e231058a7bc71695bd95f883f4c2b2342ccaa45ae74f04484e6299899
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      TransportSecurity
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                      • Size 683B
                                                                                                                                                                                                                      • SHA256 7f1c600af9b5f083ed886411593cb9e9b8afe884929dd2303d178ecf462abeb4
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      TransportSecurity
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                      • Size 681B
                                                                                                                                                                                                                      • SHA256 8e8b25c00ad63e2fe167d3804aefaa0f99facfaf3d4cfd6f45f9a245e2751b2a
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      TransportSecurity
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                      • Size 685B
                                                                                                                                                                                                                      • SHA256 8ce542f31ac12826ee034c82404855a0abca9cc4a00a4cee81abffbb460a9c95
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      TransportSecurity
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                      • Size 685B
                                                                                                                                                                                                                      • SHA256 3ae9d97298dc6e811218fe56882cab11dc255d3cb8329ecf41af5b3751165dee
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      TransportSecurity
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                      • Size 685B
                                                                                                                                                                                                                      • SHA256 d77e95de49bef0e3cd538ffa6bbe0257bb1b848f5ce26e3c4493d43695ad2b04
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      TransportSecurity~RFe5a1231.TMP
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Default\Network\TransportSecurity~RFe5a1231.TMP
                                                                                                                                                                                                                      • Size 681B
                                                                                                                                                                                                                      • SHA256 1a40545ee61f45199476d58485bf7b2a78c42c0318a473b295df2bdb3187f1e3
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      ef2b1f0c-e4cf-4aa1-90d5-97ea6cd95609.tmp
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Default\Network\ef2b1f0c-e4cf-4aa1-90d5-97ea6cd95609.tmp
                                                                                                                                                                                                                      • Size 685B
                                                                                                                                                                                                                      • SHA256 b39615f0e0c9712a14a6030302a9c04924b0c69e90c3761cef6d2a277013b8ed
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Preferences
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Default\Preferences
                                                                                                                                                                                                                      • Size 7KB
                                                                                                                                                                                                                      • SHA256 d7ec0b8f1ead040e6cdad2ef5f95daea6c0330c28b5c92f012f365b29394a619
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Preferences~RFe59ff07.TMP
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Default\Preferences~RFe59ff07.TMP
                                                                                                                                                                                                                      • Size 7KB
                                                                                                                                                                                                                      • SHA256 9d24bf2ff3241aa7c6c21140569e13d690bef4b3eac83512b3fc2cb1c3a59dc8
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Local State
                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                      • SHA256 8f47eefaf49737512b142763e49fd783ad6889d4af1d4a57736d017326d92254
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Local State
                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                      • SHA256 d18c84c189d33ed4b2baa4aed4cb4c39806bb7a866f4ff531019803f65cca8ca
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Local State
                                                                                                                                                                                                                      • Size 17KB
                                                                                                                                                                                                                      • SHA256 d2158fd16e4bea2e90d29ed181e62ab2bc7ee36c4edc9a54f9b30a52c1a08cdf
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Local State
                                                                                                                                                                                                                      • Size 17KB
                                                                                                                                                                                                                      • SHA256 b9b954318eff1dd207ae9c7738bdf4272a6285eca75670899aa72ac9ce8317d1
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Local State
                                                                                                                                                                                                                      • Size 17KB
                                                                                                                                                                                                                      • SHA256 ea64d4b0caf8848887d66c350e3b2f2af248674fc9ac8cc40b65bcfe4bda5137
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Local State
                                                                                                                                                                                                                      • Size 17KB
                                                                                                                                                                                                                      • SHA256 a26bd16620f633b92a62e9111b3992e0f04160d43e52abfc29b8c149391db79d
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Local State
                                                                                                                                                                                                                      • Size 16KB
                                                                                                                                                                                                                      • SHA256 a4a45336147078354fa9f52b25a96a950dc92224551c0e909363a639883e5686
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Local State
                                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                                      • SHA256 054d8fe3afa5019cad563f94e58860d0de9c5cfe08f6cdfef30229bf23df7860
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Local State
                                                                                                                                                                                                                      • Size 3KB
                                                                                                                                                                                                                      • SHA256 6676c890cf9d3307eef46122e97021cc1db743e7f4826fdce7654d39d16a4ef2
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Local State
                                                                                                                                                                                                                      • Size 17KB
                                                                                                                                                                                                                      • SHA256 e6a5452e03b7de9afd814358dbe43ca8c5ba65ae4340e1005d7c6801588452a9
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Filtering Rules
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
                                                                                                                                                                                                                      • Size 2.1MB
                                                                                                                                                                                                                      • SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      LICENSE
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe.WebView2\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.84\LICENSE
                                                                                                                                                                                                                      • Size 24KB
                                                                                                                                                                                                                      • SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      utweb_installer.exe.crdownload
                                                                                                                                                                                                                      • Path C:\Users\Admin\Downloads\utweb_installer.exe.crdownload
                                                                                                                                                                                                                      • Size 2.1MB
                                                                                                                                                                                                                      • SHA256 30491226a2107d63c675f1fe93595974622085f391aade2af15ba9e8a6a17978
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      WinZip Duplicate File Finder.lnk
                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\WinZip Duplicate File Finder.lnk
                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                      • SHA256 7da8cc08dac9b26ccb9fce383cf8154250c4cd64dce5f5c3178fb1b2a7005ea2
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      WinZip Duplicate File Finder.lnk~RFe5ae60c.TMP
                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\WinZip Duplicate File Finder.lnk~RFe5ae60c.TMP
                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                      • SHA256 90799a7308ab2604f3f0a7767de4c505716b5159be890d4cffe47c692e0379f2
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      WinZip Image Manager.lnk
                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\WinZip Image Manager.lnk
                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                      • SHA256 991c846802d516d6d0936eb8b93a5b9e56a5c3af0dcb13c5f6dc1831eff86c9b
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      WinZip Image Manager.lnk~RFe5ae62b.TMP
                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\WinZip Image Manager.lnk~RFe5ae62b.TMP
                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                      • SHA256 a774f6602c7b151edabbb16ed0da26135fc370faa24cc807e9112e2f42492ae5
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      WinZip PDF Express.lnk
                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\WinZip PDF Express.lnk
                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                      • SHA256 3ce54a73ce1d97b672f48535879e3d2e681e5d531a1f83252a5a6d4e302c50ec
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      WinZip PDF Express.lnk~RFe5ae63b.TMP
                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\WinZip PDF Express.lnk~RFe5ae63b.TMP
                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                      • SHA256 9408987f7b9afa6740f4a63215fcc022dc272888772afa76f9ca3267c16ba3c6
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      WinZip SafeShare.lnk
                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\WinZip SafeShare.lnk
                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                      • SHA256 a744396f83800021055a1d96b6dfa95438a3584c87e68b88a74b49a90ad3c012
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      WinZip SafeShare.lnk~RFe5ae64a.TMP
                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\WinZip SafeShare.lnk~RFe5ae64a.TMP
                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                      • SHA256 cef60d6adbf3ffdb0b4b63dccec629fc958ed493df3777b07c8ef5973fa5dca9
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      WinZip Secure Backup.lnk
                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\WinZip Secure Backup.lnk
                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                      • SHA256 0410c4d9acdc2738dade8b45fd57390a48ac69cfecc83c88f3d508bfd0414492
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      WinZip Secure Backup.lnk~RFe5ae679.TMP
                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\WinZip Secure Backup.lnk~RFe5ae679.TMP
                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                      • SHA256 5366906371faee7fc16e36360852196148a57dedc7206d71e663fe2563553568
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      WinZip.lnk
                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\WinZip.lnk
                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                      • SHA256 6f9945af4cce822473ff619f5c970ea6b4e9934c387a154502bc4b35e915766d
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      WinZip.lnk~RFe5ae5dd.TMP
                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\WinZip.lnk~RFe5ae5dd.TMP
                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                      • SHA256 c1876649c8ef204e8b9cadd2df043f008240e82ef44671e9456ceab92ee8b154
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      MSIB347.tmp
                                                                                                                                                                                                                      • Path C:\Windows\Installer\MSIB347.tmp
                                                                                                                                                                                                                      • Size 2.0MB
                                                                                                                                                                                                                      • SHA256 a684397d0db383d7617e6ef2ccb665a9f538bae47db21968fdea1b2da5240512
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      DupFFStub64_Shortcut_Desktop.ico
                                                                                                                                                                                                                      • Path C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C24165}\DupFFStub64_Shortcut_Desktop.ico
                                                                                                                                                                                                                      • Size 56KB
                                                                                                                                                                                                                      • SHA256 eb33603fa37bbc75e0776f7ffeaf764305eb30ecb5450d8b45817b9f14f82b35
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      ImgUtilStub64_Shortcut_Desktop.ico
                                                                                                                                                                                                                      • Path C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C24165}\ImgUtilStub64_Shortcut_Desktop.ico
                                                                                                                                                                                                                      • Size 324KB
                                                                                                                                                                                                                      • SHA256 79fd5df4a1cf8f37e59a117cd3817113bf034254e13694aa4e5e368906c17f01
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      PdfUtilStub64_Shortcut_Desktop.ico
                                                                                                                                                                                                                      • Path C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C24165}\PdfUtilStub64_Shortcut_Desktop.ico
                                                                                                                                                                                                                      • Size 324KB
                                                                                                                                                                                                                      • SHA256 acf0866620907436400bbf2233410eb7351becf50d50b4326e03f0656317b1e4
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      SafeShareStub64_Shortcut_Desktop.ico
                                                                                                                                                                                                                      • Path C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C24165}\SafeShareStub64_Shortcut_Desktop.ico
                                                                                                                                                                                                                      • Size 332KB
                                                                                                                                                                                                                      • SHA256 51a1e6ea9df9873c0c67b0ddbeb992b56c062fbde4a7f97c1e5bfea237689165
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      SbkupStub64_ShortCut_StartMenu.ico
                                                                                                                                                                                                                      • Path C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C24165}\SbkupStub64_ShortCut_StartMenu.ico
                                                                                                                                                                                                                      • Size 324KB
                                                                                                                                                                                                                      • SHA256 96182d08fd482e4482a55814c6f4a6e03656153eeeec5fde4a13dd4157ede4ac
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      WinZip64_Shortcut_MenuGroup.ico
                                                                                                                                                                                                                      • Path C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C24165}\WinZip64_Shortcut_MenuGroup.ico
                                                                                                                                                                                                                      • Size 140KB
                                                                                                                                                                                                                      • SHA256 622db5c22cc304abb82d01f8d2b582bb70a56811f5c228b94bb265126196be15
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      manifest.json
                                                                                                                                                                                                                      • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5996_1961095402\manifest.json
                                                                                                                                                                                                                      • Size 76B
                                                                                                                                                                                                                      • SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      manifest.json
                                                                                                                                                                                                                      • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5996_417891183\manifest.json
                                                                                                                                                                                                                      • Size 43B
                                                                                                                                                                                                                      • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      crl-set
                                                                                                                                                                                                                      • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5996_423108036\crl-set
                                                                                                                                                                                                                      • Size 22KB
                                                                                                                                                                                                                      • SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      manifest.json
                                                                                                                                                                                                                      • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5996_423108036\manifest.json
                                                                                                                                                                                                                      • Size 113B
                                                                                                                                                                                                                      • SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      hyph-as.hyb
                                                                                                                                                                                                                      • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5996_520058830\hyph-as.hyb
                                                                                                                                                                                                                      • Size 703B
                                                                                                                                                                                                                      • SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      hyph-hi.hyb
                                                                                                                                                                                                                      • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5996_520058830\hyph-hi.hyb
                                                                                                                                                                                                                      • Size 687B
                                                                                                                                                                                                                      • SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      hyph-nb.hyb
                                                                                                                                                                                                                      • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5996_520058830\hyph-nb.hyb
                                                                                                                                                                                                                      • Size 141KB
                                                                                                                                                                                                                      • SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      manifest.json
                                                                                                                                                                                                                      • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5996_520058830\manifest.json
                                                                                                                                                                                                                      • Size 82B
                                                                                                                                                                                                                      • SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      manifest.json
                                                                                                                                                                                                                      • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5996_616544762\manifest.json
                                                                                                                                                                                                                      • Size 116B
                                                                                                                                                                                                                      • SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      manifest.json
                                                                                                                                                                                                                      • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5996_686379325\manifest.json
                                                                                                                                                                                                                      • Size 135B
                                                                                                                                                                                                                      • SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      memory/220-1885-0x00000000005A0000-0x0000000000686000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/220-1735-0x00000000005A0000-0x0000000000686000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/220-1677-0x00000000005A0000-0x0000000000686000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/1240-4765-0x000001BEB4350000-0x000001BEB435C000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3164-4694-0x0000000004E80000-0x0000000004E81000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3164-4376-0x00007FFA13B70000-0x00007FFA13B72000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3164-4695-0x0000000004E90000-0x0000000004E91000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3164-4377-0x00007FFA13BD0000-0x00007FFA13BE0000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3164-4984-0x0000000003AE0000-0x0000000003AE1000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3164-6526-0x0000000000940000-0x0000000000941000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4520-2085-0x00007FFA13B10000-0x00007FFA13B11000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4608-1914-0x00007FFA13B10000-0x00007FFA13B11000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5548-4757-0x000001431B580000-0x000001431B58E000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5916-1720-0x0000000003270000-0x00000000033B0000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5916-1884-0x00000000006F0000-0x0000000000B30000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5916-1736-0x00000000006F0000-0x0000000000B30000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/6424-4357-0x00007FF9F62F0000-0x00007FF9F630E000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/6424-4363-0x000001E0D3ED0000-0x000001E0D3F08000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/6424-4367-0x000001E0D3EC0000-0x000001E0D3EC8000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/6424-4329-0x000001D8B6D80000-0x000001D8B6DC7000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/6424-4330-0x00007FF9F1410000-0x00007FF9F1457000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/6424-4362-0x000001E0D3E80000-0x000001E0D3E8E000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/6424-4331-0x000001D8B6D00000-0x000001D8B6D0C000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/6424-4332-0x000001D8B6D30000-0x000001D8B6D44000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/6424-4333-0x000001D8CF880000-0x000001D8CF912000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/6424-4359-0x000001D8D0210000-0x000001D8D03FE000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/6424-4356-0x000001D8D0000000-0x000001D8D001E000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/6532-4327-0x0000019DB1210000-0x0000019DB1232000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/6752-6570-0x000002B7FE9B0000-0x000002B7FEAB0000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/6752-6649-0x000002AFB31E0000-0x000002AFB3200000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/6752-6650-0x000002AFB3040000-0x000002AFB3060000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/6752-6722-0x000002AFB4920000-0x000002AFB4A20000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/6896-4445-0x0000026CE41B0000-0x0000026CE4220000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/6896-4487-0x0000026CE6090000-0x0000026CE60E4000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/6896-4486-0x0000026CE5FB0000-0x0000026CE5FDE000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4410-0x00000277A9E20000-0x00000277A9E94000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4381-0x00000277A97C0000-0x00000277A9823000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4338-0x00007FF9F8B80000-0x00007FF9F8BA4000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4339-0x00000277A8D80000-0x00000277A8E88000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4337-0x0000027790250000-0x0000027790274000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4342-0x00000277905D0000-0x000002779062A000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4347-0x00007FF9F1320000-0x00007FF9F1344000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4346-0x0000027790660000-0x0000027790684000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4350-0x00000277A8F90000-0x00000277A8FB4000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4351-0x00007FF9EDF10000-0x00007FF9EDF34000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4349-0x00007FF9EDF40000-0x00007FF9EDF7A000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4361-0x00000277A9080000-0x00000277A90EF000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4352-0x00000277A91E0000-0x00000277A93A2000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4348-0x00000277A8FD0000-0x00000277A900A000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4364-0x00000277AAB00000-0x00000277AC24A000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4365-0x00000277A90F0000-0x00000277A915F000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4366-0x00000277A9160000-0x00000277A91CF000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4368-0x00000277A9520000-0x00000277A958F000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4370-0x00000277A9600000-0x00000277A9666000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4369-0x00000277A9590000-0x00000277A95FF000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4374-0x00000277A96E0000-0x00000277A9743000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4373-0x00000277A9670000-0x00000277A96D3000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4378-0x00000277A9750000-0x00000277A97B3000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4383-0x00000277A98A0000-0x00000277A9903000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4384-0x00000277A9910000-0x00000277A997F000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4386-0x00007FF9EB840000-0x00007FF9EB88D000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4390-0x00000277A99D0000-0x00000277A9A3E000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4391-0x00000277A9B10000-0x00000277A9B60000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4389-0x00000277A9EE0000-0x00000277AA2A8000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4388-0x00007FF9E0950000-0x00007FF9E09E3000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4387-0x00000277A9A70000-0x00000277A9B03000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4385-0x00000277A9980000-0x00000277A99CD000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4401-0x00000277A9830000-0x00000277A9842000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4402-0x00000277A9BD0000-0x00000277A9C3F000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4404-0x00007FF9EAE60000-0x00007FF9EAEAD000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4403-0x00000277A9B60000-0x00000277A9BAD000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4406-0x00000277A9DA0000-0x00000277A9E11000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4407-0x00007FF9E04A0000-0x00007FF9E0511000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4409-0x00007FF9E03F0000-0x00007FF9E04A0000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4408-0x00000277AA2B0000-0x00000277AA360000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4405-0x00000277A9CB0000-0x00000277A9D1F000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4413-0x00007FF9FA3A0000-0x00007FF9FA3BC000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4414-0x00000277A9D20000-0x00000277A9D8A000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4412-0x00000277A9A40000-0x00000277A9A5C000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4415-0x00000277AA4B0000-0x00000277AA4EA000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7148-4416-0x00000277A9C80000-0x00000277A9CA6000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7180-4761-0x000002C433DE0000-0x000002C433DF2000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7200-4799-0x0000000005F50000-0x000000000637A000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7200-4804-0x00000000065A0000-0x00000000065BE000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7200-4803-0x00000000066D0000-0x0000000006706000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7200-4802-0x0000000005ED0000-0x0000000005EDA000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7200-4801-0x0000000006380000-0x0000000006412000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7200-4800-0x0000000006930000-0x0000000006ED6000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7260-4982-0x00007FF9F15B0000-0x00007FF9F15D4000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7312-4953-0x00007FFA04210000-0x00007FFA04257000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7312-4975-0x00007FF9F1390000-0x00007FF9F13B4000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7312-4980-0x00007FF9EE0D0000-0x00007FF9EE0F4000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7312-4957-0x0000024534460000-0x00000245345AB000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7312-4971-0x0000024534C50000-0x0000024534C74000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7312-4972-0x00007FF9F15B0000-0x00007FF9F15D4000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7312-4974-0x00000245355E0000-0x0000024535604000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7312-4952-0x000002451ADF0000-0x000002451AE37000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7312-4977-0x00000245357D0000-0x000002453580A000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7312-4978-0x00007FF9EE100000-0x00007FF9EE13A000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7312-4979-0x0000024535810000-0x0000024535834000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7312-4981-0x00000245358A0000-0x00000245358F8000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7312-4958-0x00007FF9F13C0000-0x00007FF9F150B000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7312-4970-0x0000024534DA0000-0x0000024534E0F000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7340-4737-0x000001E454CE0000-0x000001E454D76000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7340-4736-0x000001E43A620000-0x000001E43A630000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7388-4809-0x0000000006320000-0x0000000006334000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7388-4807-0x0000000006B30000-0x0000000006D18000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7388-4808-0x0000000006D20000-0x0000000006F2A000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7420-4741-0x000001F9BE970000-0x000001F9BE97E000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7520-4745-0x000001F871A20000-0x000001F871A36000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7564-4749-0x0000020CB9C10000-0x0000020CB9C5E000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/7648-4753-0x00000163FFA00000-0x00000163FFA4E000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/8008-4781-0x000001E8A6BE0000-0x000001E8A6E18000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/8008-4779-0x000001E88C400000-0x000001E88C43C000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/8068-4916-0x00000203B6160000-0x00000203B6161000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/8068-4906-0x00000203B6160000-0x00000203B6161000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/8068-4908-0x00000203B6160000-0x00000203B6161000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/8068-4907-0x00000203B6160000-0x00000203B6161000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/8068-4918-0x00000203B6160000-0x00000203B6161000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/8068-4917-0x00000203B6160000-0x00000203B6161000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/8068-4915-0x00000203B6160000-0x00000203B6161000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/8068-4912-0x00000203B6160000-0x00000203B6161000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/8068-4913-0x00000203B6160000-0x00000203B6161000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/8068-4914-0x00000203B6160000-0x00000203B6161000-memory.dmp
                                                                                                                                                                                                                      Download