hxxps://www[.]skylink[.]in/apkfile/skyplaytv[.]apk?_rsc=vk1uj

Analysis

user interaction
yes
max time kernel
144s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 07:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.skylink.in/apkfile/skyplaytv.apk?_rsc=vk1uj
Sample260807-jt7vbsef89

Score

6^/10

adware discovery spyware

Malware Config

Signatures

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5612	5812	WerFault.exe	123

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2400	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 17 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "677"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{1E5D6265-9236-11F1-B03F-4A126A0DFDD7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305631349440597"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{72D76700-2C28-4EE8-96EE-253AD9DC4190}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5880	msedge.exe
5880	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5260	OpenWith.exe
5736	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5812	wmplayer.exe
Token: SeCreatePagefilePrivilege	5812	wmplayer.exe
Token: SeShutdownPrivilege	5984	unregmp2.exe
Token: SeCreatePagefilePrivilege	5984	unregmp2.exe
Token: SeRestorePrivilege	3068	7zG.exe
Token: 35	3068	7zG.exe
Token: SeSecurityPrivilege	3068	7zG.exe
Token: SeSecurityPrivilege	3068	7zG.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
5812	wmplayer.exe
3068	7zG.exe
3352	iexplore.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4468	OpenWith.exe
1544	OpenWith.exe
5260	OpenWith.exe
5260	OpenWith.exe
5260	OpenWith.exe
5260	OpenWith.exe
5260	OpenWith.exe
5260	OpenWith.exe
5260	OpenWith.exe
5260	OpenWith.exe
5260	OpenWith.exe
5260	OpenWith.exe
5260	OpenWith.exe
5260	OpenWith.exe
5260	OpenWith.exe
5260	OpenWith.exe
5260	OpenWith.exe
5260	OpenWith.exe
5260	OpenWith.exe
5260	OpenWith.exe
5260	OpenWith.exe
5260	OpenWith.exe
5260	OpenWith.exe
5260	OpenWith.exe
5260	OpenWith.exe
5260	OpenWith.exe
5260	OpenWith.exe
5260	OpenWith.exe
5260	OpenWith.exe
5768	OpenWith.exe
6016	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 2308	4604	msedge.exe	83
PID 4604 wrote to memory of 2400	4604	msedge.exe	85
PID 4604 wrote to memory of 2284	4604	msedge.exe	86
PID 4604 wrote to memory of 2284	4604	msedge.exe	86
PID 4604 wrote to memory of 2284	4604	msedge.exe	86
PID 4604 wrote to memory of 3624	4604	msedge.exe	87
PID 4604 wrote to memory of 3624	4604	msedge.exe	87
PID 4604 wrote to memory of 464	4604	msedge.exe	89
PID 4604 wrote to memory of 464	4604	msedge.exe	89
PID 4604 wrote to memory of 464	4604	msedge.exe	89
PID 4604 wrote to memory of 1628	4604	msedge.exe	88
PID 4604 wrote to memory of 1628	4604	msedge.exe	88
PID 4604 wrote to memory of 1628	4604	msedge.exe	88
PID 4604 wrote to memory of 956	4604	msedge.exe	90
PID 4604 wrote to memory of 956	4604	msedge.exe	90
PID 4604 wrote to memory of 956	4604	msedge.exe	90
PID 4604 wrote to memory of 564	4604	msedge.exe	91
PID 4604 wrote to memory of 564	4604	msedge.exe	91
PID 4604 wrote to memory of 564	4604	msedge.exe	91
PID 4604 wrote to memory of 3140	4604	msedge.exe	94
PID 4604 wrote to memory of 3140	4604	msedge.exe	94
PID 4604 wrote to memory of 1860	4604	msedge.exe	95
PID 4604 wrote to memory of 1860	4604	msedge.exe	95
PID 4604 wrote to memory of 3944	4604	msedge.exe	97
PID 4604 wrote to memory of 5044	4604	msedge.exe	96
PID 4604 wrote to memory of 3944	4604	msedge.exe	97
PID 4604 wrote to memory of 3944	4604	msedge.exe	97
PID 4604 wrote to memory of 5044	4604	msedge.exe	96
PID 4604 wrote to memory of 4624	4604	msedge.exe	100
PID 4604 wrote to memory of 4000	4604	msedge.exe	101
PID 4604 wrote to memory of 5648	4604	msedge.exe	120
PID 4604 wrote to memory of 5656	4604	msedge.exe	121
PID 4604 wrote to memory of 5664	4604	msedge.exe	122
PID 5260 wrote to memory of 5812	5260	OpenWith.exe	123
PID 5812 wrote to memory of 5944	5812	wmplayer.exe	126
PID 5944 wrote to memory of 5984	5944	unregmp2.exe	127
PID 4604 wrote to memory of 5800	4604	msedge.exe	134
PID 4604 wrote to memory of 5800	4604	msedge.exe	134
PID 4604 wrote to memory of 5880	4604	msedge.exe	142
PID 5736 wrote to memory of 3352	5736	OpenWith.exe	143
PID 3352 wrote to memory of 3460	3352	iexplore.exe	144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.skylink.in/apkfile/skyplaytv.apk?_rsc=vk1uj
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb70f2c188,0x7ffb70f2c194,0x7ffb70f2c1a0
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,14231880962485989530,1450434035291422515,524288 --field-trial-handle=2404,i,16524555268624217813,16223049265327848535,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1796,i,2417682692755099036,17356865499241305761,262144 --field-trial-handle=2404,i,16524555268624217813,16223049265327848535,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:2
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,10127633824619447895,14871838991991351345,524288 --field-trial-handle=2404,i,16524555268624217813,16223049265327848535,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,1847787070421986734,6222009698445166676,2097152 --field-trial-handle=2404,i,16524555268624217813,16223049265327848535,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,13280601194984467528,10398410267107893591,2097152 --field-trial-handle=2404,i,16524555268624217813,16223049265327848535,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,3079467408556308613,3716736366855232951,2097152 --field-trial-handle=2404,i,16524555268624217813,16223049265327848535,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,12835209339916058540,18107060165936008112,2097152 --field-trial-handle=2404,i,16524555268624217813,16223049265327848535,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3492,i,11324172353708332932,1858679664677229280,524288 --field-trial-handle=2404,i,16524555268624217813,16223049265327848535,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,17978950871751868844,13510444953949457012,524288 --field-trial-handle=2404,i,16524555268624217813,16223049265327848535,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,9167643860015596445,13650483035281001090,524288 --field-trial-handle=2404,i,16524555268624217813,16223049265327848535,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5680,i,4654063152427092085,1333377536621527610,2097152 --field-trial-handle=2404,i,16524555268624217813,16223049265327848535,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,15187334116239549991,830688604724613955,524288 --field-trial-handle=2404,i,16524555268624217813,16223049265327848535,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:8
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,15187334116239549991,830688604724613955,524288 --field-trial-handle=2404,i,16524555268624217813,16223049265327848535,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,8753612457454097655,4097074693765857942,524288 --field-trial-handle=2404,i,16524555268624217813,16223049265327848535,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:8
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,16701057908681552837,7080170483336790807,524288 --field-trial-handle=2404,i,16524555268624217813,16223049265327848535,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:8
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3456,i,1563930332518975009,11321951209932701886,524288 --field-trial-handle=2404,i,16524555268624217813,16223049265327848535,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:8
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,17100763733947957983,14382815509261929717,524288 --field-trial-handle=2404,i,16524555268624217813,16223049265327848535,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:8
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,12715546371889594740,4986553246456035852,524288 --field-trial-handle=2404,i,16524555268624217813,16223049265327848535,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5400,i,10210460262421109248,732447886806957886,262144 --field-trial-handle=2404,i,16524555268624217813,16223049265327848535,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5880

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3160

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4468

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1544

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4704

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5260
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play "C:\Users\Admin\Downloads\skyplaytv.apk"
  2⤵
  - Drops desktop.ini file(s)
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5812
- - C:\Windows\SysWOW64\unregmp2.exe
    "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5944
  - - C:\Windows\system32\unregmp2.exe
      "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
      4⤵
      Enumerates connected drives
      Suspicious use of AdjustPrivilegeToken
      PID:5984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5812 -s 1140
    3⤵
    - Program crash
    PID:5612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:5192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5812 -ip 5812
1⤵
PID:5320

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap19358:80:7zEvent3268
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3068

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5768

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6016

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5736
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\META-INF\services\m6.q
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3352 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    PID:3460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 05210635590ecfe61f0ff004344f0d07b5a87e284e29db76f0bd61e97f43da5d
MD5 f3021567e2b276da7e7b2413e95d0918
SHA1 2925767ee01df1ce973aad0d342ba0f82a41cd81
SHA512 5b21fac88299defcd3a29d897631cfc4c2389199b22dd9059a42d23770fa290b889a287add6c819d88e1fd4c377eaeb1334a84e81ea1e94cb895145f971870b3
TLSH
T1D1D09B207A48F441C745017195059F553B2654542057D90AE165585D6CA519493D9682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec09ba5da501666cac506a8e17a37a0b19f2d9712ad11c5ba4ad14b3ce62e7db
MD5 e1404f4875306f456785e26a92aed547
SHA1 053db7b2ab0b6a59f2b44973d8f1751505d230ac
SHA512 a6ccf97239d40b1773848dd7f6ee31e91a3f8b90e05f43c6d7b13ead4ba9896a88cb2a9ebb06880b10b5223c52e29e192ba9e6e80528cece8415c817c164e52c
TLSH
T137D09B203A88F441CB45017195049F553B2654542057DA0BE165585D5CA51D493D9682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c5ae6cb19fe27722c6e0ddf8d7e417267fb7416cfd97d270eb6c2157392ea254
MD5 be73c48a8e7cecf0cb1c53f2ae98aca8
SHA1 f029dccca54b45ab6bc70573dd5d6646ae7e3824
SHA512 bfc10ecd4a1cfd0e0ded79684d94cb3c530d4ce9eea96efa0d99e48f84a8c3dde26f2a0bbe2bcb186342366e059a7b3a201a08a12d190c9b20ea4218bfd25a89
TLSH
T1BE61D7380A12B89DF7311373F6D03BFD37F251A94D5B5ED951A018BE158BF328656418
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a95a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a95a.TMP
Size 3KB
SHA256 94d48c9047a6f383b5cf4428a1698c92819971c941a8854073b9e23d247429f2
MD5 57cc2e344050c18e59c2554ce2b1b9a5
SHA1 dffe0d940ec0e08a288193a2ec79f0936abc237f
SHA512 f668c53b6acb10cb9093499074151862873bfea61cccc7d715003798805656fb299f98b3deafe44587132d8c8b87c9ebfdeb5a9ba73047e33dd45c116e0e5883
TLSH
T1D961C6380A12B89DF3311373F6E03BFD37F251A94D5B5ED961A018BE158BF328656418
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 541389be71655f8c4da0d0bb940677d60f2a8fd177799566b97abb40635d4007
MD5 4db19e374688ae1e02e60d1dc76bf117
SHA1 3b5ae0bce868452754cf5e460f7d77d8c53c2021
SHA512 835646101e5578531344af7153d31ae4b4a4395203c6c5720c6c82e95cf62d16108b39c812e78f1883f81884733e6649e661506d33ccf12d6d7bf54e2c441e4f
TLSH
T163219EB3C7D5826DC91166F0AA24AE2BCE1D0619431D3C19C9D5FF2BA3E2075E10165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 fca79cf341bb80888d291fd2e1f449def53ee92146acaea3823827411352ceaf
MD5 99ef974cf4ac91bcc715de3fd9bcf448
SHA1 299a11e73e0d7f314816a91b99a8b02a2a89ed7c
SHA512 74c0acffa6f366b04821f037a8494d91b1d19c6ec93d8622c561c80c796149093a0f2dbb0fc77fcf565d05fa899692e8c8104dab44f442713fa89e6ede99869a
SSDEEP 192:sxZDR8yM/jK1Ml8M9d/f9+sDdlTIdpJHW6+WNGYLlwhtzIgrJ:sxZDC1d/fssDdlMJHbGV9
TLSH
T19E42F711AB346977CCCBD209BA457F53D6F95473A2900E48A9FCCA1C00E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 652c3b0f4ef6f3c2d873d8f7fd93a2d64fba6e128323dc096e6e0100e7a4c917
MD5 1a59f7f9120bdd9cf11f550dac3deb1c
SHA1 3b9af14c4e00ed54f5ad6d78aaa270b5f08cf458
SHA512 f6d35e7e966498ccf4cde0b3707b8be9267e5b5acb3ea4c157847c1210baad6c339079f67ec067c4eb4506c11fccbf23e9885866464a649157a6e4b628c830b1
SSDEEP 192:sxZDR8yM/jK1Ml8UQD9d/f9+sDdaTIdpLHW6+WNGYLSuttzIg5QJ:sxZDCqxd/fssDdaMLHbGSG
TLSH
T1A852F811AA345977CCCBD20DB951BF53E6F95573A2900E44AAFCDA1C00E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6fb0941bad4501d6be0883eb4907c4cb60312349501d599b255557c7682dcb70
MD5 a3c65504a0061fdd199f86d7bbc68211
SHA1 f5c29fec4d411ce05772595d6bac02e2f86c485b
SHA512 4db4fdbbf39aa55f9378f269b3132855ec95b355551796dfab907807a887596999858d700608a356ce82aab3ec4f5583223c22c9feab6969f0220550c962cdc1
SSDEEP 768:uUs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJN9roiM:uUs6pD1WvxzWju1jahILIsN2iM
TLSH
T16AD2EA3B680CCB7E4F841E5CEC2AAF967DD801CBAB98895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 ec4ec7700be0d7676889391a15c04ecd92dbf916468da14a5e45e10593c08e30
MD5 45def978460ae3784af7a234be810cd8
SHA1 5fc9d07f8db856e550c95c5592bf14ab4b5f35b3
SHA512 397c435ddc0667a5fb11c4faf90b4204f5fefb00c8c9100b5812d2b514872c3f56cd0cfa073f07dc280dad0ec1c9a93e12b85c2ae32a1671d8339a21c928d8ef
SSDEEP 192:iiJHohV/lR8hK19XCmbuHPCpxIJLsd57V9GXqW4UIdMpqui1ugF+uZA0Pg:iWHohV/lR8hK19XCmbuHPCpxELsd57PC
TLSH
T1A0E1101235BB47113C3E290C9264972A5782F6A33018ED2F77A811B14EA7E354DFD9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4e1e7ac35c058f6b068422ebde852814f6e9838b768da9ef049e9663639e5490
MD5 c63ea94c6b586ae7358187cd1b5089f8
SHA1 5f467d6bee26d6efd864e107c3415e48723ca86d
SHA512 65a5d8bc283ea55805ad2e59ee59fcf56768aa4fc48dfe7fa9937c713d1c91cb4166000fa7b9754a2b800da3fcb6615e7b5c20ac85f4cd5adc4cab4a48d3238a
SSDEEP 192:qONp6O7+3hQmiUyjlGttb0mO2opgGAfU6:qONp61WGt9nOD52U6
TLSH
T17D02E935AC7C6C779EB2AE45F58737179FA5103BE9962F40D6E81E0C00D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 80a8c0b93ab95276e61b41e11c1b3e5ab47139a38e6aa58e6517e4a47de74b59
MD5 7884643528b9b0584a640a5d088d94a5
SHA1 ba9908a55e770b05d208fa680375a66946406d00
SHA512 6bdd84d2c38061d204936c9eae3b4e25d6b5e0339eb5bbced33f19ca59704c0b82d74ccd179cdc1eb71d92b8c81fa3a50dd3f616d890a22da3068d322035b98f
SSDEEP 192:uKq+xasuheOwQxMPsNoYiQXS87+3vriQmiU1hQl4atb0mO2oazE5LMRqLzf5CFhV:MZcIwsNoLJ3686a9nODaw+Wf5UrzeKDh
TLSH
T1E1928D715C789C367AE2E584F94632078FB89077E2C52B94D5DDBB2D01EB69C230B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 2646e187c7dc57def198c99119f6dc304c0445a73c3e1ba93df4a36f55640436
MD5 86e6bb9fcdb26f04e0a1a74d4baef7b3
SHA1 b155a05405a97d24a59459e477646d45280e6419
SHA512 2751ea3489d7aa865fed4e9ff75583137357d4c48ff1dec816756398a5f22ea40ff2e9d709d2d72c03e9e615c49c1bf27bb99263af5c40afdb9ea20e3e8f66dc
SSDEEP 384:8ZcIMGsNoLJ3686a9nODawvWf5UrzeKDh:qNL7dO2wvWSeG
TLSH
T150928E719C789C327AE2E584F94632078FB89037E2C52B84D5DD7F2D01EB69C230B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 7edd3910c08a8121b83e16648483729ff6f1347ebbea5277f6929d5a961bc2fe
MD5 2f072448c826b24720fa1e58d7bcf76f
SHA1 7dcc54d8dbaac42962d607203552f0e6449aa8d2
SHA512 3657196ec3ffe4c7fdd70b6d5dcdbe3d580e242485de0ebf0f539a16a586eba5e14fb3bc8b5f16a237dd8d92d059b0b6532fd8e67ecc9b8da5d94e73f3a04232
SSDEEP 384:1ZcIMGsNlLJ3L86a9nODawwWf5UrzeKDh:NNf7dO2wwWSeG
TLSH
T1D7928E719C789C327AE2E584F98632078FB89037E2C52B94D5DD7F2D01DB69C230B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 4737509e7d6e1665dade64a4a08d072630a679a59453b5793c4aaa4507cbb79a
MD5 eeda61ede1e69469426d25567ea7224e
SHA1 1ffde6511ee5015ff32209a5c1437fcf12e33a32
SHA512 74295cb42aac2ad2ca3fcf9025cb6b77f96b0bda0f87dcc9060329bf74eeb6940a13898c8fd6293f444ef2e6f3a6f915b389f5571902d7984ea62980ead2c2a0
SSDEEP 384:kZcIM1sNlLJ3b86a9nODaw+Wf5UrzeKDh:CG/7dO2w+WSeG
TLSH
T1F7928E715C789C327AE2E584F98632079FB89037E2C52B94D5DD7B2D01DB69C230B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 9268707aa6b9ca1a7507719648a6e3d726ef19e9c527d31957b24b5c7e4bd37f
MD5 5948ed28b9b7478ce731bba7117756c3
SHA1 bedd36c19a3c47fa51b9ff7d63bf118a353ccc0b
SHA512 5b2d6bd4f26ddd3014ea269fe91fa7e3c76acd7dd27d9fdc15129a7988d33fec56d1dd8b5b877017a4fd9f991c1daa63eac97daf2fa51ea9f6d77a280ba1ed9e
SSDEEP 192:urq+xasuheOwQxMPsNoYlQXS87+3vriQmiU1hQl4atb0mO2oazE5LMRqLzf5CFhV:HZcIwsNoOJ3686a9nODaw+Wf5UrzeKDh
TLSH
T1E7928E715C789C367AE2E584F94632078FB89077E2C52B94D5DD7F2D01EB69C230781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c682acd4ce339fa02ed8c12f2ce6ae0c82777bf6e76accdd17b2ba371851d515
MD5 c07b8a669b57cd2844a906367cebc53e
SHA1 94cdf9be4ab330ae6d8d1870440f60a50a9699f9
SHA512 d7642a83278d73b0c23632787301edb5047e2b937f8d0d7c445371907fd250ade65f1a57b70d2f3fe6f4554c5deb28ab43bc89af6c670cd0c290d46240ed77bb
SSDEEP 192:hONZ6O7+3VQmiUywlmttb0mO2oazEzcNRqLzU6:hONZ61Jmt9nODawIWU6
TLSH
T1CD121A35A87C6C772EE2A584F98732139F654137EA8A2F80D5DC2E1C01EF66C234BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 c162bb30d684f77ebf41ac07ffd4ec0925a607be8ef57f717bb8373ad1e466f9
MD5 3b3ff3df2d79e1dbf4991f6c173a42a0
SHA1 dd73a4a06992aa9070aaa7236f8a06a38139221f
SHA512 ef57f0280f31b03352395083a160874433ea0fc807812a4e1b145142101557f57739af576c05f70a614140a4ab65e8cc96778ce6edff7c532efa0202fb3abc1d
SSDEEP 192:urm+xasuheOwQxMxsNofQXS87+3vriQmiU1hQl4atb0mO2oazE5LMRqLzf5CFh9D:RZcIOsNofJ3686a9nODaw+Wf5UrzeKDh
TLSH
T1E9928E719C789C367AE2E584FD4632078FB89073E2C52B94D5DDBB2D01EB69C230781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

06b86841-efaa-491a-a7e8-498de492dc2d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\06b86841-efaa-491a-a7e8-498de492dc2d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 64KB
SHA256 f1a4a978ce1c4731df1594043135cf58d084fdf129dd1c8e4507c9e06eac5ea8
MD5 987a07b978cfe12e4ce45e513ef86619
SHA1 22eec9a9b2e83ad33bedc59e3205f86590b7d40c
SHA512 39b86540e4d35c84609ef66537b5aa02058e3d4293f902127c7d4eac8ffc65920cb5c69a77552fc085687eed66e38367f83c177046d0ecb8e6d135463cc142aa
SSDEEP 3:Akallkltlsl7pl+e/lls4XplsMlOI1Xlldl0lcNklltlwzl4hR/mll:AN+1E3+e9XplskOI10cAe
TLSH
T1FD539204E3609562C8048377A4EA0B47B331F0690A1AEB1B602A64381C422DA2CA0180
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 e979b788f82c6b33ff00ab6868709d7c0d90435321a86a8be6602089f6b37f2e
MD5 af8181831e63863cea2faf3af9219703
SHA1 9f8e12d21c72c11cd5005632e99bd0ca211ff90b
SHA512 189ef182a954c57f91685b1521283a8e43226e64edbf42c20d46e32b113639d889a3e168ea5b0d30935bd475ba7ebe6aed27bc067dfa1ca21890d5cc55e72e33
SSDEEP 768:x0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaY:XZP2tFP3vqY8bqEM9TaBacg
TLSH
T14E258537D190B0C5CE2CB171E9ED8F09BA23B10B12A052465FF8957E7A533D99D0B1EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalMLS_3.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
Size 68KB
SHA256 fdf15bbe352493340a120d0873b77d9019e96b296d1ec359cacb9c3289e60f86
MD5 046bd77876cd6d5c9657331eca1d015e
SHA1 2ae616f512e53768e911467c9171057874113d29
SHA512 6aa15a39d1466dcc02f8e83f7f9b0c4560d08cc4fbf9bfcb1253d2f47500a8509067226a03f335050ce23e6708b612786c8b39a4a76bfe79f3de9a121584c86f
SSDEEP 96:3d5Ajzoielt2NXtDUMUstL7XtgUMbstXUMlstgOXtZL2t+LXtKtVAtzt:3d5Ajz9VninCna
TLSH
T16E63EF2426E64689F7F72EB169F657231E3B78919E35D20D02146B0E0CB1F18DA30B2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 510cdf1c16968d54d379cf05ff2590818a9b4d4cf29fcb2577f7c716ea5e107c
MD5 ab39961780985725dc2e9bc0933b944e
SHA1 98656dc27ad4a55441167ead9811ccccab0b221c
SHA512 dbd7973588d04ffe7c636dd2554b8ed32bde0ab20f85dc57b9833b74c2d40a44b18d79f92c1a60ba1cf10e45258e65b39077a11e9a02b6363304724963f06392
TLSH
T1FC41F898A6F91144B3B76E569FF6A86D487F78771E06D1AD00110E4E4A23B44CC71737
MD5 SHA1 SHA512 TLSH

Submit Download

WMSDKNS.DTD

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD
Size 498B
SHA256 644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
MD5 90be2701c8112bebc6bd58a7de19846e
SHA1 a95be407036982392e2e684fb9ff6602ecad6f1e
SHA512 d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe
TLSH
T15BF027AD4BE26C59323110903E78A0B0DD05F0B3645B3A6970CE5C7679E7D9C0407FD1
MD5 SHA1 SHA512 TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 dc94403fa75ccdda04ddf2b4f8444d928bd82170512d8cff66ee2ef17069de47
MD5 786dbff3d66afa50488d4178bb5d58d7
SHA1 0266c6c47871e2f7b79e3de587febf1c82556e1b
SHA512 9b4bfee6715151509faed4daa255fe37fc082121ce26ff4ffe45733c8eef4fa70f37d366a690677d4b62326ef418259bda11d32339e2744d7a69b0a4a660f54b
TLSH
T1CA217D5B1B8DE47089E01BE71DEC8E2573BBC7CE8790E065B34DA039480262D5B3D45D
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.cursoradapter_cursoradapter.version

Path C:\Users\Admin\Downloads\META-INF\androidx.cursoradapter_cursoradapter.version
Size 6B
SHA256 59854984853104df5c353e2f681a15fc7924742f9a2e468c29af248dce45ce03
MD5 c9e47dbb0e1927076ed7b2e1ec157be7
SHA1 c538b66c7110ca3a028ccfe422d0f1fa200a9935
SHA512 c6e5081ce77f5971474ff994acc1b8887818f3007a4e3db32c91640203906f0bd2df3012441c9e1b6c1ae4e54dfea465ec23034092779cf6852aece45bf1df21
MD5 SHA1 SHA512

Submit Download

androidx.datastore_datastore.version

Path C:\Users\Admin\Downloads\META-INF\androidx.datastore_datastore.version
Size 6B
SHA256 cc52f678848b814373757b460383bf61960e4943c203735adde0a350b3e50989
MD5 375e8a39ec9331ddd89c8acbeb620028
SHA1 3b1c4a149729cc044e1a39df31b3628cdbf5f895
SHA512 32bac321e3df5237d7e66c72179befdc5ce68ca80eaa2766705c31d84d20e0409df49a39a521c2bd7e6783513395834c1a75240f97f2405a5fd914e1e15864dc
MD5 SHA1 SHA512

Submit Download

androidx.lifecycle_lifecycle-livedata.version

Path C:\Users\Admin\Downloads\META-INF\androidx.lifecycle_lifecycle-livedata.version
Size 6B
SHA256 362148d7721ad4a1bb64981ff8d604ef7f4d22267ea8845042f54f90940f24fd
MD5 c7b46c48e218a9fa48dd337a91bb3490
SHA1 a8c86d12b1459b66b47ef640f3f0c87822c25901
SHA512 294108697ec66acf16af2f9518c5999605a8585058ad25dc9303029fd890e6835b2fcda23fff2ad60058f8f6a8a19c945d998e4e228453d4946e395b9aa2055d
MD5 SHA1 SHA512

Submit Download

androidx.savedstate_savedstate.version

Path C:\Users\Admin\Downloads\META-INF\androidx.savedstate_savedstate.version
Size 6B
SHA256 6cf4e084b47f33c9b02ef79279d157833868f8f70514169a768be353ee328fea
MD5 d4ec81e89b0e7cb07587d71e22c6788f
SHA1 9576dfbd47fecf72420d42171d6bb7a2e728a1d8
SHA512 e3ca200319bb0cb2e8758ceee10cfba0acc73c305cbc75be507dbc51c2875d8661b0ce0ac0c6d3b5abb9d8ea66631b659b02bb92d29ddea966f0066e20992803
MD5 SHA1 SHA512

Submit Download

androidx.vectordrawable_vectordrawable.version

Path C:\Users\Admin\Downloads\META-INF\androidx.vectordrawable_vectordrawable.version
Size 6B
SHA256 1575e1af4a95f12f70b4ee6a6adce8160953d93ea17dc2611b90883ccc3ad3b8
MD5 30a04cf33ee91a3ecf4b75c71268f316
SHA1 05e17b646a817240c206186f94f8f4c70974d5dc
SHA512 45068042776137c07c26a0a005777fed7966ee689c1eef6a4bf3500857aadcb026eca047e6c0665482273dead269de7c810ccbf5753aa71703ae79272f278c51
MD5 SHA1 SHA512

Submit Download

androidx.window_window-java.version

Path C:\Users\Admin\Downloads\META-INF\androidx.window_window-java.version
Size 6B
SHA256 1e5b51cde515396a9fa762909cf8ca6584ccc564b325d2eebeea76175fe95c4d
MD5 4049400e232490d58f1e26d9ab973a03
SHA1 cf744bd007850b04601dc865815ec0f5e60c6970
SHA512 8da6b544889de1985ee82a224a8a8a40dcc4a2eea849ae98a9806655a88ffd5a9931d910cc0b0463742dafb10554c3e312565f0a4829fa6fb723033e227309aa
MD5 SHA1 SHA512

Submit Download

m6.q

Path C:\Users\Admin\Downloads\META-INF\services\m6.q
Size 5B
SHA256 6448f9fad504ff37c9a7b68fa20070306b5d4b23146b03f70c91dbb8dfe39642
MD5 a794a0a4a8f7c1a44fa80af40ecb22d4
SHA1 86da262e7f082fe04533770f9c69fc62e237752b
SHA512 2142af0400e06e7b071e1c62add733c0b98d6fcf59403aff33657565efd2786340e8d0974370320e90b11f74690178c23c2858403359b95405d9d30bd29af440
MD5 SHA1 SHA512

Submit Download

ash_exact_french.txt

Path C:\Users\Admin\Downloads\org\apache\commons\codec\language\bm\ash_exact_french.txt
Size 847B
SHA256 164118ca18b6eac070875ac8dd5a76e19053d62e4f8b1023ab1c0b449f216c19
MD5 5354eb024f09dfbfd09f2722e0d70af3
SHA1 7413c2bec978ff2b24a1ab7fa7652499424cd45b
SHA512 007bb52eb3a5404b06c3951dd07c0478a7d6a6683d8a4842385c0aa9a49d7ae9767ed90d132e7373deb2cd68bf927c45a4a7e20d29d40253ac877aa54fa96ea5
TLSH
T1CB01AFBE3D85273317F045AA2F0FC48FE105D76C254A63553469C1D41B3A25A47EADE1
MD5 SHA1 SHA512 TLSH

Submit Download

gen_approx_greek.txt

Path C:\Users\Admin\Downloads\org\apache\commons\codec\language\bm\gen_approx_greek.txt
Size 847B
SHA256 0d08372e7b3441285777c6cb1cc55a71426563a98c24205471f59d46799c59b0
MD5 4ed627773bb1e4c73d663a4e9636fb61
SHA1 da5c2aab5a8992b360b28fc7195afd79b9ff70e4
SHA512 3c2b5757547239bc5aaa628db40ea6e866aa576b4663b81b99d3cfc46f31e275dca8e61edaecc29d86949cbf028bd48effdc79089991d3b4e97ad37ec1dfe624
TLSH
T1D501EFBE3D89273327F045AA2F0FC48FE005E36C214A23553868C0C41B3A15A43EAEF1
MD5 SHA1 SHA512 TLSH

Submit Download

gen_approx_hebrew.txt

Path C:\Users\Admin\Downloads\org\apache\commons\codec\language\bm\gen_approx_hebrew.txt
Size 829B
SHA256 b29b40a7b7daeb83d036340d711caee93c3ad8f029e0b2d5a414fdfad2f370a5
MD5 5a8eb009fc98f424e2b507f1958cfc30
SHA1 19b5ed535fb0fea649054967a320cfb2bd334c2e
SHA512 a58554c5591703ff2476803605a9eca5162a1668748b0fd7e5865a82ff4c5e084e02046ed9aaccd1f0101bebce2b307eda034829df76645dc6028427d6bf3e9f
TLSH
T11201ABBE3D85273317F045AA2F0FC48BE145D76C254A23953869C1D41B3A25A42EADE2
MD5 SHA1 SHA512 TLSH

Submit Download

gen_exact_english.txt

Path C:\Users\Admin\Downloads\org\apache\commons\codec\language\bm\gen_exact_english.txt
Size 847B
SHA256 1657c298f1ec89110e41b87f41ca23657a1bb3a1ec25b6a40b941fe07403421f
MD5 f22823105e60022e6ea2d2b6babee07b
SHA1 a8555ae9b5065713f8296a9ff032dbc9a53a672a
SHA512 47a48eeae74bbdce17777b59134e94efa5e1091f28f09300fbb44037cf35b90a79e842a5ab47a432c79a7914a17bed1c7ec3baad20a8f3d1f64d2608f89ae4a0
TLSH
T10501EFBE3D8A273317F045AA2F0FC08FE005D36C214A23553468C0C41B3A25A43EADF1
MD5 SHA1 SHA512 TLSH

Submit Download

-Y.xml

Path C:\Users\Admin\Downloads\res\-Y.xml
Size 112B
SHA256 31794062cf1f8af54f47f64425cdf4da3ddc380f91d7c63bc68bbbb55b663540
MD5 9618f1a5a82ea9fc393c175740892be3
SHA1 5ca1a555b79b4bd14c20f60e7a334f57826e6197
SHA512 0446529dfc1e1d85d325a38491a73ae1e948ddcae15d9b4f05ddf00fe9bf0f514559a252f914d01b40aa4183c40cd06f1cd4c70d982e8593275aa9d36f1a2213
TLSH
T1F0B00240B700E501C42CAB308D1ECFC95744FE14EF12B32B7082730E0D712420D22A86
MD5 SHA1 SHA512 TLSH

Submit Download

1S.png

Path C:\Users\Admin\Downloads\res\1S.png
Size 67B
SHA256 a4d4c009619311d9b83904acfd62fe3b7f918c312522bbcc6ad51cdec4fd1edf
MD5 aa78de6842c7c0fa92d5fd8329f229cf
SHA1 5a9d058778beb4e96d1f968a29a98ecc3d9dff06
SHA512 ec3552d929a9e640c73bcf06318f5724b73b6499cecd421ed4916bc1ce9a004e8da419606c46512b8621360ec88dad69aba4f9edaa0402be100b21e0a44dedc5
TLSH
T1C9A022C33302CC38C382A233A22002A0E8300A000AC30388002B802C2CA830B8A88282
MD5 SHA1 SHA512 TLSH

Submit Download

7P.9.png

Path C:\Users\Admin\Downloads\res\7P.9.png
Size 77B
SHA256 fde815fa5c3267d58ce96698035dd6867c6daa573ec498dfc755c60f9445a677
MD5 90abb5ffc510020e28f372e65174f156
SHA1 ac953f53bfe02e3ee01b8ec3e12f11a9fd1514a3
SHA512 573b8fd6d871f5ab20ffb0ee89ce1cf9c3b39554b3fd56d256ba515ab0bc8e84762fe30d55c2b38a8df2affd0c04285718d7cd3793cbaa7013ec2fabe041bd1a
TLSH
T182A022E22BB08C38CB22083303300032FFB302AB0E20C20C008FC8B02802CC800E2382
MD5 SHA1 SHA512 TLSH

Submit Download

XM.xml

Path C:\Users\Admin\Downloads\res\XM.xml
Size 124B
SHA256 9b0ac791a3fa953e28b526e020fd2e629b40812ee1bc4693ff5fdfef15044202
MD5 8b40c428b5b0d9ad329f439e73363216
SHA1 d84478ee99eba9d8c5af5a09189a7de687be8b72
SHA512 f13ff9cd26405117470729075a37f8db56eb287e906f6710d80a36cc0c798e6e2904c0eb8745169a2b1cfcea3bee4b55be3c85748fb96e8bf7000d9bcf4a31be
TLSH
T15FB012403604C102C0AC5730DC56C6875244FE10CF1451073054330F04F01050C02E42
MD5 SHA1 SHA512 TLSH

Submit Download

ei.9.png

Path C:\Users\Admin\Downloads\res\ei.9.png
Size 167B
SHA256 378694706fb7256dd2248e2af854efd71ec7e8885f61da2e16a2bd32fcf3d0a9
MD5 3856a749d5f0b1af12f8d95cb84dc393
SHA1 c3cf91043f30322301bbc418cf64ad89c940aa16
SHA512 aaf4d157e6a26f3938458d255ed1aac8f76787f6f80106e431ded92c6d0b9138b2b30059d7e16ea6dffe24cccd9e30876f58111454db61b14667087b4f7d81c1
TLSH
T1B4C014F3F313547DD545433F514C4757D53541DD45D5051314515D171D3534D4C557C1
MD5 SHA1 SHA512 TLSH

Submit Download

skyplaytv.apk

Path C:\Users\Admin\Downloads\skyplaytv.apk
Size 21.4MB
SHA256 96cb41b87bd6e764e415325b8a947d0202a15524f524ad0194b264189a1e91ce
MD5 7d0cb9747136097f8bf5cb2f963a7631
SHA1 4189eb17e9b43dbaf922eeec2b76ba929095b350
SHA512 44d3bc22589edca5ea03012986c1187a69aaeaa133313aaa612f94ca8d881818ecc54c01e70352e424cf0ea0b08e8abeeb833d2aabce57260c242a6308f9ca10
SSDEEP 393216:WRu8SFpdbmwfaRoYD78CtkDW4H1PaypBOq+klrz6esX8aRd+:2uzhHwa+8zkX3Rd+
TLSH
T1F537CF4BF110ED1AD9E94671FE6E96D433844F1EE6D32962F80D62343BE70880AB35D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5812-277-0x000000000A660000-0x000000000A670000-memory.dmp

Download

memory/5812-292-0x000000000A660000-0x000000000A670000-memory.dmp

Download

memory/5812-293-0x000000000A660000-0x000000000A670000-memory.dmp

Download

memory/5812-287-0x000000000A660000-0x000000000A670000-memory.dmp

Download

memory/5812-288-0x000000000A660000-0x000000000A670000-memory.dmp

Download

memory/5812-290-0x000000000A660000-0x000000000A670000-memory.dmp

Download

memory/5812-291-0x000000000A660000-0x000000000A670000-memory.dmp

Download

memory/5812-289-0x000000000A660000-0x000000000A670000-memory.dmp

Download

memory/5812-286-0x000000000A660000-0x000000000A670000-memory.dmp

Download

memory/5812-285-0x0000000008460000-0x0000000008470000-memory.dmp

Download

memory/5812-283-0x000000000A660000-0x000000000A670000-memory.dmp

Download

memory/5812-282-0x000000000A660000-0x000000000A670000-memory.dmp

Download

memory/5812-278-0x000000000A660000-0x000000000A670000-memory.dmp

Download

memory/5812-280-0x000000000A660000-0x000000000A670000-memory.dmp

Download

memory/5812-281-0x000000000A660000-0x000000000A670000-memory.dmp

Download

memory/5812-279-0x000000000A660000-0x000000000A670000-memory.dmp

Download

memory/5812-276-0x000000000A660000-0x000000000A670000-memory.dmp

Download

memory/5812-248-0x0000000008460000-0x0000000008470000-memory.dmp

Download