bc8526519ba3ab695fa8659774f5c93d7d12fe0af43402f2f60682f30c7cefb3

Analysis

user interaction
yes
max time kernel
420s
max time network
424s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
16/08/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Kaspersky Installer.exe
Size 4.5MB
Sample260816-eepyracn7v
SHA256 bc8526519ba3ab695fa8659774f5c93d7d12fe0af43402f2f60682f30c7cefb3
MD5 ddb6b05d76fe3b5e01ccc60a44ea0f18
SHA1 8f4c16963e0ab16b1e5cab461ce632786390d744
SHA512 33756f883960c43e09470b91f36f0558a4bf10844f808c521873178d2787b7e56b9b75366803fff63615a584f0c71856964629fbf125cb920c348ec07078b0de
SSDEEP 98304:RUA459jvgsJEMiVfDzdEs8jFEq5NrlV6WVM:ujvgBnB8lMF
TLSH
T18126EF11AE7D9062F422453D4A5D9273C5BBBBECB71F019762B4267B0B237808A2D377
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

bootkit defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	startup.exe

Drops file in Drivers directory 6 IoCs

description	ioc	Process
File created	C:\Windows\system32\DRIVERS\K4W-21-26\SET2C23.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\K4W-21-26\klflt.sys	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\K4W-21-26\SET2C03.tmp	MsiExec.exe
File created	C:\Windows\system32\DRIVERS\K4W-21-26\SET2C03.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\K4W-21-26\klif.sys	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\K4W-21-26\SET2C23.tmp	MsiExec.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	startup.exe

Looks for VMWare services registry key. 1 TTPs 3 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmdebug	startup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	startup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	startup.exe

Looks for Xen service registry key. 1 TTPs 5 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xenevtchn	startup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xennet	startup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xennet6	startup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xensvc	startup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xenvdb	startup.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
62	5892	msiexec.exe

Checks for any installed AV software in registry 1 TTPs 64 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP16.0.0	startup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP21.7	startup.exe
Key opened	\REGISTRY\MACHINE\Software\KasperskyLab\AVP21.16	startup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVPXX.XX_not_exists\settings\PasswordProtectionSettings	msiexec.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.26\settings\PasswordProtectionSettings	msiexec.exe
Key opened	\REGISTRY\MACHINE\Software\KasperskyLab\SM6.0.2	startup.exe
Key opened	\REGISTRY\MACHINE\Software\KasperskyLab\AVP21.2	startup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP21.8	startup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP21.15	startup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP21.19	startup.exe
Key opened	\REGISTRY\MACHINE\Software\KasperskyLab\AVP21.23	startup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP21.1	startup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP21.21	startup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVPXX.XX_not_exists\data\FlushedMsiCriticalSettings	msiexec.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.26\settings	msiexec.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.26\Data	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\klim6\Parameters	MsiExec.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP18.0.0	startup.exe
Key opened	\REGISTRY\MACHINE\Software\KasperskyLab\AVP17.0.0	startup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP21.3	startup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP21.18	startup.exe
Key opened	\REGISTRY\MACHINE\Software\KasperskyLab\AVP21.19	startup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\SM7.0.0	startup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP21.13	startup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP21.14	startup.exe
Key opened	\REGISTRY\MACHINE\Software\KasperskyLab\AVP15.0.0	startup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\SM3.0.0	startup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.26\environment	msiexec.exe
Key opened	\REGISTRY\MACHINE\Software\KasperskyLab\AVP21.5	startup.exe
Key opened	\REGISTRY\MACHINE\Software\KasperskyLab\AVP21.1	startup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP21.17	startup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\SM5.0.0	startup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\Kleaner	startup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.26\environment	MsiExec.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP16.0.1	startup.exe
Key opened	\REGISTRY\MACHINE\Software\KasperskyLab\AVP16.0.0	startup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP17.0.0	startup.exe
Key opened	\REGISTRY\MACHINE\Software\KasperskyLab\AVP19.0.0	startup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP21.4	startup.exe
Key opened	\REGISTRY\MACHINE\Software\KasperskyLab\AVP21.15	startup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\SM4.0.0	startup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\SM6.0.0	startup.exe
Key opened	\REGISTRY\MACHINE\Software\KasperskyLab\AVP21.14	startup.exe
Key opened	\REGISTRY\MACHINE\Software\KasperskyLab\AVP21.25	startup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP21.26	startup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP15.0.0	startup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.26\Data\ContainersDb	msiexec.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.26\settings	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\protected\LicStorage	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\Components\34\1103\1.0.0.0	rundll32.exe
Key opened	\REGISTRY\MACHINE\Software\KasperskyLab\AVP21.0	startup.exe
Key opened	\REGISTRY\MACHINE\Software\KasperskyLab\AVP21.13	startup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP21.25	startup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVPXX.XX_not_exists\data	msiexec.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP21.6	startup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP21.9	startup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP21.20	startup.exe
Key opened	\REGISTRY\MACHINE\Software\KasperskyLab\AVP21.22	startup.exe
Key opened	\REGISTRY\MACHINE\Software\KasperskyLab\AVP15.0.1	startup.exe
Key opened	\REGISTRY\MACHINE\Software\KasperskyLab\AVP21.7	startup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP15.0.1	startup.exe
Key opened	\REGISTRY\MACHINE\Software\KasperskyLab\AVP21.18	startup.exe
Key opened	\REGISTRY\MACHINE\Software\KasperskyLab\AVP21.21	startup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP20.0	startup.exe

Downloads MZ/PE file 3 IoCs

flow	pid	Process
40	2380	startup.exe
40	2380	startup.exe
40	2380	startup.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Kaspersky Installer.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	Kaspersky Installer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5a08ea.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC47.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_922432962\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_604955312\Sigma\Cryptomining	msedge.exe
File opened for modification	C:\Windows\Installer\MSI11CD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI179C.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	MsiExec.exe
File created	C:\Windows\Inf\oem1.PNF	MsiExec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_604955312\Mu\Fingerprinting	msedge.exe
File opened for modification	C:\Windows\Installer\MSI28F6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFC7.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1374.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1C81.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1E67.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_604955312\Mu\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_604955312\Mu\TransparentAdvertisers	msedge.exe
File opened for modification	C:\Windows\Installer\e5a08ea.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBB9.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_292888324\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_604955312\Sigma\Fingerprinting	msedge.exe
File opened for modification	C:\Windows\Installer\MSICE6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF78.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI11BC.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_922432962\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_459840839\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_604955312\Sigma\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_604955312\Sigma\Staging	msedge.exe
File opened for modification	C:\Windows\security\logs\scecomp.log	MsiExec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_1124009980\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_604955312\Sigma\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_859881332\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_1124009980\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_292888324\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_604955312\Mu\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_604955312\Sigma\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_604955312\Sigma\LICENSE	msedge.exe
File opened for modification	C:\Windows\Installer\MSIEFA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1402.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_922432962\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_922432962\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_604955312\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_604955312\Mu\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_282387519\manifest.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSI2359.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_604955312\Mu\Social	msedge.exe
File opened for modification	C:\Windows\Installer\MSI2B2A.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_604955312\Mu\Cryptomining	msedge.exe
File opened for modification	C:\Windows\Installer\MSICA7.tmp	msiexec.exe
File created	C:\Windows\Inf\oem0.PNF	MsiExec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_292888324\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_604955312\Sigma\Advertising	msedge.exe
File created	C:\Windows\Inf\oem2.PNF	MsiExec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_604955312\Mu\CompatExceptions	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_859881332\manifest.json	msedge.exe
File created	C:\Windows\Installer\SourceHash{2AE381ED-A2A2-373C-8DB1-231B56332A0F}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI18E7.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_292888324\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_459840839\manifest.json	msedge.exe
File opened for modification	C:\Windows\installer	startup.exe
File opened for modification	C:\Windows\Installer\MSI18D6.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_282387519\data.txt	msedge.exe

Executes dropped EXE 6 IoCs

pid	Process
4636	Kaspersky Installer.exe
2712	setup_ui.exe
6120	startup.exe
2380	startup.exe
5260	setup_ui.exe
784	Kaspersky Installer.exe

Loads dropped DLL 64 IoCs

pid	Process
4636	Kaspersky Installer.exe
2712	setup_ui.exe
2712	setup_ui.exe
2712	setup_ui.exe
2712	setup_ui.exe
2712	setup_ui.exe
2712	setup_ui.exe
2712	setup_ui.exe
2712	setup_ui.exe
2712	setup_ui.exe
2712	setup_ui.exe
2712	setup_ui.exe
2712	setup_ui.exe
2712	setup_ui.exe
2712	setup_ui.exe
2712	setup_ui.exe
2712	setup_ui.exe
2712	setup_ui.exe
2712	setup_ui.exe
2712	setup_ui.exe
2712	setup_ui.exe
2712	setup_ui.exe
2712	setup_ui.exe
2712	setup_ui.exe
2712	setup_ui.exe
2712	setup_ui.exe
2712	setup_ui.exe
2712	setup_ui.exe
2712	setup_ui.exe
2712	setup_ui.exe
2712	setup_ui.exe
2712	setup_ui.exe
2712	setup_ui.exe
2380	startup.exe
5260	setup_ui.exe
5260	setup_ui.exe
5260	setup_ui.exe
5260	setup_ui.exe
5260	setup_ui.exe
5260	setup_ui.exe
5260	setup_ui.exe
5260	setup_ui.exe
5260	setup_ui.exe
5260	setup_ui.exe
5260	setup_ui.exe
5260	setup_ui.exe
5260	setup_ui.exe
5260	setup_ui.exe
5260	setup_ui.exe
5260	setup_ui.exe
5260	setup_ui.exe
5260	setup_ui.exe
5260	setup_ui.exe
5260	setup_ui.exe
5260	setup_ui.exe
5260	setup_ui.exe
5260	setup_ui.exe
5260	setup_ui.exe
5260	setup_ui.exe
5260	setup_ui.exe
5260	setup_ui.exe
5260	setup_ui.exe
5260	setup_ui.exe
5260	setup_ui.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	startup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Kaspersky Installer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kaspersky Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup_ui.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	startup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	startup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kaspersky Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kaspersky Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup_ui.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2384	msedge.exe
2180	msedge.exe
3856	msedge.exe

Checks SCSI registry key(s) 3 TTPs 2 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM	startup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Msft&Prod_Virtual_Disk	startup.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313260895447230"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{43338FB7-0141-4f90-9789-094256BEC456}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{43338FB7-0141-4f90-9789-094256BEC456}\e24332e2c36c2b36312429291720272a2a3115202b212c2b22	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4045429996-2364296335-1634900306-1000\{7A0BAFFC-9CAC-4B6C-8B32-70DD7A5DB684}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4045429996-2364296335-1634900306-1000\{998D7487-C46F-496D-9117-7C622D686B65}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4045429996-2364296335-1634900306-1000\{693C4DC1-6C71-4C69-ACA9-B5D92D62ED13}	msedge.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD	Kaspersky Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Kaspersky Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Kaspersky Installer.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2380	startup.exe
2380	startup.exe
4600	MsiExec.exe
4600	MsiExec.exe
4600	MsiExec.exe
4600	MsiExec.exe
5892	msiexec.exe
5892	msiexec.exe
4600	MsiExec.exe
4600	MsiExec.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
672	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2380	startup.exe
Token: SeIncreaseQuotaPrivilege	2380	startup.exe
Token: SeSecurityPrivilege	5892	msiexec.exe
Token: SeCreateTokenPrivilege	2380	startup.exe
Token: SeAssignPrimaryTokenPrivilege	2380	startup.exe
Token: SeLockMemoryPrivilege	2380	startup.exe
Token: SeIncreaseQuotaPrivilege	2380	startup.exe
Token: SeMachineAccountPrivilege	2380	startup.exe
Token: SeTcbPrivilege	2380	startup.exe
Token: SeSecurityPrivilege	2380	startup.exe
Token: SeTakeOwnershipPrivilege	2380	startup.exe
Token: SeLoadDriverPrivilege	2380	startup.exe
Token: SeSystemProfilePrivilege	2380	startup.exe
Token: SeSystemtimePrivilege	2380	startup.exe
Token: SeProfSingleProcessPrivilege	2380	startup.exe
Token: SeIncBasePriorityPrivilege	2380	startup.exe
Token: SeCreatePagefilePrivilege	2380	startup.exe
Token: SeCreatePermanentPrivilege	2380	startup.exe
Token: SeBackupPrivilege	2380	startup.exe
Token: SeRestorePrivilege	2380	startup.exe
Token: SeShutdownPrivilege	2380	startup.exe
Token: SeDebugPrivilege	2380	startup.exe
Token: SeAuditPrivilege	2380	startup.exe
Token: SeSystemEnvironmentPrivilege	2380	startup.exe
Token: SeChangeNotifyPrivilege	2380	startup.exe
Token: SeRemoteShutdownPrivilege	2380	startup.exe
Token: SeUndockPrivilege	2380	startup.exe
Token: SeSyncAgentPrivilege	2380	startup.exe
Token: SeEnableDelegationPrivilege	2380	startup.exe
Token: SeManageVolumePrivilege	2380	startup.exe
Token: SeImpersonatePrivilege	2380	startup.exe
Token: SeCreateGlobalPrivilege	2380	startup.exe
Token: SeRestorePrivilege	5892	msiexec.exe
Token: SeTakeOwnershipPrivilege	5892	msiexec.exe
Token: SeRestorePrivilege	5892	msiexec.exe
Token: SeTakeOwnershipPrivilege	5892	msiexec.exe
Token: SeRestorePrivilege	5892	msiexec.exe
Token: SeTakeOwnershipPrivilege	5892	msiexec.exe
Token: SeRestorePrivilege	5892	msiexec.exe
Token: SeTakeOwnershipPrivilege	5892	msiexec.exe
Token: SeRestorePrivilege	5892	msiexec.exe
Token: SeTakeOwnershipPrivilege	5892	msiexec.exe
Token: SeRestorePrivilege	5892	msiexec.exe
Token: SeTakeOwnershipPrivilege	5892	msiexec.exe
Token: SeRestorePrivilege	5892	msiexec.exe
Token: SeTakeOwnershipPrivilege	5892	msiexec.exe
Token: SeRestorePrivilege	5892	msiexec.exe
Token: SeTakeOwnershipPrivilege	5892	msiexec.exe
Token: SeRestorePrivilege	5892	msiexec.exe
Token: SeTakeOwnershipPrivilege	5892	msiexec.exe
Token: SeRestorePrivilege	5892	msiexec.exe
Token: SeTakeOwnershipPrivilege	5892	msiexec.exe
Token: SeRestorePrivilege	5892	msiexec.exe
Token: SeTakeOwnershipPrivilege	5892	msiexec.exe
Token: SeRestorePrivilege	5892	msiexec.exe
Token: SeTakeOwnershipPrivilege	5892	msiexec.exe
Token: SeRestorePrivilege	5892	msiexec.exe
Token: SeTakeOwnershipPrivilege	5892	msiexec.exe
Token: SeRestorePrivilege	5892	msiexec.exe
Token: SeTakeOwnershipPrivilege	5892	msiexec.exe
Token: SeRestorePrivilege	5892	msiexec.exe
Token: SeTakeOwnershipPrivilege	5892	msiexec.exe
Token: SeRestorePrivilege	5892	msiexec.exe
Token: SeTakeOwnershipPrivilege	5892	msiexec.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3412	msedge.exe
5260	setup_ui.exe
3412	msedge.exe
3968	msedge.exe
3968	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 4636	1004	Kaspersky Installer.exe	82
PID 4636 wrote to memory of 2712	4636	Kaspersky Installer.exe	83
PID 4636 wrote to memory of 6120	4636	Kaspersky Installer.exe	86
PID 6120 wrote to memory of 2380	6120	startup.exe	87
PID 2380 wrote to memory of 5260	2380	startup.exe	88
PID 4636 wrote to memory of 784	4636	Kaspersky Installer.exe	93
PID 5892 wrote to memory of 4508	5892	msiexec.exe	99
PID 5892 wrote to memory of 4600	5892	msiexec.exe	100
PID 5892 wrote to memory of 5584	5892	msiexec.exe	101
PID 2380 wrote to memory of 3412	2380	startup.exe	104
PID 3412 wrote to memory of 852	3412	msedge.exe	105
PID 3412 wrote to memory of 2384	3412	msedge.exe	106
PID 3412 wrote to memory of 5468	3412	msedge.exe	107
PID 3412 wrote to memory of 5468	3412	msedge.exe	107
PID 3412 wrote to memory of 5468	3412	msedge.exe	107
PID 3412 wrote to memory of 4328	3412	msedge.exe	109
PID 3412 wrote to memory of 4328	3412	msedge.exe	109
PID 3412 wrote to memory of 3252	3412	msedge.exe	110
PID 3412 wrote to memory of 3252	3412	msedge.exe	110
PID 3412 wrote to memory of 3448	3412	msedge.exe	111
PID 3412 wrote to memory of 3252	3412	msedge.exe	110
PID 3412 wrote to memory of 3448	3412	msedge.exe	111
PID 3412 wrote to memory of 3448	3412	msedge.exe	111
PID 3412 wrote to memory of 5464	3412	msedge.exe	115
PID 3412 wrote to memory of 5464	3412	msedge.exe	115
PID 3412 wrote to memory of 5464	3412	msedge.exe	115
PID 3412 wrote to memory of 4552	3412	msedge.exe	116
PID 3412 wrote to memory of 1656	3412	msedge.exe	117
PID 3412 wrote to memory of 4552	3412	msedge.exe	116
PID 3412 wrote to memory of 1656	3412	msedge.exe	117
PID 3412 wrote to memory of 3540	3412	msedge.exe	119
PID 3412 wrote to memory of 5888	3412	msedge.exe	123
PID 3412 wrote to memory of 5500	3412	msedge.exe	124
PID 3412 wrote to memory of 2524	3412	msedge.exe	125
PID 3412 wrote to memory of 5272	3412	msedge.exe	126
PID 3412 wrote to memory of 5272	3412	msedge.exe	126
PID 3412 wrote to memory of 3468	3412	msedge.exe	128
PID 3412 wrote to memory of 3468	3412	msedge.exe	128
PID 3412 wrote to memory of 5736	3412	msedge.exe	129
PID 3412 wrote to memory of 5736	3412	msedge.exe	129
PID 3412 wrote to memory of 1848	3412	msedge.exe	130
PID 3412 wrote to memory of 1848	3412	msedge.exe	130
PID 3412 wrote to memory of 3968	3412	msedge.exe	131
PID 3968 wrote to memory of 1528	3968	msedge.exe	132
PID 3968 wrote to memory of 2180	3968	msedge.exe	133
PID 3968 wrote to memory of 2852	3968	msedge.exe	134
PID 3968 wrote to memory of 2452	3968	msedge.exe	135
PID 3968 wrote to memory of 2852	3968	msedge.exe	134
PID 3968 wrote to memory of 2852	3968	msedge.exe	134
PID 3968 wrote to memory of 2452	3968	msedge.exe	135
PID 3968 wrote to memory of 6132	3968	msedge.exe	138
PID 2380 wrote to memory of 5656	2380	startup.exe	139
PID 3968 wrote to memory of 4740	3968	msedge.exe	140
PID 3968 wrote to memory of 4740	3968	msedge.exe	140
PID 3968 wrote to memory of 5040	3968	msedge.exe	141
PID 3968 wrote to memory of 4740	3968	msedge.exe	140
PID 3968 wrote to memory of 5040	3968	msedge.exe	141
PID 3968 wrote to memory of 5040	3968	msedge.exe	141
PID 3968 wrote to memory of 1524	3968	msedge.exe	142
PID 3968 wrote to memory of 5456	3968	msedge.exe	143
PID 3968 wrote to memory of 1524	3968	msedge.exe	142
PID 3968 wrote to memory of 5456	3968	msedge.exe	143
PID 3968 wrote to memory of 3376	3968	msedge.exe	144
PID 3968 wrote to memory of 3376	3968	msedge.exe	144

C:\Users\Admin\AppData\Local\Temp\Kaspersky Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Kaspersky Installer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Windows\temp\6CFC318C52991F119A426E10A5985A74\Kaspersky Installer.exe
  "C:\Windows\temp\6CFC318C52991F119A426E10A5985A74\Kaspersky Installer.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\Kaspersky Installer.exe"
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Users\Admin\AppData\Local\Temp\0E45C38C52991F119A426E10A5985A74\setup_ui.exe
    "C:\Users\Admin\AppData\Local\Temp\0E45C38C52991F119A426E10A5985A74\setup_ui.exe" -cp=objref:TUVPVwEAAAAAAAAAAAAAAMAAAAAAAABGgQIAAAAAAAC6GkkeqGEAp17FxNZoIzPBAoAAABwS///3PX1b+ewNsS8AGQAHAEcAZQBzAGgAdgBiAGkAZgAAAAcAMQAwAC4AMQAyADcALgAxAC4AMQAxADIAAAAAAAkA//8AAB4A//8AABAA//8AAAoA//8AABYA//8AAB8A//8AAA4A//8AAAAA:
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2712
- - C:\ProgramData\Kaspersky Lab Setup Files\KFA21.26.4.406.0.66.0\au_setup_C83C54E3-9925-11F1-A924-E6015A89A547\startup.exe
    "C:\ProgramData\Kaspersky Lab Setup Files\KFA21.26.4.406.0.66.0\au_setup_C83C54E3-9925-11F1-A924-E6015A89A547\startup.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\Kaspersky Installer.exe" -auto_update_mode="C:\Users\Admin\AppData\Local\Temp\Kaspersky Installer.exe" /-self_remove -l=es-MX -xpos=590 -ypos=238 -prevsetupver=21.20.8.505.0.74.0
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6120
  - - C:\Windows\temp\2FC34F5D52991F119A426E10A5985A74\startup.exe
      "C:\Windows\temp\2FC34F5D52991F119A426E10A5985A74\startup.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\Kaspersky Installer.exe" -auto_update_mode="C:\Users\Admin\AppData\Local\Temp\Kaspersky Installer.exe" /-self_remove -l=es-MX -xpos=590 -ypos=238 -prevsetupver=21.20.8.505.0.74.0
      4⤵
      Enumerates VirtualBox registry keys
      Looks for VMWare Tools registry key
      Looks for VMWare services registry key.
      Looks for Xen service registry key.
      Checks for any installed AV software in registry
      Downloads MZ/PE file
      Drops file in Windows directory
      Executes dropped EXE
      Loads dropped DLL
      Checks whether UAC is enabled
      System Location Discovery: System Language Discovery
      Checks SCSI registry key(s)
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2380
    - - C:\Users\Admin\AppData\Local\Temp\A092006D52991F119A426E10A5985A74\setup_ui.exe
        
        "C:\Users\Admin\AppData\Local\Temp\A092006D52991F119A426E10A5985A74\setup_ui.exe" -cp=objref:TUVPVwEAAAAAAAAAAAAAAMAAAAAAAABGgQIAAAAAAADC5glha0EFhIaMx1zHKgnaAlAAAEwJ////5yEPeXLtAC8AGQAHAEcAZQBzAGgAdgBiAGkAZgAAAAcAMQAwAC4AMQAyADcALgAxAC4AMQAxADIAAAAAAAkA//8AAB4A//8AABAA//8AAAoA//8AABYA//8AAB8A//8AAA4A//8AAAAA:
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:5260
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://click.kaspersky.com/?hl=es-MX&customization=&version=21.26.4.406&pid=230-Win&syst=Microsoft Windows 10 x64 Edition (build 19044)&error=29100&link=error&type=MsiError
        5⤵
        Drops file in Windows directory
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3412
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x374,0x7ffe6ed7c188,0x7ffe6ed7c194,0x7ffe6ed7c1a0
        6⤵
        
        PID:852
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,14765754271401611586,3505925283504747988,524288 --field-trial-handle=2328,i,17308379339222966583,4798649678324421621,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:2384
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1776,i,877116574906662002,14743186934831729918,262144 --field-trial-handle=2328,i,17308379339222966583,4798649678324421621,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
        6⤵
        
        PID:5468
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,10955220960738715569,16213412615617932542,524288 --field-trial-handle=2328,i,17308379339222966583,4798649678324421621,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:8
        6⤵
        
        PID:4328
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,8845797279776651812,456431345003561121,2097152 --field-trial-handle=2328,i,17308379339222966583,4798649678324421621,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
        6⤵
        
        PID:3252
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,3219916769997500964,13020597221230079454,2097152 --field-trial-handle=2328,i,17308379339222966583,4798649678324421621,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
        6⤵
        
        PID:3448
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4920,i,11255646384510276558,17191044477669825224,2097152 --field-trial-handle=2328,i,17308379339222966583,4798649678324421621,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:1
        6⤵
        
        PID:5464
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,4768472819116038733,1245665640222780469,524288 --field-trial-handle=2328,i,17308379339222966583,4798649678324421621,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
        6⤵
        
        PID:4552
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,11393094333916036554,8222625071305615412,524288 --field-trial-handle=2328,i,17308379339222966583,4798649678324421621,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:8
        6⤵
        
        PID:1656
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,14417236943147225895,10425087015103473504,524288 --field-trial-handle=2328,i,17308379339222966583,4798649678324421621,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
        6⤵
        
        PID:3128
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,14417236943147225895,10425087015103473504,524288 --field-trial-handle=2328,i,17308379339222966583,4798649678324421621,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
        6⤵
        
        PID:3540
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,15481779652701112918,8316901994440364576,524288 --field-trial-handle=2328,i,17308379339222966583,4798649678324421621,262144 --variations-seed-version --mojo-platform-channel-handle=740 /prefetch:8
        6⤵
        
        PID:5888
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,10573477578165847222,1621599000983042294,524288 --field-trial-handle=2328,i,17308379339222966583,4798649678324421621,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:8
        6⤵
        
        PID:5500
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,9815328842203674038,17375575445080425643,524288 --field-trial-handle=2328,i,17308379339222966583,4798649678324421621,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
        6⤵
        
        PID:2524
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,2486618079412142111,2637669116255884186,524288 --field-trial-handle=2328,i,17308379339222966583,4798649678324421621,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:8
        6⤵
        
        PID:5272
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,7796444307922195614,160673322004036592,524288 --field-trial-handle=2328,i,17308379339222966583,4798649678324421621,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
        6⤵
        
        PID:3468
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,17234084584602614182,6600347660133707918,524288 --field-trial-handle=2328,i,17308379339222966583,4798649678324421621,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
        6⤵
        
        PID:5736
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=876,i,15858807498613821418,10107271688751251197,524288 --field-trial-handle=2328,i,17308379339222966583,4798649678324421621,262144 --variations-seed-version --mojo-platform-channel-handle=880 /prefetch:8
        6⤵
        
        PID:1848
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        6⤵
        Drops file in Windows directory
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3968
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x30c,0x7ffe6ed7c188,0x7ffe6ed7c194,0x7ffe6ed7c1a0
        7⤵
        
        PID:1528
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,9395372385669151805,14559679704193154693,524288 --field-trial-handle=2732,i,8363196154300737998,100730705554932906,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:3
        7⤵
        System Time Discovery
        
        PID:2180
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,12618823151217832195,10796188405365050365,262144 --field-trial-handle=2732,i,8363196154300737998,100730705554932906,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:2
        7⤵
        
        PID:2852
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,5061351922431892817,3232711147046233920,524288 --field-trial-handle=2732,i,8363196154300737998,100730705554932906,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:8
        7⤵
        
        PID:2452
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,2942949295656467157,7309578078618042,524288 --field-trial-handle=2732,i,8363196154300737998,100730705554932906,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:8
        7⤵
        
        PID:4616
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,2942949295656467157,7309578078618042,524288 --field-trial-handle=2732,i,8363196154300737998,100730705554932906,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:8
        7⤵
        
        PID:6132
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4852,i,14851473707278584402,17555247053273046511,2097152 --field-trial-handle=2732,i,8363196154300737998,100730705554932906,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:1
        7⤵
        
        PID:4740
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4844,i,12653238572968935906,10177015953255484254,2097152 --field-trial-handle=2732,i,8363196154300737998,100730705554932906,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:1
        7⤵
        
        PID:5040
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,15052584982486480174,13921161773011526818,524288 --field-trial-handle=2732,i,8363196154300737998,100730705554932906,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
        7⤵
        
        PID:1524
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,17108328428675673408,2966371291191322194,524288 --field-trial-handle=2732,i,8363196154300737998,100730705554932906,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:8
        7⤵
        
        PID:5456
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5860,i,4679943603078159370,6518157706166365685,2097152 --field-trial-handle=2732,i,8363196154300737998,100730705554932906,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:1
        7⤵
        
        PID:3376
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,17186790246334588049,5095535365008841725,524288 --field-trial-handle=2732,i,8363196154300737998,100730705554932906,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:8
        7⤵
        
        PID:2736
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,2824135622364133315,3356996683027521041,524288 --field-trial-handle=2732,i,8363196154300737998,100730705554932906,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
        7⤵
        
        PID:5368
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,9288565573071315221,16883622700774759511,524288 --field-trial-handle=2732,i,8363196154300737998,100730705554932906,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8
        7⤵
        
        PID:2168
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,12078998942135323642,16940811055860068367,524288 --field-trial-handle=2732,i,8363196154300737998,100730705554932906,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:8
        7⤵
        
        PID:3080
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,10364669236888537365,13620728815269484620,524288 --field-trial-handle=2732,i,8363196154300737998,100730705554932906,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:8
        7⤵
        
        PID:4420
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,6801930283774982308,9710905459206983412,524288 --field-trial-handle=2732,i,8363196154300737998,100730705554932906,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
        7⤵
        
        PID:3320
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,10504324409511814057,14777685601215363756,524288 --field-trial-handle=2732,i,8363196154300737998,100730705554932906,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:8
        7⤵
        
        PID:780
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,7314654138633759005,17243474788942734305,524288 --field-trial-handle=2732,i,8363196154300737998,100730705554932906,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
        7⤵
        
        PID:1484
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,16353508210218506848,12333048017461072849,524288 --field-trial-handle=2732,i,8363196154300737998,100730705554932906,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:8
        7⤵
        
        PID:4092
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        7⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        
        PID:2184
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffe6ed7c188,0x7ffe6ed7c194,0x7ffe6ed7c1a0
        8⤵
        
        PID:216
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,17714591356386430136,4559497206876150372,524288 --field-trial-handle=2292,i,2037639913279199532,5684103709602392743,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
        8⤵
        System Time Discovery
        
        PID:3856
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,7133287005284076350,2254737942030273154,262144 --field-trial-handle=2292,i,2037639913279199532,5684103709602392743,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
        8⤵
        
        PID:3128
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,10976610372645345997,5476604139069573885,524288 --field-trial-handle=2292,i,2037639913279199532,5684103709602392743,262144 --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:8
        8⤵
        
        PID:4444
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4152,i,16621599225606858527,4588994951011534038,524288 --field-trial-handle=2292,i,2037639913279199532,5684103709602392743,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:8
        8⤵
        
        PID:3872
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4152,i,16621599225606858527,4588994951011534038,524288 --field-trial-handle=2292,i,2037639913279199532,5684103709602392743,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:8
        8⤵
        
        PID:3444
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://click.kaspersky.com/?hl=es-MX&customization=&version=21.26.4.406&pid=230-Win&syst=Microsoft Windows 10 x64 Edition (build 19044)&error=29100&link=error&type=MsiError
        5⤵
        
        PID:5656
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\BF88AD71-9926-11F1-A924-E6015A89A547\GetSI.dll",SaveReportRunDllEntry "C:\Users\Admin\AppData\Local\Temp\BF88AD71-9926-11F1-A924-E6015A89A547\BF88AD72-9926-11F1-A924-E6015A89A547"
        5⤵
        Checks for any installed AV software in registry
        System Location Discovery: System Language Discovery
        
        PID:5204
- - C:\Windows\temp\6CFC318C52991F119A426E10A5985A74\Kaspersky Installer.exe
    "C:\Windows\temp\6CFC318C52991F119A426E10A5985A74\Kaspersky Installer.exe" -cleanup="C:\Users\Admin\AppData\Local\Temp\0E45C38C52991F119A426E10A5985A74;4636"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:784

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Checks for any installed AV software in registry
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5892
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding BE21BF328F5A8DD63BCF2C07CB334C45
  2⤵
  - Checks for any installed AV software in registry
  - System Location Discovery: System Language Discovery
  PID:4508
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4918FA2A8A8003C36F83949917D3864C E Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4600
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding C5E525B29BB4D679A826AF575085ADB5 E Global\MSI0000
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  PID:5584

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3904

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5400

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
PID:1420

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

kdscrl.rdb

Path C:\ProgramData\Kaspersky Lab Setup Files\KFA21.20.8.505.0.74.0\kdscrl.rdb
Size 3KB
SHA256 e6c0da20fc5d9eda24e4128faa5641f8b2d39951e0a0236c013e1f1efcbf83fd
MD5 79a78149e4ef2e6e09cc061338c7b151
SHA1 99505d2461a18f16d4d185603887c60e226347ee
SHA512 a3baf55b373b943f8f1c8840cdc2f02a94aed436c54fdcb8cf6eeac9b5840a5e1a11be0c70460da0c17f6fda1b01b87f4e2a688abb5ddeb7819301a1354d688e
TLSH
T14A5191D64838FA05CF89AA79887A4C076FF463C10B63AA1A7710DC9A1664772D80342E
MD5 SHA1 SHA512 TLSH

Submit Download

dynamic.ini

Path C:\ProgramData\Kaspersky Lab Setup Files\KFA21.26.4.406.0.66.0\au_setup_C83C54E3-9925-11F1-A924-E6015A89A547\dynamic.ini
Size 142B
SHA256 c7a3dd62a1d52f22beb4b6570b6e576fd92784e07a9e372fb2bba699b1f52f9e
MD5 443936f4582f61c1efe26f4c8f9204b3
SHA1 5881f5c4276e8ab3aeff6b6ef8e738302544c342
SHA512 a73ba5fe7b5377cff500b1ba81be0905abd9f797d838caf98aacba0ce11377fd442dbc58821cebb8244ded7e0d989a68ce22a799b5eb3fe2366aa710eb329d4d
TLSH
T1B4C09260BFE56423F0FB85D2EA3300468D92B5033409CC1F90C9052980B2C46098BA0F
MD5 SHA1 SHA512 TLSH

Submit Download

startup.exe

Path C:\ProgramData\Kaspersky Lab Setup Files\KFA21.26.4.406.0.66.0\au_setup_C83C54E3-9925-11F1-A924-E6015A89A547\startup.exe
Size 6.7MB
SHA256 b423ab5bedbf216191dcf5f0092591abc027e41b5e2c8970d2c498d71111b7e8
MD5 d1aa1a766b19c453dabfaad999053e48
SHA1 44483b6b8dcda8e3ff63938557a677286618a9cf
SHA512 04ba4d820be247fa7b67a72b1b55fb2ce2262103286faab2ad2c9a1b203742245f7b0a6b092c7ff8ebb08d5d6765f3b1380b9de877e0f660015d9c7fb3b5dca4
SSDEEP 98304:jOTfOPgU2vv161ErDORJg702mYAmp87fkZNxDvF4efU/wGpgzZWJXDMw69eJ6:+O4UgUe3ORa702phsaNRvCeUvoQb6gs
TLSH
T18666F0256E3D9121F462853C156DA237E5BBBBDCBB1F058B62B4223B1B63780492D373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

static.ini

Path C:\ProgramData\Kaspersky Lab Setup Files\KFA21.26.4.406.0.66.0\au_setup_C83C54E3-9925-11F1-A924-E6015A89A547\static.ini
Size 582B
SHA256 472561a0302242ba98268f56a1573b7835c1466e6d5ee9008368ade310aef6fc
MD5 8f5e6dcb2a8c4d443e6710aa6b934217
SHA1 c88c154ac636c9283fcbc8c175b4abcdf1ebf58c
SHA512 75308297748806c2b7b2d89c1b3981f804c93cdb63191494c462116340eb1f08a5c5dc00bba12a80d149f6b529791abdc79b7499abf3c65ca128fe72dde21f39
TLSH
T18EF0749293F51409F6BF5BA4EA7964650ABBBD765A09C81C50C1044D45F2B40C9F63A3
MD5 SHA1 SHA512 TLSH

Submit Download

common.kcat

Path C:\ProgramData\Kaspersky Lab Setup Files\KFA21.26.4.406.0.66.0\common.kcat
Size 3KB
SHA256 60f81b81251f4e009ee941aa706580c53a14b51b49ffd5b63e52dd6944dccdd1
MD5 eed225c7e29f8d84b466f43a758be858
SHA1 bd1186635498def4967501cbe88dc467b5f347b6
SHA512 142ad091ec39b1756faa0bb1f71efd396c97a78674c9550178ef854ae02db1ef96fdd4bf51a7acce3255936986c2c56fb3f75e3028d352824216f9efc7648d06
TLSH
T11C5185D20938F9026BC6EF98897F8C1B5FF023D10B529A176316CC6455A873ADE0747D
MD5 SHA1 SHA512 TLSH

Submit Download

common.z

Path C:\ProgramData\Kaspersky Lab Setup Files\KFA21.26.4.406.0.66.0\common.z
Size 14.8MB
SHA256 57ba256aea94d323b240dfa8ee50a60704b43b9a21fbf6eb4c0be891cbb9370b
MD5 9c59093d780dc0c17cba72d361323c73
SHA1 7f2824da6a8fd190ac64ea35f2b88f24354d2f8d
SHA512 df6def2fc7137a287bedbcd82eecd997492e4e322c5f9bf789385287e216978123d750691af40a5040ff4e0eec4c34f004e09dbe1546797376f87abd26c74398
SSDEEP 393216:mg5xF06sAGQCQBHznbWdITa1UUPRVUIDDZcvX:V5xa6sRhQBHbbvd62IvZW
TLSH
T1FAF6336F1EB273D2C65E03B8D9C7A1B7974C0416349F8AA297D209E2C272F75C476970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

coreproduct.z

Path C:\ProgramData\Kaspersky Lab Setup Files\KFA21.26.4.406.0.66.0\coreproduct.z
Size 33.4MB
SHA256 79582bbc13298e978e5bd0097207ddf40d24846960c8835c57b39c523676d932
MD5 e78e2486e7596eac00fb231cfe95838b
SHA1 71f355678fb5575f465193e8a1581d1f585b0a23
SHA512 772aa34d89a45b3e64f1aaba1e5f49f1e754c192f750f62836e3227bb5eb776076914c0986287401c84fdf7c0370cc861efb01b1c3f32c87058293de17ff6897
SSDEEP 786432:Pwj97gyMxjiEi61w6g+1ODpVHgRbt7UsCeu9C7CBsccPejZM2:PwjpgyMxjiEi6y6t2fQ7fKC7a33
TLSH
T1227733B1F64C59F1D020A7F90F86FE80722E6FCED898F302656E86D965400DBAB467C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

coreproductgdpr.z

Path C:\ProgramData\Kaspersky Lab Setup Files\KFA21.26.4.406.0.66.0\coreproductgdpr.z
Size 79KB
SHA256 72a808b1c2b0d9b2cba265a3494335ecefd729d5bfb6fd5c21d190df1fb69e4c
MD5 df1a749f186af911a276de88b63186ff
SHA1 8888d172e3960a937a8e8641ac81ab23f73aaf22
SHA512 5a0834c30ede457a9ae9ac43b5ba14b978a14a7125591093ea998c6a5e53f877a99966f4d14e93ed4ec7afb660a4825bbe66e49e3c7fabc3ec03e04cb00b8974
SSDEEP 1536:K8QhAfSMLmWW0I93rEqmwsOnGEvLujvXQQiVcPaBu:eAfSDl0I9Mw40kv8E
TLSH
T1C183022C6C91A3A6106D76F190FEC2A05D1DDEA35809FCFFB10419CADB2DC2CAB51984
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

coreproductnogdpr.z

Path C:\ProgramData\Kaspersky Lab Setup Files\KFA21.26.4.406.0.66.0\coreproductnogdpr.z
Size 75KB
SHA256 2f29b1c06a01dd64b5be2ea5513b92d3a3601f92dbfb7a762c7d0dbfe9d8c372
MD5 1a9b4939de84498a756062fe43ce097f
SHA1 11130a3a01d27da234c59b1ef614a753b8ef4893
SHA512 5e316784eefe41997c114ca615b9f46a84646d646a95c2488bf2de507ad66fa668b2e82435b5a9d985f3f642e04029fe16bac17f37478b230c9ff30fde3fb563
SSDEEP 1536:TgTFO8Rgfog/kKICEqy4tpZp0Njvvphg9eY+6zt+Z5wJ17:TgTFDPg/LI356pZpwDrMeYpJx
TLSH
T11673122E554463A8A1FCA3D09D1F4364A184A32887EC65CFBC431FC54A0C92F89B56EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

coreproductx64.z

Path C:\ProgramData\Kaspersky Lab Setup Files\KFA21.26.4.406.0.66.0\coreproductx64.z
Size 12.9MB
SHA256 70584b255225c3932d16d53b925207036919e7f0cc4e9c3e380f7f174248d345
MD5 68d53a8f6f5d852a864feb6ab08f50da
SHA1 f48e79dc16aef34390f90984819dfab4945db1e7
SHA512 0da957c0e7074e13ed8dd19875ef0ab33b3c5b81be149240040596d9d26e0ec625c888bc426a7152ce13a30fff409126187eed1e1878a22ad9e195426640dff1
SSDEEP 393216:XjET0uRLsbRtuLQBdzfZIaoqi7iK0AIOmqj:O019t0QBdzfZ4z9XPd
TLSH
T1B0D633229023F054C69F7D7A5D9B92E23AABC94F687383D3D4735C752EEC281EB86140
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ipm.cab

Path C:\ProgramData\Kaspersky Lab Setup Files\KFA21.26.4.406.0.66.0\ipm.cab
Size 142KB
SHA256 ac9a3a5477d55bcb9cd63374e3023d4c33d9423fedd33a115dc3c84eb7628ec0
MD5 559e5a3d5b2a6a1f0ccc93f54da1b931
SHA1 b104ff91b025a9f05500d695dc0f12832feaa7e1
SHA512 ec94b9f3cb7b6b86d99ed32dc02ab85f6355ec266a5b68f2121e0dd04df4646824498670c97580c7c1428d19d332543fd042c7f03dd20919fa8caa68a3b0a7c1
SSDEEP 3072:2ZhnJgWqiAGnPVVN4pgsCG0oE3v9y8F8FruEmMWsTKKL/TL2:egUPVVipgxGyVtF8FruEeM/TL2
TLSH
T1A1E302A27DBC5C4F5917971DE5C0A8A19F3CA96D2BE3FCD72129500CAB417D1368E328
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kdscrl.rdb.z

Path C:\ProgramData\Kaspersky Lab Setup Files\KFA21.26.4.406.0.66.0\kdscrl.rdb.z
Size 5KB
SHA256 4d472e1e7142bd144622200fca0236ce0deb52c70599b2891392f85f8d96a2f2
MD5 2c18011cd76bbfca0e10119fba965d6e
SHA1 973b8bb876e716c5245b2695cc3b3d1efeaa0b2a
SHA512 abc6f6a97a78b3ad0131044cc13bc589ad88bfc875133067e45040291055a34a9ace47acd61ded19bcc688174ab3395d679e0c822130c24b879976cbc70e047e
SSDEEP 96:ad8Y7OZGhbpGD4C6Eo6ms62cgVPdOXCXEFYlrQbEmAhsR7yz6:a17OEbpG8xJs62cWECXEFYlkbE/hYyu
TLSH
T103C13C2A2E41518078F3F9F5CD775BE849648F5B0E99C6FA694324408708F7CE7B65C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kleaner.pack

Path C:\ProgramData\Kaspersky Lab Setup Files\KFA21.26.4.406.0.66.0\kleaner.pack
Size 5.4MB
SHA256 46ab360ce9ace1fb12d6cdbabb0ab7aee4b4b2bcbe6d23696d5bfcc6d45fc9ec
MD5 bd37ab60eabf19f7519cc18e69d14aa8
SHA1 55b743fd9a6072b39aa13675a347c90ed330c08c
SHA512 e8970699d821ccfb4bbc92ae8db74a2e693815c6e93d1256ad6368e23a0a3b46baa12f681498b3278f3a6bfcf50721c71fd809bf450eeec23e16d88a80edb815
SSDEEP 98304:uOvFLUboxFs0JJCC0MqPzQ07UUDPuXahXDEFaTUnzEAvbQs+KGNVDxzP:JvFLU8xXJ0CzqrpIaHjTgzJcHHlP
TLSH
T1F646335B7FD39FA7BF4EC253B88CA9B00BDB4123840ED147765984A6A45233DA65E0C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

product.cab

Path C:\ProgramData\Kaspersky Lab Setup Files\KFA21.26.4.406.0.66.0\product.cab
Size 4.2MB
SHA256 418bf7452b13a9c0e7eac4ddf187c7de59cc82fe368fb3a127957aea024deb8e
MD5 cb8f3153d76849aae4d2952d48e4a77f
SHA1 1cff715c5000b5a9a7859e6d4c0d821bb8d6ec2b
SHA512 f5afe993a9c59733c138fa00edb7d3f46954de1fa2b8a25f87b2c6d39bc47296877b744851771a0a54e591090d4990afb373033cef272fa96f9be752a0b777dd
SSDEEP 49152:1DPZcb2coZNow3ZB/BUWQeZwDaxwuMAAuMilduMn1J6hal8:1LZcSnZB/BJQeZZwzAAuLBm06
TLSH
T1B4167D5F668CC421D796097C39EA5779A36CDB2D07E28EC323C467290E606C9F5BCB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

product.kcat

Path C:\ProgramData\Kaspersky Lab Setup Files\KFA21.26.4.406.0.66.0\product.kcat
Size 3KB
SHA256 f59584541edc6e8e046915ee56afc81068d37262b9d93eb6e6c05c5c78fa72bc
MD5 6e8de6964a9840e363e9d740f1f3fb3e
SHA1 49969035d0d9a69f6b104448856c381193049012
SHA512 d34fa5491c79d9189b8e6568321b272ad54b610ed93376e1aa6ed8f5dde44f94dc763def139a7454140e14a4db6caa469710fa80a693175e863c13757bb59a28
TLSH
T13561A6D60938FA016FC6EB558A7B4C0F1FF023D08B515A17A716DC651AA873ACE4387D
MD5 SHA1 SHA512 TLSH

Submit Download

product.msi

Path C:\ProgramData\Kaspersky Lab Setup Files\KFA21.26.4.406.0.66.0\product.msi
Size 17.8MB
SHA256 bbedbf2680f6ddd5ebd1c4c454c9516eb37559ecab4f63914ddf856bcf068b64
MD5 fdca03faade770c6a9f73069a8579b09
SHA1 25f23472ca43075ddff9ccbd5bb169e2b86b73af
SHA512 a3655e34b021e93453236015b0c4a68426827d26b67b859ad95bbb335ecccc5b21d5d0754c9196dc6350b347b426a92b856d90765c5d9a36a64fae34a6e64d49
SSDEEP 393216:mrrPgRxIq2p1A7EgB0QNnW82RB5Jf8mOoj0k0VY/G3DES8sHtW:mHPgRxIAj6QBW8IJf0oj/0V0GTE9s
TLSH
T16017AD226EB49435F1AA423459B99673D27BBF210B3389CB6380772F6D716C0A635733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

startup.bin

Path C:\ProgramData\Kaspersky Lab Setup Files\KFA21.26.4.406.0.66.0\startup.bin
Size 6.7MB
SHA256 3dc1fcc2f74fcf1723ff9431197d5c919229d4427f5ada1e288e9df9b08c65aa
MD5 1f2c6de7ab235c5022e46446d8d3dd31
SHA1 76854e239e0237063105546c7d8ac1d087bec577
SHA512 475b0cc5fbe1216ac4f9aebc9acc68caa655173d2c74cf266c114547ee44ea5cd1433560e703f4a93e79473c5680d75204ec722460d3d11acd2681893e6d509c
SSDEEP 98304:rOTfOPgU2vv161ErDORJg702mYAmp87fkZNxDvF4efU/wGpgzZWJXDMw69eJ0:2O4UgUe3ORa702phsaNRvCeUvoQb6gm
TLSH
T16666F0256E3D9121F462853C156DA237E5BBBBDCBB1F058B62B4223B1B63780492D373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

startup_m.bin

Path C:\ProgramData\Kaspersky Lab Setup Files\KFA21.26.4.406.0.66.0\startup_m.bin
Size 6.7MB
SHA256 57567e1ccbd684363a74846c6adb4c09e40785acc8d65999e0153ddcb6294875
MD5 9337f8d1138f0fc33ab49cc681f2a33b
SHA1 3f5e12dc929d56824f487a728ad4cf4be2ce5ef8
SHA512 92420169be925e347d1c199574e03c12b392e3e24a22dcad8fc91538165834ab9856def1654c716107815301061403e7be3ea171effd69dd88b367555fefd877
SSDEEP 98304:VOTf3qPgU2vv161ErDORJg702mYAmp87fkZNxDvF4efU/wGpgzZWJXDMw69eJ8:k3q4UgUe3ORa702phsaNRvCeUvoQb6gq
TLSH
T12666F0256E3D9121F462853C156DA237E5BBBBDCBB1F058B62B4223B1B63780492D373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

startup_o.bin

Path C:\ProgramData\Kaspersky Lab Setup Files\KFA21.26.4.406.0.66.0\startup_o.bin
Size 6.7MB
SHA256 ace0f91d75975fa4def2b6f06d934c08038fd45f15ec4959abb33a9239f6a1c5
MD5 e6a825e541f3291c1c58c6a8255f14dc
SHA1 786afdcf605ba58f3fed24d17d2c12b422193b1a
SHA512 777733a79dcbc8d6480dcffc13264f107c5939f406bca966eb3906f0c8aab3f8d96ee8a8cadbf6b1ef65389072f15a4a49194f6f01249dde10f82a66beeabca3
SSDEEP 98304:4OTfFoPgU2vv161ErDORJg702mYAmp87fkZNxDvF4efU/wGpgzZWJXDMw69eJs:/Fo4UgUe3ORa702phsaNRvCeUvoQb6gi
TLSH
T10F66F0256E3D9121F462853C156DA237E5BBBBDCBB1F058B62B4223B1B63780492D373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x64.cab

Path C:\ProgramData\Kaspersky Lab Setup Files\KFA21.26.4.406.0.66.0\x64.cab
Size 3.5MB
SHA256 d74dfa2e1798d02057960fa677c7e15cac88c1f7d6083a8ca68298897f1ec8b2
MD5 827ff14e7c745f81b6fa94c1eb2b3030
SHA1 51a3039aaecc90e2f8bb0f49763bd957ac40fba4
SHA512 cd4de1abc868bc239eb77d74d2eaf7f11c7d969a29131e9cad4de852f1d572da045f45a4277e7325fcc69fda0f6b836d8fe1e295d7823195601bc73fd65c0ac2
SSDEEP 49152:yqRgTtWSjwiPykvMeUmUANksPmMUbVqW5CYkgSla:1WJPb/KrjH
TLSH
T19906C63EE1B564E0E95AC07C49D7A72A9BB3372C075091C7AB638322EB136F81536357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fc69248227d1b80ff41106426895bcd599abcddfbfe7fdbeabc0fcc2aca903ae
MD5 be6741080fa256162cf6b0264133ca7c
SHA1 4914334b0edd1e4c3a470920450bdee63ee2f5b6
SHA512 8d42ac6412ff316aaa68e317e92c2167dbcac331381aec8d8be8410c5bfab4657127a0601dfc90f771660e393667d62af5e917155d6fcc5c7aa6a8ca1e03f903
TLSH
T149D08037394D7015E35D5175A463C7152B664C611497DF01F166CA7CD9B61C462C71C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 35d5e1025fad043e06b3ac867171663a9d7e206f6c2fe3799c6326407d425d9e
MD5 e56a2ee52ba2c562f5f883392a3fee2a
SHA1 7d9c1a163e75801e0ca8b0786b42b2586bd81943
SHA512 6032babf97b45862e157ebd33732372d19dbafe1ce5a8d403831bafded6832dfa786f384a7f56def2c5056ccc89d0836eabc9093552e9ec5e0548d9ea5758358
TLSH
T103D02374785975F1D12C103D5470520436654D7322EBDB42F0664C6CDEB10C4A1DFDE5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d14941b026df172f86ee25265e61d2b9ca402e4145162fe7ef1f9c8993c6a286
MD5 ffef3b408bf2975570e3ac9b68bcf47f
SHA1 51d0e8a2cdc166f0c7a28fd32696e9032cc7d07f
SHA512 2b94ee9bdbbd8adef7471ddcf498d04cbca0f09da28c0d13ae0264c454ada37e772a719078c84279910df7d7c894d5ea050e963c65de83c1679edf239d8285bf
TLSH
T1EAD0A779744A6125C5490035646153443762483034EFEE52D1EB5928AA9118462DE0A9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b533b12de74a190c16f73bb006b7aa0f9a3c14760e6a8eabaacc7967c3aa881c
MD5 20c123ec382320ef70e259f966dcafd0
SHA1 464f7e127690514641d0a9704cf026b6061ac591
SHA512 9cbbf5b443392156893677490d1153a9cb6da2c8beb8a813aba76d7416b792e04167f9649dee47073ae6990db9f8d2f686870b8e1769bf0505fa1f4902aec677
TLSH
T144D0A77574465225C549003564A153443762483134EFEE56D1EB5928BA9119462DE0A9
MD5 SHA1 SHA512 TLSH

Submit Download

3f76f5e2-8123-433d-8211-9bfdcdbe50b9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3f76f5e2-8123-433d-8211-9bfdcdbe50b9.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2fa17cc7d34dd26ebbc2ea1b3fbac0bc5d45c5aa9f9ad78dff27e15ca5b895b9
MD5 688cc01202db68fd099980990434a07d
SHA1 6609f4f030e4012e87da95cdafc390e782ae07a5
SHA512 15681966ae7270ef5e653d51d9a137a48f8ca35edad0d891d3beb109e7a5ab227dfabcd4f4552847bbcd2cf9339ee43935de0f2c431542464e88af69f827b16b
TLSH
T1CBE022E9CC71A83708FD1B189061074AE786239B2F90898B3A3C91088FB1637819BC1C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00009c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009c
Size 17KB
SHA256 d2eb3e0bea77ff01cd7c8cc57ac6b75fa9792d742abfe8192cc947e6e3cba628
MD5 93f058a3eaa4f272862cc5adda04e618
SHA1 64eb5e4e5341052998b16f4100ff854860a0df67
SHA512 39031c97268e4a7df128765a3597c902733b49208fbc0e2d69df2f10ed6beae31cb792bad11d55078348acdb84bf94ed1cda4b8512c65060e6088bc6fdb9fb22
SSDEEP 384:Vuoq6IuPTfRBDTJxL6jz6408BaZBwKigO7Zzbbf8te4F:+PuPTff/Jx6ju4paZBwK2lfkF
TLSH
T11C82D0AC1CD393C01073AF23A1399A47FC9D67C214452D56636CBD81BFBE209BAF2846
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009e
Size 34KB
SHA256 9ac0033a00c0403cf6453228b4607129b58a2e139193932f206afe71bcdd7890
MD5 89c0889b2725cf6ff54bb5be6ccca67a
SHA1 53121af1e2465d74e1199d3c1db2f0c1008f8835
SHA512 cf333fabe00f206aa29df3bced1a4980fb5df3ce1f48f5f4abfa10e9d1170795612392fdbdcd14407a022c500481debe7227c266167294c22b67dd7ac19cb94b
SSDEEP 768:ohRPwi9VT87t7Sm3Uzf9NwVoZXM2rHAgAAIF9PQ06tL8isBVxucoJ6b:oT4UVTekzfQVoVrrHA7hHPutL5s/LP
TLSH
T147F2F16BF7A7A19DC0A2059F1D062BECC4D1A00A0BAE7AD7F0E5F449682393151E5B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009f
Size 26KB
SHA256 b3b2536b892cda7294b31ab03ae68c4680e858f451fa736481d20226d0abd1ad
MD5 c854a81c904d4bcfcc800a190e06e853
SHA1 8295acc0dd1b1cdb02e5cca9e819248debefff13
SHA512 f1deb73e1cab55c6230f534420c21316f122f6361d686be48412f1a03888be97010073d44e22af6af53c91043ac1471203400b588348b00aac1f0a0407499ad1
SSDEEP 768:yyIAbBoqSqLe/nb4Zw1eo5IJnMB85wiGglT/TI:yyIAbB8qC/b4ZuIJMB2GglT/s
TLSH
T108C2E14A6559842161A70728E4852B786CB4D9AC1E17F1D44CC0F4BBEC9C4BAAFFE6C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b33c4c420203444b6e6abc8dc3308e572501171a9caf491a1829ce04d225344a
MD5 3be5e5fbfe6f11efb66705e7e6d1d7b3
SHA1 2aaf30c4f05209b258aecaccac49a24718596b3e
SHA512 36e680886f21638598d8a74e33d051d46dddf1d82d698edf5ff92a50f38ca85c895836d9b93a93eb11faf0b695b91f0f8a322d8e7d600f48487ca3e7dcc89bc8
TLSH
T1458191990286B4AFE7DD02B094E105F034B789E67ED3CE153720A9B5330EFAF5827920
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8eaddcadee928f4794c61d387a835bb05c37e6357987a1c5134cf75190d4df3c
MD5 d7dc24c21b37899f0c1633ab1026ddc1
SHA1 4c4667581fb8060a23abbb333c46e6dd0da6a29e
SHA512 12e5b1e763062fe280ceea5f485946947cd5de73e737917b830dffe3dace1ee18ba66e89b6353e64be11352f8b40b656eda6b4d91260218c7c09bfe694ea1241
TLSH
T18C71E6AA020A74AFE3DC42B184E105F474B781DA7DD3CD153724AAB9330EFAF8857924
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b28a3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5b28a3.TMP
Size 3KB
SHA256 f743ed4f2b3bdc495dd70a5dee79e927210fdda60a2c7037e91019be5eb34bbe
MD5 4adbc45460ef0776887fdcd10d3ac30e
SHA1 45cad25519380c15b925070cf97a30f95945bf54
SHA512 87a3325d75baf7f987f633a02fe745a75086685067ccf01c89a74668e3009c51a07ef2844931df1ff1b70ab10671c5ad36f9726ddc180d1a7d65d03c64f25dd8
TLSH
T12361609A0302749FE35D027094E106F074B385C5BDD3CD413324A9B5330EF6F485B920
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 6d42471921d95ac7d7213f26c72181787c7aac3879625bd2e3cb40f4e8400742
MD5 004a43bde5f246ac474bd389e2b34bfd
SHA1 77bb3d809b4f68d55735d4d505bb53ca73aa5fce
SHA512 8653db5ea92e9623e420443eaf56340f6b1f612a0ad74bc342fc50a1a809b286fce206071d69d29b2559904a655dd02c123b776d7bb55b78351761f372004ec9
SSDEEP 96:D1+O4draaij6Lz/TP0YXUdA4ry9gWrz/NCBwBHx:D1t4draaij6LTT9XUdA4ry9gWrzVCkHx
TLSH
T129A188F7C3E5856ECA0195F4AA18BE1BDF6D0624431C7C5AC8D4EE1793E3471E041A5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 483085a567549e3acd9359bfb63db7ee0df7581908c4951147611c6db254e3f4
MD5 db0839300225225968f05b9272c3a0e0
SHA1 7c996bab953567d46be8912f18ffb4343ac6cbd3
SHA512 efce5e9b9311ac976ba4e976d47e2b8e47d3ae71037d115f215c4a9a73f6df84587ac2d18e08dd1687c9c73c6ccd28b344509bc95411a6a49ad43629fc3ba279
SSDEEP 96:D1HO/aaij6LzonAUUdxgCnGAzWr/27TwBP:D1u/aaij6L8nAUUdxgsGAzWre7TkP
TLSH
T1FC91C9F7C3F5956ECA0199F4AA18BE1BDF6C0624431C7C5AC8E4AE1793E3471E001A5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 5a5506310308c4162571a15a9cc039ac5c1fe878efcd810a54a4f8184d139dae
MD5 051e65122ce616cafce4b90a3fbbad0d
SHA1 237f07782051eaab2a5d5493188667ba8adeba68
SHA512 6207f4f5012670e58c09491108fc3f5671a39d420f9e09712f9139bcc30290be98f4d88915e676c0be4f794521b2c494fe9d34fcf8c41f9a3ed47f5afaf183b7
SSDEEP 96:D1HO/aaij6LzonAUUdxgCBAzWr/27lGwBP:D1u/aaij6L8nAUUdxgCAzWre7lGkP
TLSH
T1A091C9F7C3F5956ECA0199F4AA18BE1BDF6C0624431C7C5AC8E4AE1793E3471E001A5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 d1e1ac193d0ed2b0babd3d6f70df910b449f098bc8ee6e8ccffd45a76b28175b
MD5 7cb17972062054114725a5a3d5ae1e1f
SHA1 ab49981e25de1fd2f3c10810017541eb5e8237a4
SHA512 f4ff88b7aa00b93efee7334439bc96f0261c16ee0798c1a057ce96ea9349c4545bd3feedee91502cb2448a6954ecec04f9e866fe3b9f2830cf86bd2260330bbb
TLSH
T1D3313B97877EF46710780D6F2D5A7C055A7AF83611A1A4F8DEBAC13DB0C48F70B16416
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 10b0d8ff2f2444e54f0dd59d454aab3b0b92a584533b3344d1e191f1b08fe6bb
MD5 2a43e460c8a666772774e43225438df5
SHA1 38b63135c3337f1a914a2edeec4349fdc0554a40
SHA512 6c9d1a1a78893e712641339f60e7f68fb742a173029e93390b9c6b9fb4f8d595fca1ff21b68c676d17da7451d76df8135bf5e4d7b7f160f32961a285ee63b301
SSDEEP 192:sxZuRoyMqZjK1Ml8Mjj/fjsGBkYZZyb5KzodpHiHW6+WN3Fr/wuC5bTB8j01xNIU:sxZuN7j/fjsGBkmZo5xCHbl/E1jtV
TLSH
T1977209466938597B9CCBE619F945BB53D3F8557392904E449AFCCA0C00EBBEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 2e0591503a35ed6c45d0d5f6fe11559fcc8f1500cbca7a22fdc2371e660d524b
MD5 77eb0ae462a1bab661ed94ea70f290ab
SHA1 c5f512123404525bb90643160c9cbf1d999a2645
SHA512 75ddffdd93e34a1aa35d518786a72284839cbbc4728a858f6f8dcdfb0352b68bd448b6d29f60f63c7b5330ebaba53279744c77366c6b6ad0bcf51e6c64608471
SSDEEP 384:sxZuNfj/fjsoWvxBEmZo5GCHbVPTtRVtFA:sGNj/fDYxuPNHbVrtFFA
TLSH
T1E882E746A934597B9CDBE219F945BB53D7F8546292904E449AFC8E1C00EBBED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 e737b45ace771b60c4d709da12d5c33ae3ac719f9b565612d035a0beb7144f44
MD5 dbd82aedb9b37cc55d6ebb858b9c2618
SHA1 7134a3f4e599496de3041c695063d06873bc033a
SHA512 b6bde6b3b4d2888f4355173a9ce6dd909eaf01dc7d5d5c71378b758c634c554c426a8cc45d7bc6cce101b78eb4c5331b91e6a03611081cf3ab39f60b6c8bc155
SSDEEP 384:sxZuK/j/fjsnqWvCBEmZo59bHbRe94jpsVtU:sGOj/faqYCuPtHbRyq8U
TLSH
T1C782E746A934597BDCD7E219F945BB63D7F8542392904E449AFC8E1C00EBBED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 7429608180b6429acba07f462acca9ebf77311a23b4c2ca44f7faf665e9a2a2a
MD5 b6926e14ea2f24c55e50858ccc5f6d2f
SHA1 16c44741004d1b1a0f7f2ec282f02c97672db219
SHA512 877e4847306956a1c9d55ac3b725989cbbe388b6aba4421adcc07e6fee912c72c670da1a810b65797950226cffc339d314608bc6b71588f86b4d4aa89818c613
SSDEEP 384:sxZuKfj/fjsnqWvCBEmZo5VPHbVhDQ4VtFA:sGKj/faqYCuPVHbVpQwFA
TLSH
T15382F845A938597BDCD7E219F945BB63D7F8553292804E449AFC8E1C00EBBEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 d736bdd9a759bac3603bd4c92e482ef925618f2f588da5a2c50f5b9946878148
MD5 cd130411c8a96d1eb40055c5cb09fcee
SHA1 658a94a7c8ba81a7130cd922df9da55d0173c83b
SHA512 430196e7824ca8e7468d89dd7b908b027b6502ad0aade4280d69470b6ec3af82552b86dc519c607302bbe21a3ee6fc67ea50f3662637b032169d901abb7dc221
SSDEEP 768:P4E/ael7pLuLnC6WvCuFO8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/6yVLlFX6BaroJ:P4E/aezEnC6WvCuFOu1jaq6yVLfqBRV/
TLSH
T183F20B3B2C0CCB7E4F844E9CEC2A7E9A6DE801CB5698899447FA841C03C67EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 115648e7f6a044e14cebf95336b97978072e91d89dfc341c6b83d7be40966708
MD5 04dd3b05e04b81676475a7ae4bb33be6
SHA1 78bd512cc61744d0aa984ecc86ecef602561de94
SHA512 62cd7bfd1bc0d6b04526f1fe2f92eb7807dc3f760d574a73b844bfebffceabea19a572fd43e036b534da584e57575e80ff194f1530bb1d7e9f9a2ab6cfd59220
SSDEEP 192:OotE42aG3iLEAs1AOvQA7uItfg1MhlfznKzO5tZBBHaFlufF5XYP7cNBv3dR5LAl:8ptDYDcfvNR1ANAJ/Xg
TLSH
T13EB27C16713B065138BF250CA69399378E4235A33818E4EF7BB914A21F67E225DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 e7c9a30ad5fcd5860316d4ae06069df2599ddc1b27f14a9eabf912a8b1885b2b
MD5 560e825966c43e53a574f92f09bebebf
SHA1 d0eff2c4ff305c6af26f5b322d84051af955ed88
SHA512 3524287a0f4db6b751a9410c7dfe2c79a843c0bfdd668ba749129ccd12607a5dafb7155781d79ec058bb76d6570e1421f8e1bebe25ee921718e1449cecb9d482
SSDEEP 384:n7iFPZcIIDsNLG8TUNTUlI4kv6DcYeTsJbf9GR/vMsXKIBVsOOPrXLpe8C/4Jx//:WFHggGwgmQSGJvZDsOi9Pr
TLSH
T191F2C5F198D78977E9AE9B87A77D2E029AFCD053B5884A84B7D44D0CCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 5126f94d2f53d7f55519515e9752c73d17288597c43cd4e13a0320915233b077
MD5 3cafe465a4548e04dee441231ba4e98e
SHA1 26ec69f6df6633266e9aabe17a3bcc9e29f39bc4
SHA512 2e8a7cd3396960fe9dd18ec98ee5bd8f2fa1dc8b0f68e4acc0582fa0a3f5d778b0c5b6cdb70de9d91183c805479b535fe7a5757e7674936c91469680782a867f
SSDEEP 384:npiF9CcmyWCs3sNMt8TUNTUlImkrDcYhZ9JBfpGR/vMzw5hkP+lFYS/QfIHy/7Iy:AFccps3twgxlfGJv80hkoFYS/wiy
TLSH
T144B25B35ECA4CABBEDE68FD9E74E7A17DEE0016385985AD4EAD81D0D00C719D0347C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 f2a3d1089fb6d86a63111a8aadcaefac2c0161a860a69c3afb743a54f4d892d8
MD5 2e2f813827d59ad6be4b518a8ddf4866
SHA1 f67080cc8edbc23ab78993c7fcc14fd44a5061e7
SHA512 4b3df620ca4df442d9245236b060ab905674f280ce3ad2c24c8f4ee7ca1e2ef81ecbb03d7b6a80a4d06de6cdec92a44f0c9d379049a277fd6b919ded268018bb
SSDEEP 384:nqiFVZcIUsNLG8TUNTUlI4Av6DcYeTsJbf9/R/vMsXKIBSsOOPrXLpe8C/4Jx/7r:hFtUgGwgCQS/JvZcsOi9Pr
TLSH
T1D8F2C5F198D79977E9AE9B87A37D2E029AFCD053B5884A84B7D44D0CCC8617FC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 9565ab7829aee34e6a311be3df7076c475ec64bceab9f12ce6965bac95c4e4e0
MD5 9fb93adee9a845e3ad98d44fee7116f6
SHA1 b8bde93b606488b1df5f1b5ead15a1e2fd5d9db5
SHA512 1465d7cdcb4a46a618e60d3398b336ad08ffc704f2bb39980396fb2d742654028af9166123a2f62bc38efa8ceb68942a9d24e2b8adc2caf23cd5bf246f3b69c7
SSDEEP 384:nqiFPZcIUsNT8TUNTUlI4Av6DcY6TsJbfX/R/vMsXKIBSsOOPrXLpe8C/4Jx/7Ig:hFHUAwgCAa/JvZAsOi9Pr
TLSH
T1C0F2C5F198D79977E9AE9B87A37D2E029AFCD053B5884A84B7D44D0CCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 71fcecfc4064ba6fef4db44ff74f4cf91d0b5b078e89b46e6c1515859a97ca45
MD5 32e4f3cf6633282d123831352eb7c25c
SHA1 a3e883452c1fef0c21b615e3c032903b05ee1f37
SHA512 c5993da7600feb957a39d7c19b6904e8d8ab1ffa4c092ea28c05b5776a4a6e04d25eb2bc57abdb5292d0b867aa8ffb62fb1b01c682234196a2c58b187dde7003
SSDEEP 384:ntiFiZcISR3sNc8TUNTUlI4kj6DcYWjsJBfpGR/vMsXKIBNweOOPrXLpe8C/4Hys:kFQG3zwgiCaGJvZ7zOi9PR
TLSH
T1A6D24C71E8A4DAA7BDEAAFD5B78A3653DEF41163D5C88BC4E6D88D0C008719D070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 46fddefc4cfa0db2be8b43e7d08481eb75fb6f2ac0075790794519ccf8454d12
MD5 59f2906e61c639f8b2c89087ed38a68e
SHA1 184fb9082b8dc081801df3c4cfd5383d2380dada
SHA512 85d2a504aa08e00696fcebfe7912097a505e98d9b261ffbc7e5f7717d3a96c8d69cbdb9caf243a4a0c3bfdbdd37f793e2db03bafa2d68bfeba994dbcd6398a52
SSDEEP 384:n/iF9CcmyWCs3sN48TUNTUlImkrDcYW0JJBfpGR/vMsXKIBwwehkP+lFYS/QfIHI:KFccps3DwgxtLGJvZazhkoFYS/wiy
TLSH
T17BC25B35EC98CEA7FDD69BD9F78E3A53DEE010A385888AD0EAC84D1C008719D174BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 8a8e2ff72305a28b89acbaff88a4e7eb869622a001646fc3211105d68721c477
MD5 4661d8dab4b42d398292059d9f36ac50
SHA1 947004f7fde3dc7dab5016b5c42cdddcb0b3d65b
SHA512 e7af7bf0bcb6e527d612c440c63cb276f6b3c4fc6c50a38b197f2fd332774d417efd2031454aebb06f0c0cb32c22d9e7778029c5dd69ccfa5c86d600e1abe948
SSDEEP 384:nciFiZcIIR3sNc8TUNTUlI4kj6DcYW0sJBfpGR/vMsXKIB0weOOPrXLpe8C/4Hys:HFQM3zwgiZaGJvZ+zOi9PR
TLSH
T16CF2C5F198D78977E9AE9B87A77D2E029AFCD053B5884A84B7C44D0CCC861BFC706815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 f6d97ceda2796a4a3f68dcc7608b7683bf4648fa4fea38c1e728c768442062de
MD5 fee5e9900389e2146249523b4e191b49
SHA1 08132d0f23932a9cde7b6d123b93154b801b365f
SHA512 d2ae0b7e042b076131218767a0180544fc942081a51b7bd17f5bf66f07adbc77622f348486ca9c217bccd851d76dfd86d244343a1136efef53a3e7ee25c82ec8
SSDEEP 384:nmiFiZcISR3sNc8TUNTUlI4kj6DcYmjsJBfpGR/vMsXKIBNweOOPrXLpe8C/4Hys:NFQG3zwgi6aGJvZ7zOi9PR
TLSH
T10DD24B71E8A4DAA7BDEAAFD5B78A3653DEF41063D5C89BC4E6D88D0C008719D070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 006e01ce9368393aeb13ecf6f22eb9dd6486237118d8a31bc50a8a9e90055d07
MD5 edfba9b2ea611c42a75b74d6f3694af0
SHA1 95645b7ce2ea208b8c4b4c3887ed51c85c1ad085
SHA512 63ebe14dbc0a7884aef6cf1ab66e07ef39ecb96151d1ad5efa962174b2aacfdac7d0ae6415bfa7fe1c83b0809192c304b8dcb4eef610364c1296c64cefe63a07
SSDEEP 384:nqiFQZcI/sNT8TUNTUlI4Av6DcY6TsJifX/R/vMsXKIBSsOOPrXLpe8C/4Jx/7Ig:hFu/AwgCAV/JvZAsOi9Pr
TLSH
T1EBF2C5F198D79977E9AE9B87A37D2E029AFCD053B5884A84B7D44D0CCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 48753fcf571de13c4c6c81231660568c45e335fb339177af3ab3ff88b8e73e26
MD5 cf919b1fc536049bf59892b5320ada99
SHA1 a445c72d5200827cc1a36569d03b31175508c6cf
SHA512 b195f09070c3e5ff8a2e0eea13e380d2d13782855ff9663c477b197467e98fc061a7495ecdfa08e3c9a1a1ad6cfc351008631301a8d636e9b7579a2cae78eea6
SSDEEP 384:nqiFdZcIhsNT8TUNTUlI4Av6DcYVGsJifU/R/vMsXKIBYnZJJpwiF1K60lc4OOPF:hFFhAwgCSu/JvZunZBrrK60m4Oi9Pr
TLSH
T1D803A2F898D7897AD89EAB87577D2D1299BCC133B4A48988F7D44E0DCC6207FE306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 ecb8f63beaec1309be17a8450abb1a2d43766076301f5a5c77cf42d38b94e0ae
MD5 e5bebcf3a4357e840ce2bfbb3f9d35ab
SHA1 8c82e62995d919138f9afbdf811d0366ddbf3411
SHA512 b39abc416f53009afbda53462ac7a8ecb39fb2b46317a6575187c249780729729282b21a7ce5ffea3287a448c198414c5bf37ce7db8318b5180511938852f847
SSDEEP 384:nciFbZcIIDsNL38TUNTUlI4kj6DcYWJsJbf9GR/vMsXKIBUSJzmWF1K60lczOOPn:HFDgg3wgiISGJvZuAVrK60mzOi9PR
TLSH
T1F703B3F89CD7897AD8AEAB87977D2D1289BCC123F1A44588F7944E0DCC6607FE306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 11f4804be6659fc588f30038e448c6a77bbcf95c78e4e80e510f96b0f15ae19d
MD5 18eca094a06d80f31da23570cda3feda
SHA1 7fff6b2d6bc2b699f3d03d6a3cfd89210e39d1f5
SHA512 b3784db6e24a00058f9a2de153327f3131cfa7f782b79268d359f4f3f4c2d60e2953fd339e1d7595c5aba222a2c2e5e32fd45dbf077aaa177feec8224b1a9d52
TLSH
T126E002045611041ED030437000932F301FD4C54011210B47532402581C223003B106C0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5d0f54.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5d0f54.TMP
Size 392B
SHA256 a5d163455bb2a0f46e1dd53bfab7b939251a9f1a5bcc1cdd0876183301853b5e
MD5 58765cf79e85ae9ddb80298ce9c6d0ea
SHA1 5d303369989e480ca7547a63cde7f0c06298df88
SHA512 7ba0664a5dcb98be38244316342df12f04446b2bed2b8b0902d4da8ea001e6c6a45094717b7da56196824ab3c46ccea6ff23c3ffc9cd3456a4a9a8697068adf7
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 80d33d065a1fa7e56733c4fb831a8c1cec784494a6c58808efdef1c0adc8ae30
MD5 1279ade31ccfc715c281215dfb1dd0f7
SHA1 5d4d6f9f3560e7f9b628a57ecb183dfd6cb9991f
SHA512 e634ce5eeae140ec5980a4e9effc834976b535b91366d09312dfbf3160d25c5d1e166d80d4f7b62eecbcd27448b2af123d67ca4b1b1111c8bc64d0ae82a80bb5
SSDEEP 3:MsEllllkEthXllkl2zEolUt:/M/xT02zDc
TLSH
T1884404057FC1040DCD4410304431C3F11375DCD41D1157C334531D335CC5DC04D00404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 d0cc64f0b6590e81bbf58fdc9a30a0ec719657ee60432be7716b2c5fcfb4410f
MD5 398789b9c3bf054bd3c65ccc361e00d5
SHA1 f59d38f0b6526a399961cf4e96da89456f73bf03
SHA512 a1ebb64fe587f31745d1b62190bcb7f9613789689f7113cf9067b3ece1b0f50b2350b08c8db8ae761ba64e25f95deffd770c736a83eb023baabe0f5ac652e1ae
TLSH
T1E63100D148380AD6C4BD09BEB48739FC84E8D726B0E4743C68C8E9A85B6E65D645143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 510f638dd1744be80ebffdc2053c01b5a0bbaf729ac50fefedb6f0a48cc80099
MD5 7581ac75da665e57ca131b1e0e43a26f
SHA1 75d0485fadcb16a533ae222443d54589462ab03e
SHA512 9447415f6ca006e7d8f5fd801f417659219be9029639c479c52512e70e48f9f9d3f38aaf5d8eeaa20983896cfda65210299753edade6a1123ec778cc42bf648c
TLSH
T1D83100E148391AD5C4BD0DBEB08739FC94E8D625B4E4347D68C8EDA84BAE51D615083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 4a54404981de3184c2e61dffb513a933b3293b1554532a1a6dc04abc38da44c6
MD5 de6de34e973af25446bc62122be9adae
SHA1 875c4bd3d94ddfece12dd61f39346d4f65e45123
SHA512 05592af15a2963be2bf503f0e26592273eda4c87d582cd97acd11cf4689aa553ba94b76d09a8e723d48866d2b84b436fe0f508007fafb4c46c53825dbdb52c09
TLSH
T10E3123E148381AD1C4BD0EBEB08739FC44E8D626B5E4347968C8E9984A5E61D605043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 c66ffef4bafa83cf908225224ea26019f66103a0ca4efe65914e13b45bec56b3
MD5 b024060bddaa62bafdabd50648d6aed4
SHA1 7353c490653d11854e5fadf434c7c1858e013050
SHA512 07c7a0761b2fe9e1f5be879f6658682559c9ffb7e1c02af038d9c7b96dbe0979cb3cdddce279b6e6479349ed0f89839638553c516761f24c4316c667641b03d0
TLSH
T12A3122D148381ED1C4BD09AE648739FC44E8C32AB1E8707D5898E9951B7A64D744583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 1c674d647d20f4440b5c69c67e09c8fab4997326eb23d0fa97d8b65c8f01d713
MD5 884500b2951419c573b4508cbe48678d
SHA1 ca750b46e105bcc719065b93cbd5a91c9b3fb858
SHA512 1b4c52b1d80409bad8e0b7ad36fdbec9e3f279a0aab5a198c09050547400b61ac4d899db7eb4642cdbfa1ca8e60496bde33c14d2311fd505c9b45897ef38473d
TLSH
T1493122D148380ED6C4BD0ABE748739FC84E8D72AB1E430782888E9944B6E65D705143F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 17bc872902309fe4562b336c2808f64aab9b781a2b9a7742cbad1e44ef00d672
MD5 e09f7ebb81363f5f6c7fe6a8f18d1248
SHA1 8136dc7b67280feaaf3d0d22ab71cd8e04a9c8e1
SHA512 0a225940d761506be0aa38716048b8441c6289aa564448c106e07374f7b181ce15930775d2e1f3a5c21507072c5cdbd22d735e1bfbdc93f0d3ffa278d3811852
TLSH
T1DE411A58AAF91158B3B7BF5AABF2686D447FBC372E06C45D10000E4F0A22B40C871773
MD5 SHA1 SHA512 TLSH

Submit Download

kl.setup.ui.core.dll

Path C:\Users\Admin\AppData\Local\Temp\0E45C38C52991F119A426E10A5985A74\kl.setup.ui.core.dll
Size 84KB
SHA256 b0d787fcb13c898c8643841e81323c4661b0258f965586dcb496f574350a089b
MD5 7222812cb257ac6af69bee410e3c37da
SHA1 3c68980276f9396a7b0edc626740d0b5d28fb195
SHA512 b2a5b5f16a4083e3056d00efd40c1acf4c084e0ac411bb3be23157110d320f037863626d0b89c08c7a93a1b6bcf5d7128af1e79bd9997e46c10aae750c085100
SSDEEP 1536:WBPehlV/A/lu+bftwkL3actaYZ5387yjHQrFNKd0VKnx8D0:WPehl1A/bD3mYZ5387yb3IK
TLSH
T140835B5187FD1702E9FB0FB864F687540A71BA52FD81D39F5A08E08C1925780EA63B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kl.setup.ui.dll

Path C:\Users\Admin\AppData\Local\Temp\0E45C38C52991F119A426E10A5985A74\kl.setup.ui.dll
Size 287KB
SHA256 77ecbd88d7b601355ba6b28a15d10c67a6e52d34cf13309217476d032127cce7
MD5 8be133708d11d4fe2c4c6104bf9bc781
SHA1 bdc9d43584b81669275ed09a6d517da007dd0183
SHA512 cd57d8e576a676c0a5d829873c4c103fb09596fddc6af2f6527a4a1d9143b90551ecc635b431ff952d25ef20d10d990f9fe4ffd681eebe725b8652df843bb6c5
SSDEEP 3072:u4p1E9iJargq3Mv2XKzga2rrnrFc2ePc03Rx/ITjWzl:u4XKhrgq3P9nrzr8x/I3Wzl
TLSH
T159546C8151AE4920DE7F8B3DF0F25981AFB572873E46CB0D5A51B44C1E667C38B062BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kl.setup.ui.interoplayer.dll

Path C:\Users\Admin\AppData\Local\Temp\0E45C38C52991F119A426E10A5985A74\kl.setup.ui.interoplayer.dll
Size 57KB
SHA256 72ea6620b0b105b1fdd693c300d77349c7d13693b98b1c215e2c274de09d5528
MD5 b81370d7a74134f62117dff012b2d088
SHA1 5b74a5b32017dd8b6a90c6d454d39e436eb26317
SHA512 814ff5c239e878b88418e2b5b5c00f98759985cd44b6905352357003f2f113c13e2248f524c8e45678069a61a42477bb56d7b646aaed73f7f491e2ba02bf6ebd
SSDEEP 768:xhjs3IJ3gqpvQjDoIBCOikSFQP8SeFmCKdqhGrr2fnxi2ETRdy2EQ:xO3GR8DoI6kS88rFtKdrfKnxi3dym
TLSH
T1AA439D428BA85907EEBA4FBDB8F559150FB4F3475882E28E074DD0894A433506BE237F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kl.setup.ui.visuals.dll

Path C:\Users\Admin\AppData\Local\Temp\0E45C38C52991F119A426E10A5985A74\kl.setup.ui.visuals.dll
Size 87KB
SHA256 e23ba8e36cb8e48cd3eb8d3c9fcd8ce42137ca2b3a4d4cd768458f5533da8067
MD5 41d7e3958da5612753148cd66dd70e3c
SHA1 fed7e1072a96a91874543c1fcfa1c8b1e6feda26
SHA512 d856b5ee1871bb94db6e185ed4c20ae760e4707cca364ab5062c02a6353809a01b84a1c13aecbabffcf3abde32e8e689d828d3730eb2efb8c20b540889a76b7d
SSDEEP 1536:pqyDiKH3pWzkc5dH3mmmmmmmmmmmVvCY18Ego9y1/rFcKdMSKnxUfVg4:pq2YY1Xy1d3vL
TLSH
T10C935B9112645814DE378F39B4F268D9B1BA168B6FA1CB8D445D5A1C8EE020BCB137FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kl.ui.framework.dll

Path C:\Users\Admin\AppData\Local\Temp\0E45C38C52991F119A426E10A5985A74\kl.ui.framework.dll
Size 371KB
SHA256 b2f349f56e06de8c51c7bce6c9527da7ec4cd5f3769d95d7f2ee8aed838496c8
MD5 a9635e63d07499bc70934b1d961f87db
SHA1 701523618e57df7cdfefe878a2ac56944d9adfb1
SHA512 dbb8409d35120d1ecbd0adc2b2da5e08e110bc56de1d1ec152938a963b8b672915e41c5d01b6524c54531e698ebe202886812a048efcdb104f29a7e7c9f12c4b
SSDEEP 6144:FopqYnJsRvbaI5cvQWkoHu77n8fUsJPKv+pP6T9OS:PiJsRPmvSou778ZP7u/
TLSH
T12D848C8463E85B22CDAE4FB3F4A005588B36E002949BB75E26D5F2F54CB3750DD913AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kl.ui.framework.uikit.b2c.dll

Path C:\Users\Admin\AppData\Local\Temp\0E45C38C52991F119A426E10A5985A74\kl.ui.framework.uikit.b2c.dll
Size 694KB
SHA256 550ca9e9d7969daf12fdad68c3668226c88e6f28d941cca2b053e9e0a8b03a89
MD5 f01c9c2d3ed268a2e371a61dd9ef43a4
SHA1 b03806486ceba2df9f58fe7ad006b1bbacd7dcc5
SHA512 5363d1c9b479a78335c7c2dc292e73ff03af76622247889fc627dd24ff51e08b8421e77c4791ff24c92d2646435c0165b2cbb7785c08bf525df0e8b3a9541394
SSDEEP 3072:hz75N5blJogJJgkRPkFJIbrc91pNFpsuYGEAgNjZ6ObbwXvZPsvP+vcs2IRFFAuO:hhRPkF9nG9SErN
TLSH
T176E40CE412446A2CFB13D93AB1AE8D507A312436F6126FCF275ED07C56E14C28E93B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kl.ui.framework.uikit.dll

Path C:\Users\Admin\AppData\Local\Temp\0E45C38C52991F119A426E10A5985A74\kl.ui.framework.uikit.dll
Size 3.4MB
SHA256 eff0f027f46f9bfefea3360b63d25446d3bbe5db5452d16f7c570757120cd0ec
MD5 53849b06e3880f3969d228ca15cfbb7f
SHA1 c0fdd989afc29f6483bc041b5524788e70b16092
SHA512 87582ea6c51a46d9d306e60d2f1fa363f8382650c16376cb4841535addb2c5f9a616c17fdeebf7ea663a060be6a05cc8a7dbde172c66b6f047225afe1df6a57d
SSDEEP 24576:GBjf+SeMbd3RZ4XcrIAebKAHUOqUFd0eIIlm021EsWFuI:+dfvyskj+AwKaIlL
TLSH
T1EBF56BD163DC068DE9A7CF3CDE7A51A0533EF0B7BB29835C985E92385883B95D813612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kl.ui.framework.uikit.media.setup.dll

Path C:\Users\Admin\AppData\Local\Temp\0E45C38C52991F119A426E10A5985A74\kl.ui.framework.uikit.media.setup.dll
Size 264KB
SHA256 f839c27ef3e0ca393593c1cb9fc130c698cb20881f052d8da8de882eaf3e8699
MD5 c6542114aaba972428681a56853d4c98
SHA1 07b883f210e6fc19c1b4965efe1551ecd44c7cd7
SHA512 21702f76456a3208abfc4cfc3b3c5043825108678a2298ce2ada54209bd5fb54cb044350f3ee6d0cd896e310dc4032343426c49f58a0b8bf503312d87b2e19c3
SSDEEP 1536:I5Ugv0Mu1UC2H9TlYMl2/MI1CWxy9Kc9KmRMFRs7hVWme3mpM6BFycYMg9tMIRp9:0gWga7TrwOD15KtB
TLSH
T153440AD56734B6F4ECD34FFDEF2964E4344AB4FE456542E891298A2812C3BCEE849C90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.dll

Path C:\Users\Admin\AppData\Local\Temp\0E45C38C52991F119A426E10A5985A74\setup.dll
Size 6.0MB
SHA256 00ea5ed47e25704299ae8ae043c6ca0f9cdebe49c5e66789bd2692b0e0f866ad
MD5 9ba4fe94e1b287055466332a4faf65e4
SHA1 3dc79e6f50ae500b307f5c30525a382a9e040b59
SHA512 79a622d8d58766a8833f1f359584a72f1d91a6f453ea4db0e099967f3f9a62645dba645b467877d9f2dd1a4d0eb7eaeb1bc7e56b1e61d8c06eb05df094c2fec1
SSDEEP 98304:LXXAILII6kvlW5A4NZ3Q+/DB0Tt7KGU+TDirF+xGxjoZ5R6N+06LTnz/gFlu:LXdWv3Z+TDi/y6NiTz/L
TLSH
T1F7569E3276FD80B4E15F1175B8ECA6A9C2BEF1334B2508C7F785654D1B788C12639A8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup_ui.exe

Path C:\Users\Admin\AppData\Local\Temp\0E45C38C52991F119A426E10A5985A74\setup_ui.exe
Size 659KB
SHA256 725c8ebe11c28cd2cf9c4b2cc2a628f9af9bb4d32d4f6c655c4aaff8df81d085
MD5 c851b9409366f5060affc6b035a48824
SHA1 ef65aa6f364819922222f0edb9b4079f1e893a2f
SHA512 957a3d40521a147ea6d042cfa048ebb231e13f54b78b1cd19b43cb711640cfa1276c2896a414df9dec2a88b8558fce373e408e8439b1efa581a7e96517046e5e
SSDEEP 6144:t3iAUFQCAufOQ4VQYvLdA6rFDN3AOJrUfCRBrt8:tillOQ4VQKhh3DsC/t8
TLSH
T1DDE48D106E7C8462F522853D046C9573D57BBBECBB1F059762B42A3B8B633809A2D773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sharpvectorconverterswpf.dll

Path C:\Users\Admin\AppData\Local\Temp\0E45C38C52991F119A426E10A5985A74\sharpvectorconverterswpf.dll
Size 153KB
SHA256 565a07a7855c1e0a406f7e0a6d1e0216a50430e93bf4bc3a2792fdebaa06c8b9
MD5 ee6d543b93bffda3d0292e75699d9c6e
SHA1 4397aba81449e4e0c2860dc03f0e620f7228b972
SHA512 9f8624dc6eaabf81dacbffa8e35012cc029041c0df8d1f70366ab16998eb61e861151cc7a9097d557311f9c8c55205d33515b7dfcb9c9f1955d7bcd50d996f4e
SSDEEP 3072:PJFKfqFKrmRZW5cZhtmyfOTa8s8igymhxmoMkShX:BFKfqFKrmHW5cZhtmyfOT/hhMAShX
TLSH
T1B2F36C9856F88D06D97F9BBDB4B406000734A313D657E78D0FD1A4EA1CA3351CF4AAAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sharpvectorcore.dll

Path C:\Users\Admin\AppData\Local\Temp\0E45C38C52991F119A426E10A5985A74\sharpvectorcore.dll
Size 197KB
SHA256 cea4468b3e59864b87cc9413eb18f00ebb788dac260678f4b9b64f0bdb0a0100
MD5 1f77d731d801f31f4919e8443e436482
SHA1 2773f38e17e77eef53fb091378237a9751e54bcf
SHA512 f446d9a689c88394280e50fd7b03f12665790b843e7ffb24af85215d3e77693ba5e0fbc232d4446595b6228d0838e53af7269849745b9bf761669cc94aeeccea
SSDEEP 6144:H6xC3pFJ8QGsIeLpJxgW2Nn0/M3Z4bt02/yp:HS28OkBX
TLSH
T15D14292A73A0D56DEDDB0BFCB8B1581C27BDF781262B8B9F18048C2D5917BA48550F93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sharpvectorcss.dll

Path C:\Users\Admin\AppData\Local\Temp\0E45C38C52991F119A426E10A5985A74\sharpvectorcss.dll
Size 117KB
SHA256 104a576ef72d41b7660264f01afa920837ad97a9825991fcaca70ff2230f512d
MD5 a62c3d715ded4b5ca9ab067a5862e577
SHA1 9e3243178008484e0f1206f7d88b833e7fee2b85
SHA512 3f562667016d31648c8a0e0e8866ba4b098bc28e9bc7098a4b1395eb2ef97f9ce9596a7e08664071894b469a4df2d2ec456140610fee9d350464df049f5b5597
SSDEEP 3072:5hQjsBdIZNGbsznuSPgyDDTzXBDLvmIBU:5S7NGoBfv9BU
TLSH
T16FC33C587BE54654E7BE8F79A8F010045B32BB1B6973CB1D0E8950AE0A737828B14F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sharpvectordom.dll

Path C:\Users\Admin\AppData\Local\Temp\0E45C38C52991F119A426E10A5985A74\sharpvectordom.dll
Size 59KB
SHA256 6a231926c51445f12be9c1d4942534fc31527c853649f84b46937ff5d5da911a
MD5 7b356e76f6fc27e278f08e03145ac052
SHA1 28509219e59e088ce41d5359f7c74a1ac6265016
SHA512 c3889f937408c256a7e1a34b4610585cc8cbf498f822e9dad2fdb9ce799a6c67ab60206fa5ebbdedaeaa1f16165c1c2aaf7591793e99c488da944d121f13cfab
SSDEEP 1536:cHEe5ZftZozPKTNV7KGkBOxRrFaKdPJKnxahqD0L:cke5ZczPKTNV3xZbb
TLSH
T10F536B5D0BE95927DE9F077EE9DB42054BB0E6836883DB1B1B15C1A01D2A302DE532EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sharpvectormodel.dll

Path C:\Users\Admin\AppData\Local\Temp\0E45C38C52991F119A426E10A5985A74\sharpvectormodel.dll
Size 730KB
SHA256 a7234f55d3e57c618eaa8ac06802c8af694b1bdc79a7051fa5b1d32b866dfc01
MD5 2f26b0f0c2fd2994af1afaf6cc4f2414
SHA1 0e67969f97acf30e0dce8f81b17c945045764385
SHA512 7153c4c6a4b98fff762716247ffaab5c7a73086b6c485504b7d50163251641abe815eccd76084ca5499773352c6a69324d83b411deb98f0d827f5d7181226694
SSDEEP 6144:4kzgXVcUuWjRuN5TYYRI6jMluzH++gkiC3Lp1JeMgWi2dUDUfcA7LZwOXKcDp7DZ:ctukYRwMTYkJKJOXKcDR4qp/KE
TLSH
T1F2F481416BF80124F5FF6FBA58B504205E35BE132D7BE74E269194AE18B2B20CC62777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sharpvectorrenderingwpf.dll

Path C:\Users\Admin\AppData\Local\Temp\0E45C38C52991F119A426E10A5985A74\sharpvectorrenderingwpf.dll
Size 233KB
SHA256 9064a9b7ddcf05f923d054f0063a5a93e62979950d8698f89abdf429c0d54b52
MD5 99ee86a7e99acadcd2a39144598dbc7d
SHA1 ffe4edb5d069ec0708280fb0e4764c1e7409a4da
SHA512 3d5db49243e9e441f9c35c88a9a1d5acd8c7787336b445165fc856b925949498d40f062f90153a8cea918fb366a70d859b817bf54c3c231b995f9e6a037a8327
SSDEEP 6144:aLYFKPL8Gf98TLNfho9yF/hPMzYeN9TTspxQMWe:a+T9LNfho9qMzYyTAB
TLSH
T1A1346C5C36E8CD05C9AF4B7EA1E4040463B496139287F3591FC6A9EA2D333518F8DEA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sharpvectorruntimewpf.dll

Path C:\Users\Admin\AppData\Local\Temp\0E45C38C52991F119A426E10A5985A74\sharpvectorruntimewpf.dll
Size 74KB
SHA256 083e76caeea398215e1a7260aad9bff07eb699306fcca94151685057f30fbba0
MD5 70e01468f190c78700cdfb39b84419af
SHA1 87159f90c3d54635dc4e907d36a0bf780296ce5b
SHA512 e783f24d2ca336ebcb2bf17fb8df04ce57a1c9c43e8c2b27ec3c3323edc3e694e328dccf722af56ed79c5375d200ebc347e73ee1ccf569dde7cc4fd0c863146e
SSDEEP 1536:fHqs/HRoolJL545ah6icdWeKJj4ShyUjrFBg04KnxAcJ:fHF/xoolV3tR5+m
TLSH
T1A6737EA807B48D02DFAE8B7D71F022105B30A7137652E7566FD1A1FA4BA339047917EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

netcoredistr_8_x86.z

Path C:\Users\Admin\AppData\Local\Temp\19ECFD51-9926-11F1-A924-E6015A89A547\netcoredistr_8_x86.z
Size 25.7MB
SHA256 2aa00d51fdafbbf2cfa5d818f2b3bbdadc650ba481dd7c4c0387250dd647b814
MD5 4cb032267f7344d3c7ec12014b5deff6
SHA1 f324a1ba0890addfbc5e7c270e749f86768eb7cf
SHA512 1739ed9dbc0c178424683135b8fa5c22f5b82ecefd0f3a6c7139d4f0b167dce6b089775d5177dc785088a7ee10a4ff6243d88cb8fa5e78bcc70656402d525298
SSDEEP 393216:iP8BmlhOTCq6lRRZIgucOSOXQXrHt2M9oA24/YwrK5AoPKApoLnhXLnpoSbW413:iqmiTCxRRZIx1XorNVoAmFyuo9LCSbr3
TLSH
T10847331A31906FDEC19132B51B6FAFF01E1990CF55B13ECF1FCA93299B219D15E9820A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kl.setup.ui.interoplayer.dll

Path C:\Users\Admin\AppData\Local\Temp\A092006D52991F119A426E10A5985A74\kl.setup.ui.interoplayer.dll
Size 58KB
SHA256 b7bd6823029ff048424721532c46cd09748aca3ed0ce493b176d1dd75624662d
MD5 99e822bc9f7d53c6ee67c3fa3a7e4e3e
SHA1 f66ab57deb7e8df05e33e06cac285227f5cc93e5
SHA512 f7983f04da89b61749287d1c4c5666a5247f55d7efd8fad34986ffb5d98993715f8abd1c41c73a5d651415f22a460940dabb6a8133a192fdf0399ac950d0fe68
SSDEEP 768:n105FbNA5RQbVF8BDlW6gF4HCLxHr2sMNxN5ALw5ALW:nMFC5RQRF866gTLxL9MNJ
TLSH
T15C437C4346E81A03FEBB5F78F8F955010F75F65B1982E2CE1A4890894B43350ABA637F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.dll

Path C:\Users\Admin\AppData\Local\Temp\A092006D52991F119A426E10A5985A74\setup.dll
Size 11.2MB
SHA256 75651f54294042afd2b9ae684ccd5bf81375acf59f25c92a6f3d19cd482dcd5b
MD5 520f04bf4e1b1aa01f070be956b07cb2
SHA1 5d3a06a6a8b76c3fb8ec689da8e3d1d826c70f7b
SHA512 c9b8f3f196be93f218536a288cd8544da335c872549b0b8cd764e979c84b223cffb588bc447691a8ff671548f04e555d843f9df730c41db461707a04d4012ac4
SSDEEP 196608:4ZolSHBK0Df/21Xg5C/vvBr/Qb8JaF5nzbwkNQYOJbQFmt0Qrm27wz2cp:4wyBbDf/2Fg5C/HBDo5zbwJYM8Fm0QrO
TLSH
T1CCC6AE73A5E88879E51E1374B57C67A3C1BDDA3A0B2101D7E3CC6A4D2A784C6773068B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup_ui.exe

Path C:\Users\Admin\AppData\Local\Temp\A092006D52991F119A426E10A5985A74\setup_ui.exe
Size 809KB
SHA256 2b48f81b1ef7ef018683a98a66cb180f4825fe5f6742db746f75c929f30b424b
MD5 f599103b9576f4580c59681e55490817
SHA1 7198c846b2d8cd3b6fdf62f384293f6bd1087d6c
SHA512 cbd25f764aba35725d283a5dd53b7e3e5fbb99c597b838c13f45e8d6d341adda9b90e400eb09fa522822f6e9d915cdfab9b5ebf91e423aedb47d5fc78efcb967
SSDEEP 6144:Jq5KDhnGgI39jJkYm1Ym6zDPHSwCAOGlqCQnGVMG53j4ps3MA4SpcdTYnP:Jq58I39jJkYmwC4oDSMGtYs9pcRC
TLSH
T1CA0526016E7D8425F422993D05AD9273D57BBBECBB1F058B62B0263B9B63380492D773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cbi.dll_x86

Path C:\Users\Admin\AppData\Local\Temp\BF88AD73-9926-11F1-A924-E6015A89A547\cbi.dll_x86
Size 133KB
SHA256 952cb6a2435b14383ee26ab8a72578689d3931f0ff220cf887dfde3c3626d150
MD5 7a33c0e89bd6adb8c5ad036c48ff0ead
SHA1 23ca5930f3e7a7a2b7deee10b297bc9cac658033
SHA512 fac998f35ff61fc8d3c7fcfd3e5dd938355b4fe85bd44c38487e4ba2f9ccc1f8be506cce48bcc5661c65d00382e16346347db10e049ae2d3b9afe67f2f3fce59
SSDEEP 3072:UX+YeT6HflAcL4tqUgIgEqyu3Ysu4uwrflI/qOD9ULK+:UOYeWHeptB14u4uwrflWqK9Uu+
TLSH
T166D36D1AEBC498F2F9B26E3B4CB19511593CF6101B719C9B7F4C066D0BA02D09376A6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GuiStrings.loc

Path C:\Users\Admin\AppData\Local\Temp\C83C54E1-9925-11F1-A924-E6015A89A547\GuiStrings.loc
Size 22KB
SHA256 57bf969d3c10d5be0a4b31b8e530c1e005622c8dc809ee4fbd4c214f3b3e9a37
MD5 09c4e9f41c4b8bfdb6bf8916af730ecd
SHA1 a215913aa718b459d8e3c13dfd22e5246dcff38c
SHA512 7767639c5e068fd3e83a527dfce0345c902673e50102a6c5ba3998ffa2d16f0417a74bee15fce9b6825eabe94f6d36c4528cc70c4541294415b26b9f0f64937e
SSDEEP 384:pniMPGH1JfmA7vcjbKHKluY2IZO3DHQLIlsMV7eyE33p4i8QVWimzAqznOd0PjnH:RiMuH1JfyKHKluY2IZKI3p4i8QVWimzF
TLSH
T1BBA2D7B7DA923ECF2312E0FD30263B8FA4A66546971EA17450E5224387F1992077E4B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GuiStrings_KFA.loc

Path C:\Users\Admin\AppData\Local\Temp\C83C54E1-9925-11F1-A924-E6015A89A547\GuiStrings_KFA.loc
Size 3B
SHA256 f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5
MD5 ecaa88f7fa0bf610a5a26cf545dcd3aa
SHA1 57218c316b6921e2cd61027a2387edc31a2d9471
SHA512 37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5
MD5 SHA1 SHA512

Submit Download

GuiStrings_es-MX_KFA.loc

Path C:\Users\Admin\AppData\Local\Temp\C83C54E1-9925-11F1-A924-E6015A89A547\GuiStrings_es-MX_KFA.loc
Size 96B
SHA256 146f91d96b7b2b73c06c52c47b0c030d8b64aebe1db3d9a5eba412c49a645fa1
MD5 7028b8e9f1320aad444c761514fb415a
SHA1 829d4b4673a7e35bb42c627a15ee1dbae1579289
SHA512 37c55f1f8934c94afdc0161d92333259035ecab8fc873333f7b2bebf331b261d3a5c9692455b2754d1ffe5eb3ed018e61cff0e9a6964f7abef249a8df553eb8a
TLSH
T13EB01249EBC10B4DCFCA2A3E0828C4C1945B92F103D9490C08CC010900C187D0FA2050
MD5 SHA1 SHA512 TLSH

Submit Download

downloader_neutral_KFA.ini

Path C:\Users\Admin\AppData\Local\Temp\C83C54E1-9925-11F1-A924-E6015A89A547\downloader_neutral_KFA.ini
Size 1KB
SHA256 cbb72cdc1e461226c7d0e49e7ef955f77dfeef4f7fe12d0d8a8d0cf9658edc78
MD5 2e10b2d4181d2f07d2dd305bd4285bd5
SHA1 9c05f3e03bae36da24a62b08729074cd12b0077e
SHA512 a1bae84b8a9c0833bbadf29d4532b64f0216d7c1c13be2b4ebb75dd4d2b18244eb67fee52743745ed0a5818e745cb9aae9a8bfdc415ff59ee8aa7de77f122819
TLSH
T15B31244277F8201CF2F3EF44AFB968A54737BC595D74E65C1280610D16F2A90E5B27A3
MD5 SHA1 SHA512 TLSH

Submit Download

downloader_es-MX.ini

Path C:\Users\Admin\AppData\Local\Temp\D600290B-9925-11F1-A924-E6015A89A547\downloader_es-MX.ini
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

discovery.cfg

Path C:\Users\Admin\AppData\Local\Temp\discovery.cfg
Size 30KB
SHA256 f6ac63530680ca3d81d4fd9b9dd7242770c197e5004514c6b6d619af7ff10ce6
MD5 3f798d52a9f5b6a1ae3f47a329af55d2
SHA1 7f3c93aada3fa6225eb1b79f5000b573194450ab
SHA512 ac8a44877e05415d672226bbc45004b1fa3e6366ea8a801594d48e62ab081d5d9415002e1262343c0dc3b0baaa31650607bdbdc024846c3b31c3576e67c7840f
SSDEEP 768:wtRSWzOarPTd4iE/l+ZHRTYVvAFNdF3jpzcA:6RS6YVvAFP
TLSH
T11BD26A6978111983F85FD2F1EE704F01ABCDA39602884E263ADB4D2E0E5FCDAE511977
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msi_common.dll

Path C:\Users\Admin\AppData\Local\Temp\{CA11803D-172D-416A-8D3F-C9E372F8B7A0}\msi_common.dll
Size 662KB
SHA256 b8648b78afead566039e158d5943c9f416e8e9a5c6fa78aceaf08f59bbfce43d
MD5 4e292b0c2cdd1f2c3ef09b13827c165e
SHA1 44a0da99d11b8fe271d30091f1718d20a399f3ff
SHA512 893a5a55989bbb4fd49caf97117065b844f022e4cf75f4c033e9a439ea20a50058eb2165464ea66f7d2347bc66dc3705408356287eb64dc1fb4acb9cfe05ec10
SSDEEP 12288:VozJInNieCiQI3beUPCo9upZKNqh4EoWxPqPVmlt00:Vo9INdzPyUeKi4pqq+tD
TLSH
T1C8E4AEA2BEC18036F07A063115B46A656ABDB9310F3184DFA3D4B66E6EF09C1E735713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

product_info.dll

Path C:\Users\Admin\AppData\Local\Temp\{CA11803D-172D-416A-8D3F-C9E372F8B7A0}\product_info.dll
Size 274KB
SHA256 d6c42102318997c7c83402271e2c1f74b0010ea323ce1e3d83cdb96294bf58a7
MD5 7658f9bdc9e0b98ded87f47d0989b2c6
SHA1 d3868aec0a4c662ede3250fe7f04b488dd368eaa
SHA512 7d6973a8129d125b83ba94a2c4ac235516aeb888f044f0e1791e1a0dc294de87327a389e54d4f358b6d2dc057f6e8e7f80dc67fb30d70c6418c35d5a67ea0c86
SSDEEP 6144:9B6E1wk7q5Uc4kSFscl3CC6lEMNpuzL0b:QjcZp64no
TLSH
T1AA549E217D50C832EABF06305568D66549BCB4610F70C8DB73A46F2EAE326C1AF3567B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI18E7.tmp

Path C:\Windows\Installer\MSI18E7.tmp
Size 716KB
SHA256 1f4a20135b743b480e14c55dc8f9207488354b5d17c630436c37d3113f96406c
MD5 1a0f40bdc4e5838ecc11a7364e98d412
SHA1 d1eb0a5f0c7ba998221975bfd92f424b68845442
SHA512 ad9519a7d008026193c94cc9b4a743290002da8355820d77d2b6201062753d9d68d824161d07b804f42738009d349c47a2bc00047a1849841a64cd3696e972dc
SSDEEP 12288:q6OVLjfoRI1MFpngtTekg3VqWvchOpe7dFztSRwLLUT+:q6OVnfoRI1MFpgtikgPpkdttSRwLLUT+
TLSH
T1F5F42821A6E5843AF5FF0A31687C462508B97C614F7492DF63909A3E6EF0AC6D570F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIC86.tmp

Path C:\Windows\Installer\MSIC86.tmp
Size 180KB
SHA256 a458226150f53130b509d7cf43eb81b51718ec0dd3ea497c01099c465a192637
MD5 f30e7d60fd9adbbd5e191ad7f89ec355
SHA1 1fffd3d89ff4654000940e1cc673007f7eec56a1
SHA512 977c9d125f0af7b46c8a461f08a933f44862bec1a3bec87ab523b98647161d1f59a8a1e734d7afd11f673e30c36e66cbaaf73bff3084e05bc35e06e819d902b5
SSDEEP 3072:tuqTcPkrtJCNdygoER1MmH/L+zi+2qfE+urfKmMOqaPv1oj+fS:tunwtGqo1MGLN+lfwtV6+K
TLSH
T16004AD117580C87AE57F0A3904B4EA625BBEB9209F6088CF33545A6E5E703C0EF75A77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIEFA.tmp

Path C:\Windows\Installer\MSIEFA.tmp
Size 2.6MB
SHA256 170a4071e4a86017e765a28de3db49b8cd2a99a474059cc9d61fe20417d07166
MD5 867bae62f5a29f0c15c332aa72355488
SHA1 de196279ba6391417b054b4234fa74750257c613
SHA512 05fcaa49a74b86857c670563d1c9243a6a532c0649697032fd4b108ac6612c2948d7831995ab0de10f1103beeab106ebe6324710b9a3059c0f62558620e0edf4
SSDEEP 49152:sV2N5pPWT42acXt/PBN5pj5uESL980eeK6dswePTBwurwbLsW3drclkQR6Fj9e0:sV2N5pPW82acVBN5pjE40e9TBwusbr3v
TLSH
T1F8D59E327BC4903AE26F0235E57DF6A486B9B5710B2184DBA394B70E7D709C2A735B43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Other

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_604955312\Mu\Other
Size 34B
SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
MD5 cd0395742b85e2b669eaec1d5f15b65b
SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
MD5 SHA1 SHA512

Submit Download

Kaspersky Installer.exe

Path C:\Windows\Temp\6CFC318C52991F119A426E10A5985A74\Kaspersky Installer.exe
Size 4.5MB
SHA256 bc8526519ba3ab695fa8659774f5c93d7d12fe0af43402f2f60682f30c7cefb3
MD5 ddb6b05d76fe3b5e01ccc60a44ea0f18
SHA1 8f4c16963e0ab16b1e5cab461ce632786390d744
SHA512 33756f883960c43e09470b91f36f0558a4bf10844f808c521873178d2787b7e56b9b75366803fff63615a584f0c71856964629fbf125cb920c348ec07078b0de
SSDEEP 98304:RUA459jvgsJEMiVfDzdEs8jFEq5NrlV6WVM:ujvgBnB8lMF
TLSH
T18126EF11AE7D9062F422453D4A5D9273C5BBBBECB71F019762B4267B0B237808A2D377
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/784-379-0x00000000775B0000-0x00000000775C0000-memory.dmp

Download

memory/784-377-0x00000000775B0000-0x00000000775C0000-memory.dmp

Download

memory/784-378-0x00000000775B0000-0x00000000775C0000-memory.dmp

Download

memory/1004-2-0x00000000775A0000-0x00000000775B0000-memory.dmp

Download

memory/1004-1-0x00000000775A0000-0x00000000775B0000-memory.dmp

Download

memory/1004-0-0x00000000775A0000-0x00000000775B0000-memory.dmp

Download

memory/1420-2118-0x0000020C7BB50000-0x0000020C7BB51000-memory.dmp

Download

memory/1420-2123-0x0000020C7BB50000-0x0000020C7BB51000-memory.dmp

Download

memory/1420-2183-0x0000020C6B3D0000-0x0000020C6B4C5000-memory.dmp

Download

memory/1420-2182-0x0000020C6B240000-0x0000020C6B3C2000-memory.dmp

Download

memory/1420-2149-0x0000020C7B9C0000-0x0000020C7B9C1000-memory.dmp

Download

memory/1420-2148-0x0000020C7B8B0000-0x0000020C7B8B1000-memory.dmp

Download

memory/1420-2147-0x0000020C7B8B0000-0x0000020C7B8B1000-memory.dmp

Download

memory/1420-2145-0x0000020C7B8A0000-0x0000020C7B8A1000-memory.dmp

Download

memory/1420-2133-0x0000020C6ABD0000-0x0000020C6ABD1000-memory.dmp

Download

memory/1420-2130-0x0000020C7B780000-0x0000020C7B781000-memory.dmp

Download

memory/1420-2127-0x0000020C7B790000-0x0000020C7B791000-memory.dmp

Download

memory/1420-2124-0x0000020C7B790000-0x0000020C7B791000-memory.dmp

Download

memory/1420-2125-0x0000020C7B780000-0x0000020C7B781000-memory.dmp

Download

memory/1420-2097-0x0000020C6B5D0000-0x0000020C6B5E0000-memory.dmp

Download

memory/1420-2122-0x0000020C7BB50000-0x0000020C7BB51000-memory.dmp

Download

memory/1420-2121-0x0000020C7BB50000-0x0000020C7BB51000-memory.dmp

Download

memory/1420-2120-0x0000020C7BB50000-0x0000020C7BB51000-memory.dmp

Download

memory/1420-2119-0x0000020C7BB50000-0x0000020C7BB51000-memory.dmp

Download

memory/1420-2117-0x0000020C7BB50000-0x0000020C7BB51000-memory.dmp

Download

memory/1420-2116-0x0000020C7BB50000-0x0000020C7BB51000-memory.dmp

Download

memory/1420-2115-0x0000020C7BB50000-0x0000020C7BB51000-memory.dmp

Download

memory/1420-2114-0x0000020C7BB50000-0x0000020C7BB51000-memory.dmp

Download

memory/1420-2113-0x0000020C7BB20000-0x0000020C7BB21000-memory.dmp

Download

memory/2380-182-0x0000000077590000-0x00000000775A0000-memory.dmp

Download

memory/2380-181-0x0000000077590000-0x00000000775A0000-memory.dmp

Download

memory/2380-183-0x0000000077590000-0x00000000775A0000-memory.dmp

Download

memory/2712-86-0x0000000005B90000-0x0000000005BA6000-memory.dmp

Download

memory/2712-137-0x000000000C350000-0x000000000C388000-memory.dmp

Download

memory/2712-82-0x0000000005520000-0x0000000005530000-memory.dmp

Download

memory/2712-37-0x0000000005520000-0x0000000005530000-memory.dmp

Download

memory/2712-40-0x0000000001100000-0x000000000110E000-memory.dmp

Download

memory/2712-91-0x0000000005F20000-0x0000000005F86000-memory.dmp

Download

memory/2712-90-0x0000000006210000-0x000000000656E000-memory.dmp

Download

memory/2712-92-0x0000000006B20000-0x00000000070C6000-memory.dmp

Download

memory/2712-158-0x0000000005520000-0x0000000005530000-memory.dmp

Download

memory/2712-157-0x0000000005520000-0x0000000005530000-memory.dmp

Download

memory/2712-156-0x0000000000AD0000-0x0000000000B75000-memory.dmp

Download

memory/2712-106-0x0000000007D10000-0x0000000007D4A000-memory.dmp

Download

memory/2712-115-0x0000000007DC0000-0x0000000007DF2000-memory.dmp

Download

memory/2712-119-0x00000000080A0000-0x0000000008156000-memory.dmp

Download

memory/2712-123-0x0000000007E00000-0x0000000007E1E000-memory.dmp

Download

memory/2712-131-0x0000000008070000-0x0000000008082000-memory.dmp

Download

memory/2712-138-0x000000000C320000-0x000000000C32E000-memory.dmp

Download

memory/2712-136-0x000000000C260000-0x000000000C268000-memory.dmp

Download

memory/2712-135-0x000000000C270000-0x000000000C2B2000-memory.dmp

Download

memory/2712-43-0x0000000005520000-0x0000000005530000-memory.dmp

Download

memory/2712-81-0x00000000059F0000-0x0000000005A4E000-memory.dmp

Download

memory/2712-286-0x0000000000AD0000-0x0000000000B75000-memory.dmp

Download

memory/2712-101-0x0000000005520000-0x0000000005530000-memory.dmp

Download

memory/2712-100-0x0000000006850000-0x00000000068FE000-memory.dmp

Download

memory/2712-96-0x0000000006780000-0x0000000006796000-memory.dmp

Download

memory/2712-111-0x0000000007E20000-0x0000000007EB2000-memory.dmp

Download

memory/2712-48-0x0000000005800000-0x0000000005848000-memory.dmp

Download

memory/2712-110-0x0000000007D50000-0x0000000007D76000-memory.dmp

Download

memory/2712-127-0x0000000008000000-0x0000000008010000-memory.dmp

Download

memory/4636-5-0x00000000775C0000-0x00000000775D0000-memory.dmp

Download

memory/4636-6-0x00000000775C0000-0x00000000775D0000-memory.dmp

Download

memory/4636-4-0x00000000775C0000-0x00000000775D0000-memory.dmp

Download

memory/5260-244-0x0000000003000000-0x000000000300E000-memory.dmp

Download

memory/5260-257-0x0000000006770000-0x0000000006826000-memory.dmp

Download

memory/5260-259-0x0000000007D00000-0x0000000007D16000-memory.dmp

Download

memory/5260-261-0x0000000007DA0000-0x0000000007DBC000-memory.dmp

Download

memory/5260-263-0x0000000007F00000-0x0000000007FB4000-memory.dmp

Download

memory/5260-262-0x0000000007E00000-0x0000000007E34000-memory.dmp

Download

memory/5260-264-0x0000000007DC0000-0x0000000007DE0000-memory.dmp

Download

memory/5260-267-0x000000000C1B0000-0x000000000C1F4000-memory.dmp

Download

memory/5260-258-0x0000000007D30000-0x0000000007D78000-memory.dmp

Download

memory/5260-260-0x0000000007D20000-0x0000000007D30000-memory.dmp

Download

memory/5260-256-0x0000000006680000-0x00000000066A6000-memory.dmp

Download

memory/5260-255-0x00000000060A0000-0x0000000006474000-memory.dmp

Download

memory/5260-254-0x00000000057D0000-0x00000000057E6000-memory.dmp

Download

memory/5260-253-0x00000000057F0000-0x0000000005858000-memory.dmp

Download

memory/5260-248-0x0000000005730000-0x0000000005780000-memory.dmp

Download

memory/5260-2427-0x0000000000FC0000-0x000000000108C000-memory.dmp

Download

memory/5260-274-0x0000000000FC0000-0x000000000108C000-memory.dmp

Download

memory/6120-174-0x00000000775B0000-0x00000000775C0000-memory.dmp

Download

memory/6120-176-0x00000000775B0000-0x00000000775C0000-memory.dmp

Download

memory/6120-175-0x00000000775B0000-0x00000000775C0000-memory.dmp

Download