hxxps://github[.]com/spotbye/SpotiFLAC/releases/download/v7[.]2[.]2/SpotiFLAC[.]exe

Analysis

user interaction
yes
max time kernel
203s
max time network
211s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 20:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/spotbye/SpotiFLAC/releases/download/v7.2.2/SpotiFLAC.exe
Sample260820-yxhryaxyew

Score

8^/10

defense_evasion discovery spyware trojan upx

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
38	1860	msedge.exe
217	1860	msedge.exe

Executes dropped EXE 5 IoCs

pid	Process
1648	SpotiFLAC.exe
6024	ffmpeg.exe
4784	ffmpeg.exe
1652	ffprobe.exe
3260	ffprobe.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SpotiFLAC.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
175	camo.githubusercontent.com
176	camo.githubusercontent.com
177	camo.githubusercontent.com
178	camo.githubusercontent.com
179	camo.githubusercontent.com
180	camo.githubusercontent.com
171	camo.githubusercontent.com
172	camo.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000600000002398d-121.dat	upx
behavioral1/memory/1648-1548-0x00007FF69E480000-0x00007FF6A1E44000-memory.dmp	upx
behavioral1/memory/1648-1792-0x00007FF69E480000-0x00007FF6A1E44000-memory.dmp	upx
behavioral1/memory/1648-1810-0x00007FF69E480000-0x00007FF6A1E44000-memory.dmp	upx
behavioral1/memory/1648-1841-0x00007FF69E480000-0x00007FF6A1E44000-memory.dmp	upx
behavioral1/memory/1648-1877-0x00007FF69E480000-0x00007FF6A1E44000-memory.dmp	upx
behavioral1/memory/1648-1881-0x00007FF69E480000-0x00007FF6A1E44000-memory.dmp	upx
behavioral1/memory/1648-2002-0x00007FF69E480000-0x00007FF6A1E44000-memory.dmp	upx
behavioral1/memory/1648-2011-0x00007FF69E480000-0x00007FF6A1E44000-memory.dmp	upx
behavioral1/memory/1648-2020-0x00007FF69E480000-0x00007FF6A1E44000-memory.dmp	upx
behavioral1/memory/1648-2049-0x00007FF69E480000-0x00007FF6A1E44000-memory.dmp	upx
behavioral1/memory/1648-2080-0x00007FF69E480000-0x00007FF6A1E44000-memory.dmp	upx
behavioral1/memory/1648-2099-0x00007FF69E480000-0x00007FF6A1E44000-memory.dmp	upx
behavioral1/memory/1648-2130-0x00007FF69E480000-0x00007FF6A1E44000-memory.dmp	upx
behavioral1/memory/1648-2172-0x00007FF69E480000-0x00007FF6A1E44000-memory.dmp	upx
behavioral1/memory/1648-2249-0x00007FF69E480000-0x00007FF6A1E44000-memory.dmp	upx
behavioral1/memory/1648-2301-0x00007FF69E480000-0x00007FF6A1E44000-memory.dmp	upx
behavioral1/memory/1648-2331-0x00007FF69E480000-0x00007FF6A1E44000-memory.dmp	upx
behavioral1/memory/1648-2340-0x00007FF69E480000-0x00007FF6A1E44000-memory.dmp	upx

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5480_1047081623\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5480_1047081623\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5480_1047081623\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5480_1049227223\crs.pb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5480_1049227223\ct_config.pb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5480_1049227223\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5480_1049227223\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5480_1049227223\manifest.fingerprint	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	SpotiFLAC.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	SpotiFLAC.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1860	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317301977897087"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{DC98E573-0E3F-449C-A6D5-958A63A0278C}	msedge.exe

Modifies system certificate store 2 TTPs 12 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	SpotiFLAC.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb6587f0000000100000016000000301406082b0601050507030306082b06010505070304140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d777e00000001000000080000000080826f22e7dc01030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	SpotiFLAC.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a7e00000001000000080000000080826f22e7dc011d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e77f0000000100000016000000301406082b0601050507030306082b060105050703046200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	SpotiFLAC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	SpotiFLAC.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	SpotiFLAC.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c000000010000000400000080010000040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf15761419000000010000001000000076935b5c5a037216daaf8aac76df42c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	SpotiFLAC.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 0f000000010000002000000071b437f087f3700ffd4e2fa46f42b6b810d7bf19adfedf951c023edd65b50b050b000000010000005400000053007400610072006600690065006c006400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900200013202000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c06200000001000000200000002ce1cb0bf9d2f9e102993fbe215152c3b2dd0cabde1c68e5319b839154dbb7f57f0000000100000016000000301406082b0601050507030306082b060105050703041400000001000000140000007c0c321fa7d9307fc47d68a362a8a1ceab075b271d000000010000001000000054e2cd85ba79cda018fed9e6a863aa467e00000001000000080000000080826f22e7dc01030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e2000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4	SpotiFLAC.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 19000000010000001000000060e2dc65295f1062e558f3fef235ed3c030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e7e00000001000000080000000080826f22e7dc011d000000010000001000000054e2cd85ba79cda018fed9e6a863aa461400000001000000140000007c0c321fa7d9307fc47d68a362a8a1ceab075b277f0000000100000016000000301406082b0601050507030306082b060105050703046200000001000000200000002ce1cb0bf9d2f9e102993fbe215152c3b2dd0cabde1c68e5319b839154dbb7f553000000010000002500000030233021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005400000053007400610072006600690065006c006400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000132020004700320000000f000000010000002000000071b437f087f3700ffd4e2fa46f42b6b810d7bf19adfedf951c023edd65b50b052000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4	SpotiFLAC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	SpotiFLAC.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	SpotiFLAC.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c10f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df0040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	SpotiFLAC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E	SpotiFLAC.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5980	msedge.exe
5980	msedge.exe
2900	msedgewebview2.exe
2900	msedgewebview2.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5480	msedgewebview2.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5224 wrote to memory of 3984	5224	msedge.exe	87
PID 5224 wrote to memory of 1860	5224	msedge.exe	88
PID 5224 wrote to memory of 1628	5224	msedge.exe	89
PID 5224 wrote to memory of 1628	5224	msedge.exe	89
PID 5224 wrote to memory of 1628	5224	msedge.exe	89
PID 5224 wrote to memory of 4972	5224	msedge.exe	90
PID 5224 wrote to memory of 4972	5224	msedge.exe	90
PID 5224 wrote to memory of 2960	5224	msedge.exe	92
PID 5224 wrote to memory of 3224	5224	msedge.exe	93
PID 5224 wrote to memory of 2960	5224	msedge.exe	92
PID 5224 wrote to memory of 2960	5224	msedge.exe	92
PID 5224 wrote to memory of 3224	5224	msedge.exe	93
PID 5224 wrote to memory of 3224	5224	msedge.exe	93
PID 5224 wrote to memory of 3964	5224	msedge.exe	96
PID 5224 wrote to memory of 3764	5224	msedge.exe	95
PID 5224 wrote to memory of 3964	5224	msedge.exe	96
PID 5224 wrote to memory of 3764	5224	msedge.exe	95
PID 5224 wrote to memory of 5928	5224	msedge.exe	97
PID 5224 wrote to memory of 2664	5224	msedge.exe	98
PID 5224 wrote to memory of 5928	5224	msedge.exe	97
PID 5224 wrote to memory of 2664	5224	msedge.exe	98
PID 5224 wrote to memory of 2664	5224	msedge.exe	98
PID 5224 wrote to memory of 5920	5224	msedge.exe	100
PID 5224 wrote to memory of 5376	5224	msedge.exe	101
PID 5224 wrote to memory of 4312	5224	msedge.exe	112
PID 5224 wrote to memory of 4312	5224	msedge.exe	112
PID 5224 wrote to memory of 4312	5224	msedge.exe	112
PID 5224 wrote to memory of 5228	5224	msedge.exe	113
PID 5224 wrote to memory of 5228	5224	msedge.exe	113
PID 5224 wrote to memory of 4204	5224	msedge.exe	115
PID 5224 wrote to memory of 4204	5224	msedge.exe	115
PID 5224 wrote to memory of 4204	5224	msedge.exe	115
PID 5224 wrote to memory of 5320	5224	msedge.exe	116
PID 5224 wrote to memory of 5320	5224	msedge.exe	116
PID 5224 wrote to memory of 5320	5224	msedge.exe	116
PID 5224 wrote to memory of 5788	5224	msedge.exe	117
PID 5224 wrote to memory of 5788	5224	msedge.exe	117
PID 5224 wrote to memory of 5788	5224	msedge.exe	117
PID 5224 wrote to memory of 1008	5224	msedge.exe	118
PID 5224 wrote to memory of 1008	5224	msedge.exe	118
PID 5224 wrote to memory of 1008	5224	msedge.exe	118
PID 5224 wrote to memory of 5176	5224	msedge.exe	121
PID 5224 wrote to memory of 3788	5224	msedge.exe	122
PID 5224 wrote to memory of 3436	5224	msedge.exe	123
PID 5224 wrote to memory of 3000	5224	msedge.exe	125
PID 5224 wrote to memory of 3000	5224	msedge.exe	125
PID 5224 wrote to memory of 3000	5224	msedge.exe	125
PID 5224 wrote to memory of 5644	5224	msedge.exe	126
PID 5224 wrote to memory of 1648	5224	msedge.exe	127
PID 1648 wrote to memory of 5480	1648	SpotiFLAC.exe	129
PID 5480 wrote to memory of 4948	5480	msedgewebview2.exe	130
PID 5480 wrote to memory of 2832	5480	msedgewebview2.exe	131
PID 5480 wrote to memory of 2832	5480	msedgewebview2.exe	131
PID 5480 wrote to memory of 2832	5480	msedgewebview2.exe	131
PID 5480 wrote to memory of 1928	5480	msedgewebview2.exe	132
PID 5480 wrote to memory of 2328	5480	msedgewebview2.exe	133
PID 5480 wrote to memory of 2328	5480	msedgewebview2.exe	133
PID 5480 wrote to memory of 2968	5480	msedgewebview2.exe	135
PID 5480 wrote to memory of 2968	5480	msedgewebview2.exe	135
PID 5480 wrote to memory of 2968	5480	msedgewebview2.exe	135
PID 5224 wrote to memory of 1136	5224	msedge.exe	137
PID 5224 wrote to memory of 1136	5224	msedge.exe	137
PID 5480 wrote to memory of 5644	5480	msedgewebview2.exe	138
PID 5480 wrote to memory of 5644	5480	msedgewebview2.exe	138

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/spotbye/SpotiFLAC/releases/download/v7.2.2/SpotiFLAC.exe
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x294,0x7ffe0437c188,0x7ffe0437c194,0x7ffe0437c1a0
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,6986588920852726980,16546168258216710124,524288 --field-trial-handle=2444,i,5945662517042629766,1126198941944804962,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,10957044901322628826,17203299352821630621,262144 --field-trial-handle=2444,i,5945662517042629766,1126198941944804962,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:2
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,8937987192597353481,12696178629933266130,524288 --field-trial-handle=2444,i,5945662517042629766,1126198941944804962,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,530281800688828567,7477293821014427715,2097152 --field-trial-handle=2444,i,5945662517042629766,1126198941944804962,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,3384700552183253039,1400952919893014297,2097152 --field-trial-handle=2444,i,5945662517042629766,1126198941944804962,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,10744645431450740551,9562138364242792571,524288 --field-trial-handle=2444,i,5945662517042629766,1126198941944804962,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,278495324790824143,5917628977333938131,524288 --field-trial-handle=2444,i,5945662517042629766,1126198941944804962,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,6427916911977828211,6382356116180835390,524288 --field-trial-handle=2444,i,5945662517042629766,1126198941944804962,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5572,i,13241666827868441335,4642546366301560905,2097152 --field-trial-handle=2444,i,5945662517042629766,1126198941944804962,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,10020733942929512919,11724879138466084957,524288 --field-trial-handle=2444,i,5945662517042629766,1126198941944804962,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,10020733942929512919,11724879138466084957,524288 --field-trial-handle=2444,i,5945662517042629766,1126198941944804962,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,12205123551308508769,2728036375228249054,524288 --field-trial-handle=2444,i,5945662517042629766,1126198941944804962,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3588,i,10151279215569821584,15200961450762363738,2097152 --field-trial-handle=2444,i,5945662517042629766,1126198941944804962,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6892,i,6283722274275862067,12325101596599792009,524288 --field-trial-handle=2444,i,5945662517042629766,1126198941944804962,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=7072,i,1638843180117953886,6020502214999562253,2097152 --field-trial-handle=2444,i,5945662517042629766,1126198941944804962,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3688,i,7898439298313354833,11330273313188908850,2097152 --field-trial-handle=2444,i,5945662517042629766,1126198941944804962,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3756,i,13336153043327991711,3014956984020930626,2097152 --field-trial-handle=2444,i,5945662517042629766,1126198941944804962,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7232,i,1149385964817138557,838977622430748565,2097152 --field-trial-handle=2444,i,5945662517042629766,1126198941944804962,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7508,i,567845279240299738,2140799980774669595,524288 --field-trial-handle=2444,i,5945662517042629766,1126198941944804962,262144 --variations-seed-version --mojo-platform-channel-handle=7496 /prefetch:8
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7492,i,3589758520258586202,15018229973791515108,524288 --field-trial-handle=2444,i,5945662517042629766,1126198941944804962,262144 --variations-seed-version --mojo-platform-channel-handle=7516 /prefetch:8
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7520,i,635663728674009848,9801298245683739446,524288 --field-trial-handle=2444,i,5945662517042629766,1126198941944804962,262144 --variations-seed-version --mojo-platform-channel-handle=7396 /prefetch:8
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=2744,i,13420746636321562197,11563791766217327155,2097152 --field-trial-handle=2444,i,5945662517042629766,1126198941944804962,262144 --variations-seed-version --mojo-platform-channel-handle=7364 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7404,i,3887046164255137853,6908107570051600645,524288 --field-trial-handle=2444,i,5945662517042629766,1126198941944804962,262144 --variations-seed-version --mojo-platform-channel-handle=7484 /prefetch:8
  2⤵
  PID:5644
- C:\Users\Admin\Downloads\SpotiFLAC.exe
  "C:\Users\Admin\Downloads\SpotiFLAC.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies trusted root certificate store through registry
  - Modifies system certificate store
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=SpotiFLAC.exe --webview-exe-version=7.2.2 --user-data-dir="C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --mojo-named-platform-channel-pipe=1648.5932.7112219863705086946
    3⤵
    - Drops file in Program Files directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:5480
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x178,0x17c,0x180,0x154,0x188,0x7ffde224b078,0x7ffde224b084,0x7ffde224b090
      4⤵
      PID:4948
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView" --webview-exe-name=SpotiFLAC.exe --webview-exe-version=7.2.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1724,i,9581908120906112058,9915171194361549735,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1752 /prefetch:2
      4⤵
      PID:2832
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView" --webview-exe-name=SpotiFLAC.exe --webview-exe-version=7.2.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2060,i,9581908120906112058,9915171194361549735,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:3
      4⤵
      PID:1928
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView" --webview-exe-name=SpotiFLAC.exe --webview-exe-version=7.2.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2400,i,9581908120906112058,9915171194361549735,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:8
      4⤵
      PID:2328
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView" --webview-exe-name=SpotiFLAC.exe --webview-exe-version=7.2.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3676,i,9581908120906112058,9915171194361549735,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
      4⤵
      PID:2968
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView" --webview-exe-name=SpotiFLAC.exe --webview-exe-version=7.2.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=336,i,9581908120906112058,9915171194361549735,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
      4⤵
      PID:5644
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView" --webview-exe-name=SpotiFLAC.exe --webview-exe-version=7.2.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4736,i,9581908120906112058,9915171194361549735,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:8
      4⤵
      PID:2028
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView" --webview-exe-name=SpotiFLAC.exe --webview-exe-version=7.2.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4844,i,9581908120906112058,9915171194361549735,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:8
      4⤵
      PID:4816
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView" --webview-exe-name=SpotiFLAC.exe --webview-exe-version=7.2.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1240,i,9581908120906112058,9915171194361549735,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://verify.spotbye.qzz.io/challenge?cb=http%3A%2F%2F127.0.0.1%3A52239%2Fsession-grant%3Fstate%3D7b1fb90a8e438cc6afe16034f6635065&id=eyJraW5kIjoiY2hhbGxlbmdlIiwiaW5zdGFsbF9pZCI6IjhlMTJiY2U3N2YzMDkzZTdkZTU1MTNhMGNiZDNkMjYwIiwiYXBwX3ZlcnNpb24iOiI3LjIuMiIsInBsYXRmb3JtIjoiZGVza3RvcCIsImV4cCI6MTc4NzI1NzM1MCwianRpIjoidTZTM1h4SThaUmY3ckV4ZDdWd0NmT3dkIn0.2EFc24o1LFfRUViPyAhZDR2oRLTsyoc4T3K__MeBL5w
    3⤵
    PID:628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://verify.spotbye.qzz.io/challenge?cb=http%3A%2F%2F127.0.0.1%3A52239%2Fsession-grant%3Fstate%3D7b1fb90a8e438cc6afe16034f6635065&id=eyJraW5kIjoiY2hhbGxlbmdlIiwiaW5zdGFsbF9pZCI6IjhlMTJiY2U3N2YzMDkzZTdkZTU1MTNhMGNiZDNkMjYwIiwiYXBwX3ZlcnNpb24iOiI3LjIuMiIsInBsYXRmb3JtIjoiZGVza3RvcCIsImV4cCI6MTc4NzI1NzM1MCwianRpIjoidTZTM1h4SThaUmY3ckV4ZDdWd0NmT3dkIn0.2EFc24o1LFfRUViPyAhZDR2oRLTsyoc4T3K__MeBL5w
      4⤵
      PID:4716
- - C:\Users\Admin\.spotiflac\ffmpeg.exe
    C:\Users\Admin\.spotiflac\ffmpeg.exe -version
    3⤵
    - Executes dropped EXE
    PID:6024
- - C:\Users\Admin\.spotiflac\ffmpeg.exe
    C:\Users\Admin\.spotiflac\ffmpeg.exe -y -i C:\Users\Admin\Music\B002M4XMAW.decrypted.mp4 -map 0:a:0 -vn -c:a copy C:\Users\Admin\Music\B002M4XMAW.flac
    3⤵
    - Executes dropped EXE
    PID:4784
- - C:\Users\Admin\.spotiflac\ffprobe.exe
    C:\Users\Admin\.spotiflac\ffprobe.exe -version
    3⤵
    - Executes dropped EXE
    PID:1652
- - C:\Users\Admin\.spotiflac\ffprobe.exe
    C:\Users\Admin\.spotiflac\ffprobe.exe -v quiet -print_format json -show_format -show_streams "C:\Users\Admin\Music\Arctic Monkeys - 505.flac"
    3⤵
    - Executes dropped EXE
    PID:3260
- - C:\Users\Admin\.spotiflac\ffprobe.exe
    C:\Users\Admin\.spotiflac\ffprobe.exe -version
    3⤵
    PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7584,i,6938210181270380215,1100071901020683560,524288 --field-trial-handle=2444,i,5945662517042629766,1126198941944804962,262144 --variations-seed-version --mojo-platform-channel-handle=7588 /prefetch:8
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,17402681568679686929,7438275043427033483,524288 --field-trial-handle=2444,i,5945662517042629766,1126198941944804962,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4892,i,2518470220032505700,3955893121128417234,262144 --field-trial-handle=2444,i,5945662517042629766,1126198941944804962,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5560,i,12557765861682136340,1325948991882497987,2097152 --field-trial-handle=2444,i,5945662517042629766,1126198941944804962,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6260,i,15736439488846525373,14469216775380501472,2097152 --field-trial-handle=2444,i,5945662517042629766,1126198941944804962,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7232,i,15880456682079146036,13762466952334709960,2097152 --field-trial-handle=2444,i,5945662517042629766,1126198941944804962,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6580,i,11106089246375148447,8456531969728570877,2097152 --field-trial-handle=2444,i,5945662517042629766,1126198941944804962,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7868,i,7689755102240261306,12354890392065117456,524288 --field-trial-handle=2444,i,5945662517042629766,1126198941944804962,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:8
  2⤵
  PID:5280

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5480_1047081623\manifest.fingerprint
Size 66B
SHA256 22b55f5d9b1bafb80e00c1304cf5e0d6057a304a2e8757b4f021b416f4397297
MD5 5bbd09242392aacbb5fac763f9e3bd4e
SHA1 14bb7b23b459ce30193742ed1901a17b4dcf9645
SHA512 541e4c7998e91a5113f627c2c44e32b54878fe225b3b9476572f025f51f2b4ec4a44b102498adcc22b8fe388970645bacfafb6e7fc8a216df4d7bbfc8b0ff670
TLSH
T1CEA0026342648D9FBC1C042BD478A69DCD9115B088492445A925C75BB14203389F49A1
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5480_1047081623\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5480_1049227223\manifest.json
Size 102B
SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
MD5 19322c8a94f1ac01a70f8c58cdbbc720
SHA1 7c90dac178c47dac9087dfce738f24a4a627f022
SHA512 f54a9cab8dbe96333862a67912e88c4f26cc3e25a7dc93e8f06d1fb5b0b8e91d53cc0f5619c192380573a2846034ee583276d7eda73dc9fc93bb0d9168f4e099
TLSH
T156B01221EC10B4B32004036C086CC3C063272F032C4079280DE19F84E90D9DBE471528
MD5 SHA1 SHA512 TLSH

Submit Download

.isrc-finder-token.json

Path C:\Users\Admin\.spotiflac\.isrc-finder-token.json
Size 216B
SHA256 47532f8f363fe417f14c1e975db08422efca43a4f5d447368edcc6d95ef46f6f
MD5 6cb64f50bcc63919c7e59b3eb257583d
SHA1 f49ca4d2e9762142543ef277b361436b68ceba87
SHA512 9f899174db03cd74438e4250958aaca073550efa264c4a2977aabcc93aec954cf01b6a3d471aa3bc0bf47106762707cca024a5dec09bd6dcdca571811a257ea8
TLSH
T14AD023C71B7004ABD4D2D06E4E59A3D031604D010145F737889FE593501E057ABF323A
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\.spotiflac\config.json
Size 2KB
SHA256 df37e54b7510d9b0b66c19bc8ece4c1ebce005f6d810738575faeeceed9a725a
MD5 a4199cf2d4391046063eacf64a4a408e
SHA1 4a674ae870a455cfa4097322a4b6bd8fb8fc72b5
SHA512 bab6b50fbce2950b1b51ae4eadf13ebd56ac492aaa7db22e5b2dc32ec2142bbd55be3ac1d29fabf796e6eb5adaa7279b3939696ab693ac773c1adf66904204dd
TLSH
T1F0514728D4390CBB56A5A23A58AD95537A7090430E5D7C2CB6DC030C6F4EB6F35FBAD8
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\.spotiflac\config.json
Size 2KB
SHA256 de4c06d5a1aad8aab9dd7cbe0e461967370a0ff4cf121eba8fbf743cb9209fef
MD5 5f7f1d8f3119119734f8bf6852a26902
SHA1 57a769057598ef803885ab626e3247c2af7c6637
SHA512 3923a23f46486645126c0dee56e5e309d1efc7ee9dcba42c8a88a97e8f2161ca652f46eb9ec2895cb9e9681dc223c95e7f50ccd44ee442b54de89fc9a74c9ac8
TLSH
T10D514728D4390CBB56A5A23A58AD95137A7090430E5D7C2CB6DC030C6F4EB6F35FBAD8
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 7KB
SHA256 78904e640e21549388bcc898b17202ffae038b3e3bf02e494657c2953bd24e84
MD5 dcfe33129b088ae90e0b6c9d717da3e5
SHA1 7cabb5f9da03926092dc137b4fbd0aecf4244a20
SHA512 b1e0df6fa06b026f3c2637000c2f76b686f4c69af171f9f8f3e0eab551922e74c60fa6225761fbb8e9e28229fcc2b9b4d69f168e6ddd2c5703a6389d3d20be34
SSDEEP 192:b5jyrScAsB5MytjxABgnAtz6666666aaaaaaaarA6h:ljyrScAsB5MytjxABgnAtz6666666aaL
TLSH
T1A4F1878282D8C3AADF0515CF99A9929C40B0370DEBDCD518178DCDEE308E4AFE4A56F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 151B
SHA256 638fc7e45a745683ad16c83c4be835e65031503a39b5c456ce140c71d890910e
MD5 00a76bdd21b71faf50b8ecdd6027696f
SHA1 1e4e7650207c1941c05d1eda32fed3a6de831ad4
SHA512 263500319a5bd0ee03b7aa67af740ba8dfc0c9724a4ccff796526f04be4f699eccb58c2cd738fe74cb967c8096a9d5e6ac7d4ebc11dc1c72a2e721a58da4a4f2
TLSH
T1E3C08C7938DD681AEAA8287AA34AA0040FB042052022FC2642B8EE847A815A40A5A124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 77af6eefef6519fa22c8c04618476275e288b2187bcd128f1bd4f89427185418
MD5 0615e7ae4982cc3ea43b9a218289235b
SHA1 a6751d8284ee69104c9fbc91abd642b7744db04c
SHA512 d961a79fbd0e3417093b38d3c565d10bf025b52ac74cadd6319a5d6b6a7ad28ac9cf1b82ac6c51a9d3144776bbf5be33f78cb9a6cd2b17c87511f1dac239c22f
TLSH
T1F3E02B75C821EC3709FD0B28A0494A97E71113172640894F7B3C91099FB062A46C685C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000099

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000099
Size 68KB
SHA256 6bd6fbc2d91e889d8f33ec22b3d274ab002e8869ef6ef10a8e626e6e13b46eb8
MD5 c00b6187958635e5df556992cacc4ee9
SHA1 41d08b23468bba4f0080914df44a2b010fc76bd6
SHA512 109f56fffde1bcd982a016ceaf00c3ac2d406d0a1954f5437462c68c69781a5c0b689861ee6b4136dd6b237164642991d91bdec7cc2d34beb95306c6e6b35d11
SSDEEP 1536:Ntiv6MDLzeilHaYbk/sL8IonWZPCP3eKm2hH1XF/k+Tn8X2+B:Piv6weA6YbN1xe3eK5H11sG8xB
TLSH
T12D6302B73D27D456654B3464FEB74A1C5BAD64E80109AD63C2EBB3CC00EC0E96B2F54A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009a
Size 33KB
SHA256 7b0b7abe7f4cc2a8cf9a1ce70fb3b5b355d56ec55617d89059b21bdc384fa320
MD5 af644b2a43309f33a734cb793673002f
SHA1 2a523d97c1abb65af88e5bb6394e9bf4c68c985c
SHA512 d83ef0260947d8c4f9a76dcce8480d7d875df58c7a1fa3205127b574c9f91d854b93c61498d480a8c6bec3e2c4d4fae329010f7d5e125a0daba0163a1d428546
SSDEEP 768:t0jypE37eSL3EDukK1WoJ5BRElIO1EtSJ3WRVxSi/B5X3EoD/:8FL0DXoJ5BRU1jJG3/B5H/D/
TLSH
T11BE2F24A7A167796D1D002C97BC573B699C6E3475DB080034A226E5CBCFAA0F072BEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009b
Size 96KB
SHA256 6c501148aada1207002c4dc6fb8794554897d71abeb97e92d9d15c8cf61a8448
MD5 76c1b9685c996f14f4cc8b585ddfb467
SHA1 e774b883f6b5736a9f0f0f05cfed247fdd8bdf6d
SHA512 d67c98951d327ea38ba3e761a229436782094e823847d989ddda919aa4de613bc7c5bb057968856414ecf2f2fe82e823bf3a04691d62ad7b67f7b6c142a807d1
SSDEEP 3072:rYsgcoaeqVBTILAbL7ABGMeTDm0ZSfKaXH:raU6qL7ABGMMmEFkH
TLSH
T1F7A3127B369F8CD14907CC51321A335688F4D0ADE2BA066B3D102E6A3B0B75F7A86F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009d
Size 408KB
SHA256 91422ec0ed6304445e08e0214372baed8697c99d2387cf195c39be19fde7e640
MD5 4b4f5c6ef54192cadc14b2d9134862b2
SHA1 753a3a225a9059703b0b721e0635d13ef580d9f1
SHA512 dd6af45bf2d6977d08bbe7ca1b0d898c492d7cf704f0840210a93f251120e30640bba770c6c8af32b9116f7a34fe33256ebb6f4448499fe08f4b3b39c652046f
SSDEEP 6144:LKJ8W+9OftFH8jY4h+7hRkMN15xm1end5h4WphUq+THW1aq6ipPAgSHb3pvrdwK8:ea0bH8jbS1xh4WYq5Hpwt5qz4aa75i
TLSH
T14E9423866CC3ABC1B1F04626DB4C25CAB6BE77ED0081DBCCA1D9ED05C5CCD4AA71869D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b3
Size 16KB
SHA256 d9bee0f5bd223f88748f626bd3ef3d8d984c9d04182b5d3a77255f3a979a86a2
MD5 d756b736870e5a4bcc1c684abfe6052e
SHA1 46c18b1f03045ead9e512e435e8893f05aa8779b
SHA512 92f4e128d3c3cce435f8204a439038467b98b9f330f7a7a80221ea98f93331bc07765046772bf57cddb8a619141a17a16084c913d1c2595ba42fd1a33bc2d700
SSDEEP 384:hwtnML947hbkylAvXS+0qv6k2bmBoIreQh1Kc/bqyeU59be:hwtnMZ47hbtoLjHoIKQh1KcDbeX
TLSH
T17D72D0045884C4459780AD1C952634180E6DFA67522CE3BCAE061FED2E5FCF867BAB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b5
Size 37KB
SHA256 c0b1f8b009fd2a95ee2033f2db4bb67e0aaea44b9811ea70622c66db648dbc78
MD5 7b5f784f32880bd1b1bb3dd338853593
SHA1 3f8191f3db2a43d6686ab44221270bff896fdc98
SHA512 d5611ab9bb791dc2b3fe4d58815ae606a014cd03acac003ead030110f2fc9e868662979f6dbbad47fd9baee312c1566de8b9a55ed43c16a917a9ecee3e7a695c
SSDEEP 768:CLnadh9R7wEJGObEtn5kw2WIfJYXVJghukJi/TEamYdC:/fGEJGOgtn5kwZMQU/JL
TLSH
T13B03F1A0E8981B7B7C604CAF837E56FBB93CC11D6716067256C8EC9241D775060A0CEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bd

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bd
Size 25KB
SHA256 649a2a0ec68b22c872be838b515c93dcd663d16ddb0b9f6490315df95f75dca6
MD5 eb03adf0faf7d0e48f32266ed5e2b6c3
SHA1 a1309cdb76a4fcae0bb4c0d6b9112bc8633a0884
SHA512 f302f9ab83352c7d20031035f74b4046a15a5b34c44cc6933d3425ca6e27cc560c804bf2b257a0293a38b6d9da2b28b3645367e1ef30f07d6a30db4c27ec2ab9
SSDEEP 768:Zv+lyS8Sdli5owb7kZrqhwP4U6bqOSIEtIeUeh65:ZOy0+oq7kBqhcBASIGUx5
TLSH
T174C2E191C721DC30ACDC956EA3BE6C20A12A41D4BC85B50195B393FE18F717AE6C8AE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c3
Size 43KB
SHA256 92a9a4ba993e2b4a830e27bc39375d306fddea07f46930b4e49739e7281f7150
MD5 dc996bd92bcb23a0eceb19d164228826
SHA1 3b9c45af52105aecc69207e6f9475fc494d3010d
SHA512 8ab75805c288e2ae0a04c5e8b3dca14e08ee02a63ec86846cee98083525d7796d99f04f2904c7277621e576f0d88977fa2a47c70c64b1c93d0a087dc60f966ce
SSDEEP 768:g5emOR9hiniZX2UinGT3xTAemPv79NRSoTO8xAZ8svS1voHbRv+:6emO/mmfci39AeI79NRSoTOMsvS1w4
TLSH
T18113F1459EC3C35AD622BB09406056516DA2D3C0A75FF4D702E808F931C9F9A6F26DBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c4
Size 16KB
SHA256 af8eebc51cc4c5e670c6d51f2d65b51dd00b2e2916478047ce4a20cb39192cfc
MD5 b7bd514e2416e8e7c88aa5ec02d74208
SHA1 fccd01c6da78ec2f3d0769fe04093e608ca2ae07
SHA512 c1cb50cb0701590f51fd136882f1b496372be4e48cb779d83db803a8ff5416f6538d469b392989d8bc4adcfb6ede13f8d2b8d76050134b5e5408794f85073ad1
SSDEEP 384:rAvCeOzsCIzj9SWLoMzl1fLW8OYe1eQr8BlZB:rAaeOzsCcjtLzzfLW8OYe1EZB
TLSH
T15A72D0D6A5360308B726F9B6B3D7B4D2D7FDE5196CBF83C64148064B83405BE625A0E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 11KB
SHA256 4dcd72960f4c30297df4b12f478651b57cd8bc46fc0fd8436312155edea7a32a
MD5 41abdb0d3d5500e9ea1fdcd6e846c6d3
SHA1 aafcee1e4296f8ee514ea240f85f048c9a74bd6d
SHA512 a8b96831c6bdff773bd3310e2f7251a6bf5e9de051e99761d7c5aeaf85af12d69327cc024d6572c76f9da0e4a4744d5ded969cedf10435715bedb2857edb06e3
SSDEEP 192:8OlUYkdSGqryreqDeTrSGJZ3FVPtxLa8QaBOQ5L7OE:hlH+re1NFXpafaEQNt
TLSH
T1BD32A3345A8AD497FB5B8D7605D8097FB43182E6F9835F0A064818F5ACF2FE2B1B7421
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 11KB
SHA256 ed2ffebfc1b477b05f966d69289f233b1a425272addc4a88dd208b5491de3603
MD5 75d7c1cedf4932d1e3e91ecb2f49a7a6
SHA1 968e365ea156ac8fed0f6f0554004a2d74400d3f
SHA512 9b1216663fc01b0dc940c0ba30f2e0f3d180aef15b90ed954ebfc3089ac57dc7265fa784f2120a361091e0b14f88dd6f3ca7b5ace4f09b0b38be4c4cece9b23d
SSDEEP 192:l0OlUYkdSGqryreqDeTrzGJZ3FVPtxLa8QaBOQ5L7ON:lplH+re1KFXpafaEQNw
TLSH
T1ED32B4345A8AD497FB5B8D7605D8097FB43182E6F9835F0A060818F5ACF2FE2B1B7420
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58eae8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58eae8.TMP
Size 3KB
SHA256 54a349ebe7137fd0800907908242077c2e9679da2e77f6593e981c788a598ab6
MD5 52a62e07d1afa4d3e29ef8271e38b030
SHA1 a66eaeb0465af9fd4f3c461a99fa1a333ae05d40
SHA512 fd69867556225c5ba3d7570e07c2cb29cc7857a5f5382773f55a0f554bda8e69ac2e773dfc5237f2d82ca217bf4c4ef4dbfc44685c851181d52a0225a84d1052
TLSH
T1C381EA30091291A3D393893181E85624347289E9FDD3ED9E21901CF6FCFAF73857B956
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 3d4a0d3eb161dcbd9eba00b495f9f577c00ace485ddc8e151ab05f3f17f66c0d
MD5 915747641a6918d11739cc8eb2eb51d2
SHA1 18da2bbc2041e0db7058e7b0f884f36f07994546
SHA512 901788443ef9242eec2ec462ab0bce822dc51995cd50020d3b903a81f0361bd736863329cd7da3dce6d71818c66963787fd5de49fb4694eb5269b1ad999482ad
SSDEEP 192:D1dwmLbcm6aaij611wiigIcLvTmiRzqGtkm9mrmrmDmt0mzmH:D1dwmLbcm6aaiG11wiigIcLvTmiRzqGm
TLSH
T145D1BCF783F5826DDA1295F0AA18AE1BCF2C0551436C3C6A84E46E17D3F2871E151B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1fc81b10e349fbe57f86333aeb112077ed5a03bf9bd17a60cd0c023b6188ebd1
MD5 5de78983df1170bb58558279ab653e51
SHA1 09d937aa5a242c87d340c32458446169ec450ad7
SHA512 1d618b3ccb73d755d44aab5c27ee73d8107236da166939d97a088dc4951c252362fc19acf2f3f51d8dba34cecc1acb71c66f4e3cbc226eb6a940432cfc265464
TLSH
T10031C0F383E8856E8A1195F0B618BE2FDE1D0510436C3D9AC5E4AF1B93E2471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 2db3a5a82e6d8a0bd12e07bf482a1602c5fb157b48055b00ab849ddb110031a8
MD5 43ffe37991e4aede310d4dd4fb92539f
SHA1 e7043043cd6c8a09fb310a252c75a6939ca2f4e9
SHA512 05f3a36346c4ea16bd26bacd0d062254f8305d58211252f578ecf95876387cc7c0c3afa134645608a85a26d2ec5d3863721f9c3c276a0c19be1a96b47194f960
TLSH
T1AA31C0F383E8856E8A1195F0BA18BE2FDE1D0510436C3D9AC5E4AF1B93E2471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 e1c71093bf0551b361dab20f6a9bc9e3002513fd9f7407c5defa0c62653121c1
MD5 b7dbe9dd73c05135ba164eaddcc7a4c1
SHA1 26f8598f8acdf364d17faa9615f0fa43ba859cd4
SHA512 bd87a664d8b095d253d038b030b9bf4fbb619ade92da4dae31cd36f2b684e48e2e1b377e56e5a1936d7d22546f81c6c5d1ac71b473c34725edd117589aea4686
TLSH
T1DFD0236351403075D5FDBD814066FC4FC32600340485DDE9D1D07C5805395AD5A07140
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 7b1b74f8c84c300c2dcbd2f402f42277fc268207ba3ee410e5981e524a1d8d1e
MD5 01755894c3b929a6ba5e0aed8017511a
SHA1 671c1b520ce71afaa5bf8160df91291381929d7c
SHA512 41e3481fb0a7a1657d258885f19b0bae4ee380c9fb88e7ed34b5644312aa8fb655efc10afa5b81bde4efd24f01fed21ee962babce6b1fc8e3a993fa874779887
SSDEEP 384:sxZCuqWm49/flsJMSWzXdcXZHbGlR/1DLO5C:saRWm49/fDlzXoHbC1iC
TLSH
T17AA2081265248977CDD7D219F965BF93D7F80063D9908E88AAFCC91C04EB6FD221782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1780b09178189f17a51440a92f33ef51af161bd11ed5bb22afbea678dce3622c
MD5 fbeea7b4168b1154e4cd72eec01b5aa0
SHA1 6d9a315771d57b458fc77b68794b319155f0067c
SHA512 6230981c4de8124a11136b9e679500e3f0c4bb8652a077fb6480f33a24001b7c7403dd93b6f0ff65bc0cc00c844f5b8ce6adb101f97486acc9dd8192a35b2dd1
SSDEEP 192:sxZORNyMqZjK1Ml8M99/flss5MSuaZdgzodpLHW6+WNGYv0ubwVJIgjXJ:sxZO219/flss5MSuazDLHbGxDj5
TLSH
T12162E8166A3899778CDBD209F6457F93D7F91133A2904E44A9FCCA0C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 d46bc1ba69955d9970d187c32b8550ae4325d03914bf250d63c8997f79bda1f3
MD5 4637b862d68127c9c573f72b027c45ae
SHA1 214eb1c27e1ca55230f9c2c1866b96aa4b90bd6f
SHA512 f7ac8b7bc4d845e37fc4b428e0c74c37c044ea10841136b7af7343b2e03b9d07e57d7fce61d7e44e3e824b6b748c4a70684809928d36d0fe745535e27a278fc7
SSDEEP 384:sxZCusm49/flsJMSWzZdcXWHbBR/gDLa5C:sanm49/fDlzZ3HbngeC
TLSH
T11392091665209977CDDBD219F9257F93D7F80463D9908E88AAFCC90C04EB6FD221782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 ac3648acb26edecd9127299aa0fcf2e4723707f5043173cf932336936b769352
MD5 92b5d0ad970fbf24fbc5c18b01ae3fa9
SHA1 99dfd4632ce6da32055ae8b4207424a008ccd0f8
SHA512 f52f5003bcb97d2e67f0b5d97ececde845de697c622451b8def4b622981ed9e064d5ec20a454b0d3c7a0d690026231becc5ffe63a85f07c53ae07fdaa1152bd2
SSDEEP 192:sxZPRNyMqZjK1Ml8MWP9/flsJMSuaZdxybcSodp43HW6+WNBbQ/YvXubwVJIg5N5:sxZPuuP9/flsJMSuazBjmHb2/UDL5
TLSH
T17672F7066A34597B8CD7D219F945BB93D7F8117396948E84A9FCCA0C04E7BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cdf12dee-6673-4e91-954c-23b338c514e6\index-dir\the-real-index
Size 2KB
SHA256 1678b9a94f72549882a02dc1453c78bc33d6f5a6662b7fd24001e02b10430571
MD5 8bb6a8c95770f702cbd37137b0f44397
SHA1 2d47a8c26cb0b196a79dd35a443f38817c80de02
SHA512 c0771f2547a3635a3c4261ab58817aa635da48288213eb756da7b4e0050651cf6420f55dee1a72dfc69eec7fc95f5e2f6dd4578223355674cddf6c3c180ce760
TLSH
T18F41968D4D609A6FFC94407304F2609437B0D8DD661596279CBC22366C5375D294B6AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cdf12dee-6673-4e91-954c-23b338c514e6\index-dir\the-real-index
Size 3KB
SHA256 7f8f9ef766fcefe5771e691b4232100e543c3ec0387915a04d37af00c7c99491
MD5 2bca73a5276d8794d2e29e18aaf95a48
SHA1 9053bc225ccb74218d7d87de40a1c55636fbb8fc
SHA512 18a61ec98604451fada7dca48fa3f4114ec4a5ec009aeec4fa36cba95081f4752640b581c839f8c46fcf4bf5bb4e9820dae457c17fd16f00f6b0e19fb2a86932
TLSH
T15151944FCC8A199AE5AC11B358FB048037F5A4DD5688CA4769DCA274BC933AF2C09626
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe583c68.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cdf12dee-6673-4e91-954c-23b338c514e6\index-dir\the-real-index~RFe583c68.TMP
Size 2KB
SHA256 9782e5356fc5dc9b401939148af71cece228b4c4562d43c5d73d4e0d0d7640e0
MD5 d3b740f88cf3bac05279e0cef79648e4
SHA1 b4f2563ad41f2f2e76d848346bceeda87dbd0089
SHA512 ea1dec022201f75d381cb6e5afab2b8b2eba095900a14b51ad7ce1f615f50f6f19da19ffdbac56ead54a01a985243ad740bc84b9fa184b0f4b345f9406e91719
TLSH
T18C4197894E85C62FF89444730ED3A4B47339990087267B47B8BC5636A8A27ED3E4E1D9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e6392b72-b563-46a0-851d-26cde0dbbb59\index-dir\the-real-index
Size 72B
SHA256 b14260a45f764bd3e1da8dc26941defea3f3a2b5c679e44f6d9a7bdecc163514
MD5 a7d061e829c442034dc5962e346560bf
SHA1 f39ba76b6fc1c5e4a427ebdc8fd8cbfbbbe02125
SHA512 fe4a463c731db34ea2294f6e06fcdf2e3ad4650dde5620677cff922cd8c46a792915dc750a44ff2b0a119220d56fc02879692053db5cbc1146b552d212f518cf
TLSH
T1A4A0025C43D11611D80A56F025D6D1C22B94C95102131F3B89912154CC60D854D4100D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e6392b72-b563-46a0-851d-26cde0dbbb59\index-dir\the-real-index
Size 72B
SHA256 b80ccc8b54e602179b1d716bc50cf644fbbcbdd06d6f4fe9425e1d18f94c71ca
MD5 333bd9d8edf230d77c65f97ba79f03d8
SHA1 8a4747e1426ed771e787eea0d323f6cad2825941
SHA512 a4e0096f2e920970644cfb6f343bc246cd2dfa4abbb6b3129a7041b0bab10e20e03e109ccfcf52d15d328183fcbb54fae54e875d270cad8606745cffdbf10302
TLSH
T1EDA002101390C057C45225F6FD5212413341D8A036005307419D0088CC944518DD140F
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 09d4ec7aebc090999ad90068b226ea50ac56f4ba532c0bc0b2a3039c2b89d158
MD5 077963e5622a56d7db220d7edad35677
SHA1 8fd1991b49fe85ef369099550c82dd35c951597c
SHA512 42abc007bf14def3a93f76daa0666ae82c0e843c3e177e531e03d128ea0a47ce36e4d99e857de25868ccb58d7d5c238b3ea0f6734b243f2a1a8553493ef3bf9f
TLSH
T151E068B37EFB1850FCAB93C6203119A40005755098409D0F7817A28324A1319201ACA6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 ae39afd9fafdbdaed7fd04ded8d1c0692027acde043b9696b8360d270d697051
MD5 b2d990751d603abe3ea9d5f48dd1c673
SHA1 c8f83f7599b1620b049e9e4129aa17af2f7ae54a
SHA512 a25696ec73b4284a107cc5af903cf1fa0e8ac2cfbd40d0e268f188235829e6fc1c0368838b00c0a644f51adf6cf5b75a6332df83f1e18544681cf886775b39dd
TLSH
T17FA00222C9648043D02806B191AA4196A21A8C9946A6637D70AD009C8B69B664A92205
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589313.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589313.TMP
Size 48B
SHA256 26e5b9f177b5512c4b382216889d5590036a07a69aa59b8727c72c3c6a34e768
MD5 b611b0c60a37e64fd0d9537a9c3da30c
SHA1 1ea761042caf958d1bdc19d8d13d4795b07cf635
SHA512 e643906da411945f8ece9f20e21d768fab69820d25bc625e1579463490e5d63cabcddf072ff7417ba54776433c05d16f933d140695d379af51329b908456cc57
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 529382e7ed96df18fcc95534209fca2fde8e062031397a7c30460854d73b8c89
MD5 aefc6af3c1cb85f6ec2c0e2809b17987
SHA1 67f3b9ed77c18027ffc7c81d12bdd3bef1b107ff
SHA512 d969c08be69464cc73d4edfa5246dd62b4a0b0925c8298a769fc52fba6f73cf0f894ea71d458960b79ef364a844915469be167ddfd670504329be7242f679d43
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGw:05ppxnY753RNBvRJJdt7p5J9x9drdg
TLSH
T10BB2865A713E0211397E2988B79696364F4235A33058E4BF7FB810A54F67E224CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 1caaa63d63e8b1a36c046dd3d3f49422c7a3da30acb7843373bf5990dbe5a12d
MD5 d4b2e18582158b2959788b9990c65568
SHA1 04ba9a94f007312ff227434de4c07d0a168355f7
SHA512 6d3a42397724dbb401773f15f51a9fd8a6c5395af47ba57d500d2ebfb2041edc9fcd7fb4bd5a54d961f66b2f790f421d43114f965a7942a01ddddbdf44bc1552
SSDEEP 384:n1iFPZcIGsNij8TUNTUlI4+TtckCr+RNphiftGm3p9JLyHvGivOUCQty/7Igzok:8FHGTjwgekdDoGm3p9APGiW/T
TLSH
T172E2B3F298D78977E9AE4B87A73D2D029AFCC113B5885984B7D84D1CCC961BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 89c4f2fc355e55f773797277131bb00d492ec0bbd457ae22a475edf25bdf8cf5
MD5 ddd4230d7e4d9391e0f01fb9c68864bd
SHA1 e93c6a289dc9dba4d18b1142f5b6208e376fee1b
SHA512 e6e4e0f7bc3c3065f283bb329de4ad4bedb946423e537d1bf7e43ec91711a4aa595fdf75f63c1b5b13a9f080e09ad42cc812f2b1e710581c3ce83f09f5eddf39
SSDEEP 384:n1iFxMZcIGsNp8TUNTUlI4+TtckCricy2phiftGm3p9JLtHvGivOUCQty/7Igzok:8FxaGgwgek8yooGm3p9rPGiW/T
TLSH
T165E2B3F198D78977E8AE4B87A73D2D029AFCC113B5989984B7D84D1CCC961BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 6b33789f0a0013a7dd48b11a523d3cbc96e08f959defc58ede1f86b56ce7a8f2
MD5 637b2043a6eb3c9f59b387dea4f60d76
SHA1 45392870774d367d84a682fc954270f1b6d697f9
SHA512 e65550dd925f4d3b31e7f3309d6e83fc3fc24f24934e455d9942befcd9f6723c220ca28d7c5c72ef50bfbea45ce69b5a44512a4fcbf1c5bd68cc8eb27c1e68dc
SSDEEP 384:n1iFnZcIAsNij8TUNTUlI4+TtckCr+aNphiftGm3p9JLyHvGivOUCQty/7Igzok:8FPATjwgekWDoGm3p9APGiW/T
TLSH
T16FE2B3F298D78977E8AE4B87A73D2D029AFCC113B5885984B7D84D1CCC961BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d6ee2fab85acc0376e5cb1acfbe21d1e0412ec310737ac252048ccf81d7fb07a
MD5 a7de751d725c6f76561e732f705c646d
SHA1 f8520a0eddb2193d43d59a3a87cc1b32c437fcdd
SHA512 5127eb98bab6aa7687bad60fbc459c877007760b245d221a08f263d297967a8702deeb99dd77c4aef577981e2441d2b28cfdebfff9caef8b95c3619d3a00c692
SSDEEP 384:np9iFiZcIXsNp8TUNTUlI4KTtckCrk1y2phiftGm3p9JLPHvGivOUCQty/7Igzok:p0FQXgwgik5yooGm3p9VPGiW/T
TLSH
T17DC24A72D8A4C9ABBDEB8BC5A74A3A47DFF4412386DC9AC4D5D85E1C00975DD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 43aee9f3d46823592f92c2936fd61a5c2170bd5f3fb7d29bed4f0eeb5f77fe06
MD5 265eb142ab5cd02491e10768fef16cc4
SHA1 21e8afb700a4c043b5da0ca0f2da4dff91d67519
SHA512 c62a85c57a42cb67db1d48818f4b8d4afafcbe49d4b995124daea7f6b3de36fa2c55e81b4004fb726d2eefa865f706cfdd4585968ffa844b178cd7740ccac88f
SSDEEP 384:neiFiZcIXsNp8TUNTUlI4KTtckCr9Jy2phiftGm3p9JLPHvGivOUCQty/7Igzok:1FQXgwgikcyooGm3p9VPGiW/T
TLSH
T152C24A72D8A4C9ABBDEB8BC5A74A3A47DFF4412386DC9AC4D9D85E1C00975DD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 710228bbed5f2cc23dc5e8ae8fba8f470528196b17aedb3020a7abc6d39c6803
MD5 c7dbd7df8a1925a92ad7e14b6128a5e1
SHA1 997cf9783f609d1037950519cc550ce83e8d3b93
SHA512 76228a66c1df4b0faee2e2f1acb4752e4309d0a75d7119d4230d02cef6c31ee236ee074b7982435367e4278b74e2dc4666ab93a42260b16d6604d1e72abdb55e
SSDEEP 384:np9iF9CcmyWCX3sNp8TUNTUlI4KQckCrdzpphiftGm3p9JLWHvGivOUCQty/7Ig8:p0FccpX3gwgpkAXoGm3p90PGiW4
TLSH
T10EC25B36E8A8C9A7EDEB4BC9A71A3943DEE4412386DC9AD4D9DC0E1C019B1DD130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 020da6e29435718cd5ddc247768a1cea36b13262ae1fa1cb795c8fe81f97644b
MD5 d28ed876b570a026f1276225f11d4a60
SHA1 3f49a5aae0774ddcae5be2f40d2ab913ad0b63cb
SHA512 50d88ef925d91bc7d18ab048b7556e2ad0272800d7b4e3d36697eefbbd784b199ae72c1f45d555726b5efcbf148529cf6bd4e35de21cd4f2749c8e47cc265fb5
SSDEEP 384:npMiF9CcmyWCs3sNt8TUNTUlIm2QckCr9S56phiftGm3p9JLHHvGe4KV8p03LBtj:p3Fccps3wwgbkUiUoGm3p9ZPGI8p03Lj
TLSH
T107C26C32E858CAABFDE74B99A75A3543DEE4412386DC9AD4DADC1D0C00971ED430BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 6016f0ea247e6f9f624c6a7cc9f80d657fbc97fdba9b2c6f24a6ede76c23eadc
MD5 7e88d073e5acfa3d57c08120a9206990
SHA1 7b4ab67c447d1c0db03d0c676dc2f198593b7ddc
SHA512 e79c48a2409b2d983710177c861856423cae2c4ddbcf5270dbc3c8f25916540cca6f2589c3d613e7d0828803f7a3d83c3eb532a06acc181c1761db58708bc437
SSDEEP 384:npliF9CcmyWCs3sNu8TUNTUlIm2QckCr9lPKphiftGm3pfUpCe4KV8p03LBty/7M:psFccps3bwgbkUhkoGm3pfjI8p03Lj
TLSH
T1A5B26C36E868CABBFDE74F89A75E7A03DEE4116786E899D4DAD80D0C00971DD0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c69ded8a4cf417cadfb1ec345a82e6bf744cac15571d18dc04ad16c6c15ebbee
MD5 4eed442bfb4a3dff7ee83123f0e37b53
SHA1 07192127d0c9e42b0a6846710851fc26ffac89f4
SHA512 6bd7c3b398ee6c69154b3e75c62ccba5dae50a4e89100686c70e13838f0a4928b07c657dbcf7145cfd07c285a7338438b0e5135ced46969471ee87c55996737a
TLSH
T1DDE00243670410E6C018437100C75B10B7F3C03042B203465E9446785C933011D30F40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 826e3e9db9322730612c27e676f84e4476578c38796f1243698230899475dcfe
MD5 d027d992168e849035b4f041f7a9575d
SHA1 b12b234bdfdc2c51a6b71c01bb98992fd2080fb0
SHA512 5c87e4f77226dd05311c17631d196dfc1e7e6a369548661f6e9fc77ce2091d30c589dca7e4aea03490521e2ff70dffc17736184dd94d2375666edefef35ee75c
TLSH
T12CE00153EB0450EBD02C477244D76A20BBF3D17453B34B869AA846786C933010E70FC4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5c97ef055f2faf2c7f8ab26836ccc81dc00036ce65fd3df1be5fc9c2e992b20e
MD5 e9e9b813ff4d1c0dc9ab9e21a0a466f5
SHA1 e2410d5512031cda855065fd6a3d429738ac5a2e
SHA512 6f1e6781ca834a0587f4b700915a97783a29813378e78f8bc996cf9425686e6dabb41fbe5818b74811d1a2c54bc0fc55c86a38b0038dfaecbdafc58b8a00d794
TLSH
T12CE00143670410EBD028437100C75A20B7F3803043B306465E9446785C933010E30F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58ae4c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58ae4c.TMP
Size 392B
SHA256 a0a4331d88a26ca2c43a8680815940cc57d64b0de18a0054e023fd41961a2503
MD5 ce1848284aa5cd2da328b4b3990b1f60
SHA1 8c4dd61f0df33a2d537f1a262cbd8ff22f59255c
SHA512 b67bc24af7acd22c9f52f74f99e23f17cad27bd31b0e913f5c01df46a16710d4854993350e429527a021ec21b025fe9c23b20cff18e852ae779631f5a53fbaa5
TLSH
T14DE00443530410F5C01C437100475710D3D3C03041F103475D4443541C433010D30F40
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2c2cb20795b456cf070c607ea462e2dfbe47bb78895367aa911068b58f5ef683
MD5 8c2b69a761b583d817ff574424296cf3
SHA1 46fb284e0b3f5688ff6eba58d94a6be4d7b604a6
SHA512 a3d2702a72a0297e68445e4bdb64079ed99809c2904bc193820bb0b78d83de5a053ff9a34dbe7b1212b0642707d49b4a193a50563da040818526e9dc9b6cb3e8
TLSH
T136412859A6E91108B3B77F5AABF6A96D447FB8371E06D4AE10010D4E0B23B45CCB1737
MD5 SHA1 SHA512 TLSH

Submit Download

spotiflac-file-icon-1692817747.jpg

Path C:\Users\Admin\AppData\Local\Temp\spotiflac-file-icon-1692817747.jpg
Size 83KB
SHA256 d4876eca2e273123fc021620077e782a15b0a3ee33a3167e0ed4bde66d89c1dd
MD5 edf3fb40a432633dee73a47b9d91e5cf
SHA1 47b98840041fde6107f06259f9d26db6ef874026
SHA512 7b2972bd702a4a6773ee7f4eb0c40fa3f1d2ee256b7d9cfe5d9b790285debd584083b41ad03df596be504aeba0ea64460ce389d54487969f2a8344bc9f3af267
SSDEEP 1536:mUmso9NlJg1TtwnYyPLeRUZErXF3WhAFyBnBtUs1bsnumfCRI/HW5bCxwwf0zOuH:mTsoJJ0O9IU+1GKyb10VfCJ9iy
TLSH
T1D08312DA13D747E7B44923EC2EFF1F4F74DBC18A05C5114ABAE2A5B879096780C0E899
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 8KB
SHA256 2f94269071c5c4cba30d7916dd16b0a323f2165e3694e859c7257ed4d828cba8
MD5 63975ad22f77efa8f8eebbb3e828ea8e
SHA1 44742134f1e37d564693c0b8b147a85338b801fd
SHA512 a6e7f374c66223d5b745c29a73a7551cb317768f4dea922f786236287d33731521ab65be316110559b203ea3f200b255837caaafbd313fc76ca57ce07f6dcc28
SSDEEP 96:4FJp8bwe0HpjSJlhs9OxDl/uEHwBJruEHBdMJnIuEHs:K/Z+XD/A52BIC
TLSH
T1F612F1446FE6052AF2F6DE71A5B22B10AE3AF9165E148E4E00C4420A0C73F45DE6EB77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8e5377f6e1b273313fbd3cffccbe2df85a485d8e35c4e2db049524c372058b6b
MD5 40d547b5d58a4b6d75c9f6dfed0cb605
SHA1 020dd07fa6162b68a34bb999d3f21802f6028e9b
SHA512 65e88f9ea00044a28823634f807c084dd4d894a9912fa9d4013be46e0533235218a4572dc4e865123d693846a1c87ad067a0c3574eb89b3adf114e22ca268559
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 24b762df4b2eb24a86fa086e40116cf9e919bb58343d8bb6869fae1e75552540
MD5 15d5d33429ccdc4ae9acaff41a160494
SHA1 9fb6452b0502e0f4edfb699450ffd8f68b73aeb7
SHA512 9216651729dc94dccf2e6d942178a2fb43368a8b63402985effcec086d66147bb0274a33afb2f9d96c15482d317a562377d08280801a67c36e986489b5b531ba
TLSH
T170D012127205453CC0102533012362882400C20BC0C54105643CC95D1A048500A06451
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 fa3659716c28f59b79749ef756029b2f457c97f8b49991561f46efb7b6e45265
MD5 1a2d67d0a5cdc8355c77479c952d527b
SHA1 a7415bf6be31f966f76202df7636a55a397b9a85
SHA512 73a9d1639cf9b85ae2f1a8cf79956118b699fe76292f8c83f78a25b9600aeb2a644b0a42eccd042928e44296122b503d257d9e9e3c41591792efc0d3ffbad7e9
TLSH
T13FB0113088822082E208C2B8A2C20C8A3A300C0E0FA20E0E80AA8028CC2A3C00880000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 b4cf6d3e6c009af7075ff823a1634ab5be715e7a8715965dcfc318a366c247d3
MD5 e0b2b56f1b9484d9d2fdafd3adbb63a6
SHA1 0b50349b77cabb8f1129febc440f5aaedc7bfe6d
SHA512 08455463ebdffb896a551f5a2defe2f4f237bd66e04e37bf8ad0849a270301cd21ac5df86d7ec5fd806fa87a6d24fcdfaf7160dbc5f4be921bdc7ad1eea5d3fd
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 727ee2835584008b3dab406365bf0945a8985122e45a918e630ecfb951dbf209
MD5 e197c9e6734b6cda7cefbcddca604033
SHA1 c13c18d7f61de6c7ce48e8d1347bc353e401831f
SHA512 766f217240db0eab64a9b3a0f1c20753f967272008926c824d27a6d745f7af857e0eacd2fb4ab7423dd5943173c555c704888dcceb0f1d28a4da9b10999d5c90
TLSH
T1C1115EB683E4C57D894162E466243D23CD2E0119122C2A67CDE6FBFA5FE2472E71060F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 5ced7d746b6dd68f207688184eec678bda2082578609a90dab4f2fd3aadfaa26
MD5 5f40387a8f6f8df9ddaeb2e6c84d951c
SHA1 1efc0b1b00e35b29a450c5ed64415afdc14dca17
SHA512 b35e1d75b123a7541d929b720c8bd2c5669f5601c09ad90288514f6556e829c5595b509663eb7b02908fb3880fbe1d04e40ace7fc09a1d4fa3485409b247b039
TLSH
T11D115EB683E4C57D894162E46B247D27CD2E0119122C2A67CDE6FBFA5FE2471E71060F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59e788.TMP

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Default\Network\Network Persistent State~RFe59e788.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Default\Network\TransportSecurity
Size 691B
SHA256 9bad0b7e25da11bb4cd7f09f6e7bb58be3ca20ad5f16200fd1c683597701d0b1
MD5 1750f18ee2321c6697468d1305a37f2e
SHA1 c05e477d42ce31e471af0fa3e192f1f2aa7dac08
SHA512 408c6c992fed87650891edc7582453d5caf28c689bf0a6cc0aecf051bef2178d92eea7c44578acb4f0c12524ce6bd46a6e9448753f6bce99763bb03273b68cd3
TLSH
T11501F4D7C2BAB47B10BD987B2944FC067739A43831C058F4DE53C17C70820FB4652412
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe599522.TMP

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Default\Network\TransportSecurity~RFe599522.TMP
Size 523B
SHA256 5bd3a87fc3ffb9903a15629e9b22e4a6aac83c7e13b6792e162d71bd16c098b0
MD5 4886e3335da8368200674b08aad65fd5
SHA1 769ea5482246b08529d5ab6957e080b258ae6558
SHA512 7e3dd7bcaeaa37ebde734bda8e068b6db28e93c1d83dcf4c2562d2c77ae6bc5907670c19e19628fb0f4c0afb3d90147465f5757124998cf8621ba18bf36eb8b8
TLSH
T133F050D7C2FEB07B5078A6762A41FC473739B53D214458F4DA93417CA0815F79616012
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 ae0979b588e0dbbc9103ebf07f74bf4358d5ade7de25397f28f62eda07277d22
MD5 f0fe23501e79cb105f578fb5ca87dae4
SHA1 69a1df26665ee7e982ae1c31fea63699a885057e
SHA512 9536200ee50e496f865f04ccfaa21728248ca5a34ba7f11a62dc3aa8e5d2b8f7fa0bdb41256e705758d539c2ba0b0ad9a55aeae49f4561bc494eb31f08e06d09
SSDEEP 192:stk50tNQ4fpZ8paru/S+WiQ6foYvW1nMC:stjt7UN/Vdo6C
TLSH
T184E1A5025E6879774CC7F61A7A35BB52E2FA102261D50E98EFFC861C08E76CC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe597371.TMP

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Default\Preferences~RFe597371.TMP
Size 6KB
SHA256 c7f6889518a04578963ea7bc3303afd833795567f91341810e0b1904448e7481
MD5 122616027744e81a0afabf4bd0381aef
SHA1 81477bd045787264955a06e7cdbf3da2af4f0309
SHA512 09c42d575368a154b5d4bdd55399feb732cac8a6399efa80cc6c5eea1bf2674fe560d1240b0e90a8c4dc1ec5cf3bf2db11066fa99f96f0d60af3769c17facf96
SSDEEP 192:stk50tNQKfpZ8paru/S+WiQj4wYvW7nM8:stjtZUN/Vrw08
TLSH
T1B1D1B7025F68B9774CC7F61ABA35BB97D2F6102162E54E99EFFC851C08D66CC220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Local State
Size 1KB
SHA256 0db17eae4fa2d596eff9017a5726d676fed184d199e07e2ba555d4c8888ea9b8
MD5 8c5fbd8d085b1cc282372b67dd9f95d5
SHA1 03bfab1abd26ba8e4cc7641480e7d824729d75e4
SHA512 59801f82a71856feaebdd7a2839b00f8f938ac8c0faff408a23a04d4cd15feade34a2b7f78adee2bbd38582b4aa91ff0c58f79b1e36758155d0158687382f99d
TLSH
T1CF316573A48C3F7278426155B2857B932E24106E81645EC5A5DE4E0C02E35DCE635C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Local State
Size 16KB
SHA256 90a1939e8b0cbb9c1587e9a70b5ff35dbb181cd7b5ffd4b9592c87f049cafeea
MD5 b966761d9613166f330c60cb4928013f
SHA1 e1d045cdff0ab75713916471bb6ad54d3f0c17a9
SHA512 ff7d5bece41d348d6dfa7128faeead47dc4214f173699ef49c5f3a078ed2123bc03e969df05eab7f0387c3130eac822c69a5738212c7f34fa317041a8f40f9cb
SSDEEP 384:zh+aQikB+z/xvxjg/qhEwNbPP8AIH2Ul9zo:4/UxvxjgC+8BIH2UlFo
TLSH
T17A727D2B55A87E23A4F3F5057A5D1B9BDBB494A280816FF88EEE1F0D06D73D81302D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Local State
Size 17KB
SHA256 deeea38dbe52256bd2792bcb5a80616ac404595adc1c6200572589d695fb4863
MD5 452770c16afce1ded0e9637521edf325
SHA1 6e5a0265c18e8aa82bfce37333a3f3867f9949ee
SHA512 76df1a1518c8d7c60d56b92319ff80fe04e1582a075aa37e6235e77349296c4d5ca450ebcc843e1e1d29440bf7506ecaf5fd3f24fbc00eb19cccbb6f251dc01f
SSDEEP 384:za+aQikB+z/xvxjg/qhEMNggP8V+Qm9dIH2Ul9zo:R/UxvxjgC+Y9t9dIH2UlFo
TLSH
T1F1828D3A94A8BF23A8F3E64176596B9BD7B4456241C56FE88DED1F0C06C73DC0702C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Local State
Size 17KB
SHA256 8a0303423c91641525dcf59cb3bf0f04952200bd391d1dbdaf1030811c41f353
MD5 a7bfa4787e16dc5ea8a6d593aaf99a2e
SHA1 30c28b9f4fc7c977c69e1b5950f09ad7ce80d855
SHA512 3f674b6911d1e0cd51fc4f9ec77fd56e63733faaf70e330713e23ab82b3a1c8b8ddd09bb65afd96357f774a810501312ef4b5a3ecdf08d44170a9e6d5ce9c312
SSDEEP 384:zA+aQikB+z/xvxjg/qhEONgEP8V+8m9dIH2Ul9zo:D/UxvxjgC+y959dIH2UlFo
TLSH
T123828D3A9468BF23A8F3A6457A496B9BDBB4856251C56FE88DED1F0C06C73DC0702C06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Local State
Size 2KB
SHA256 45ec8b44601fec11c4e3e1b9791e2ef53ed6dc9a4c1956908dc807e3a5a4ee38
MD5 5f74b7fa00ef31bf1951aaf2a0adbc37
SHA1 a80e3ad1b7d47ba5f9c19c4aa648e861e002593a
SHA512 aae2610215de5b2a36ec5e8f79e0b82bd7ba0646843f91e14303ebef2b4d1abcc8a083301d5f57510232b305b77c65147570e5f14b2db20ba7467b1bf1d756a7
TLSH
T18151A733784CBB7394E3A644BA893F63AA35506586752FD1D9DE0F0C01D759C6312C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Local State
Size 3KB
SHA256 1f9c3ae3dac753451f85943528f71cfa82a108e7c6569d020a65aa042747b7a5
MD5 38745cb93fb9fa186de426b32c0f1b5c
SHA1 562af97d462453f2e44aa1c67b871796272205b1
SHA512 62eb9d79c69a0294906a5c1613ed5500bb3e385325a8d150dca4a5e0f133c1feeba0b59f63586cbb014d546d41468add8d9aaa1c7b49e7f6fda1ee95fa8e2ce3
TLSH
T11B71A63268A8BA374DE3AA44B9C93B53B7655127D1A43FD5D9ED0F0C02D72D82352C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58d433.TMP

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Local State~RFe58d433.TMP
Size 1KB
SHA256 df555851273e37884fed54eca17a5b3cbcf6e13bc1b86f37da9329d73b067902
MD5 b5e113be5fdedbed016612b33708a2fb
SHA1 50ca2dfaca4a60d7fbf38242c8aae5a4e2eaa0c1
SHA512 fd4f5fd76d141fc681ec6a9fdbfc46759612826e7504651281c9821fef7633b6080010949adecc1d9a0dd504327aa90c3dbe40a6d4cb3cf88f835427a008282e
TLSH
T119214273D48C7A7274426555B2817B972E54506982185F8AE1DE0A0C03E75ECE632C23
MD5 SHA1 SHA512 TLSH

Submit Download

crs.pb

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\PKIMetadata\46.0.0.0\crs.pb
Size 233KB
SHA256 c132e2ba94619caf6143b3bbdd9c32944e80cbf3bff87364175c42801afe2584
MD5 8bbfaa2cd5cdd9a5019da146cf4deed5
SHA1 17ed2fb07543c5d4bc196a1989dd16a9dbcaacc1
SHA512 cfeee2916f19648ed408b4287e234b4140cf82254cd4b83d918c0a4c3bac2b0467d921915aec290823355be4a0cc82017557be588f65134b466b7192f795f6c2
SSDEEP 6144:KKiD4F7BVps9YpVW+J2i/P66k8GyST+uUP:KB69Vps9C2GAQb
TLSH
T14A34AE9A0F3C3A11BFD2DEA466C8D9377D79B3E06A6928172111C4F169927E07D8C12F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ct_config.pb

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\PKIMetadata\46.0.0.0\ct_config.pb
Size 16KB
SHA256 aaeeb46cd91a4a392223cf2885f449bf532f0878c087d50bb0cb3fc7fa873a60
MD5 ca6e253c3fc7718b4455493460053be3
SHA1 4085dcccd29a931b8ea9b74f008e26409edf78ad
SHA512 0004e83a845bdab07f01df32094c202c9f3b8767a6dadd707abc19796f917221f869791673315e9d2c5a6a1fc50b922cceb622db98601055df5949818dd6ea58
SSDEEP 384:7tomWvvtJvzm9myvg+FN2VOhikm5hV5+QiyA94pDmiDyDS1c8CazaUhszz:7l5Zhk5hV5+Qis2DS1cbe7Kzz
TLSH
T13A72C9BFA1169F000383D558D6E157AAA12363DACCF3763DB1E1C005F5423E6B1A567B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kp_pinslist.pb

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\PKIMetadata\46.0.0.0\kp_pinslist.pb
Size 10KB
SHA256 b5b2a45a5b25becb901916b13752e3477d4126a42d088f29863bd8672320ecf6
MD5 8061c7027f406f3e20ea5d26969f00bd
SHA1 635d6260e16d1ac595f760df9c5bdda8279629a4
SHA512 7be0be7d59ed46b7ce6adbc1ddc42119426b3223491a03ff068dae66d13a261cc954640916ff4379a6040e021689f070b33dc82b45c010b728ee59abd42f3610
SSDEEP 96:Bxk+yBjecaikDBwrBnnoxGwMAy5z5tBT6c5MacFwn2Xh6g/gw:I1IDCrBnYQ5jlMacFwn2c9w
TLSH
T1362204B37904F99350E7E0BE1041F59AE93343A540ADF98A528C4A7635F1F0719BB4EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SpotiFLAC.exe.crdownload

Path C:\Users\Admin\Downloads\SpotiFLAC.exe.crdownload
Size 7.3MB
SHA256 6f074d70ff7a7c8e005bb0dec24dcca1b878435ad48e3230d0bf7f06f8b99be7
MD5 0f2830aff0030cfd1ab0afb986e95b5e
SHA1 b291b4e8fe45316bb124830bc352c9d68f4cd4d0
SHA512 8ab9115e7d500131e59726c492272c3cc93c2c67318005096ec256a89850888bc9f04487bbf081ebf3d2a8ef30c0515b2a9098fda582d55874f573b8b01a7a33
SSDEEP 196608:Uh8fQAUTOJUm63KCg7d/BW+rIkhWZfDh5MjP:aAUTMb63Kn7HvrI99LMj
TLSH
T1077633F0114E0EC9F12A2537187A6244BA7976F606AFA64E3CCCBD1FE9E2493390553D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Arctic Monkeys - 505.flac

Path C:\Users\Admin\Music\Arctic Monkeys - 505.flac
Size 28.9MB
SHA256 ffcee9b72cb1868af53674ed78be973905a2835675be384301ec2ad7ad2f9e1e
MD5 6cfe4ce88350091d471a74afe35b6e18
SHA1 1ac4bfff6a97d133905128382eb834adc8c3a721
SHA512 8c47edac3744de94a1314e90486d30f4fe27ee3151727b26348ba1c551421986f1edb6035dbd3e35e996e25a4e4ed7b6079a6064e5029cb7c05980891154b578
SSDEEP 786432:IBfaNgvcammU6n3IaFH3pEwjZ6QmOxozPzBZqlKf1LtQTjv:IZYgxpU63R3pEwjMQ1ozgWtQTD
TLSH
T118673331DFC869B4E255AA3ED6085D7A72562BCCE52294C390C2705389F63CF3B1297B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B002M4XMAW.decrypted.mp4

Path C:\Users\Admin\Music\B002M4XMAW.decrypted.mp4
Size 28.9MB
SHA256 5bb784399b1164f2c8d6e70d7ca7b79e033992d55104c8cad7b4c1c6e1b3ea20
MD5 0a86b0c6f1a24df57fda0887c6ea28d3
SHA1 312ac856487304d7f410a8b374a670950dfe2ac9
SHA512 c4dd47d9eafc5f3341b11d4857e870d43811fab2e4371e414ace4af7f3d3b924208d2e32ac2acb3764db643a2a7ba404a34406251233a602ea3d1f6f9f524bdc
SSDEEP 786432:lB9aNgIDbmmdaY3IaeH7QhwEZ6PmOOozPzxnMlKf1rtQTMJ:lbYgapdaA47QhwEMPiozc6tQTs
TLSH
T1286733319EDA65B4A279951E96C69C3932263FC8E42182C390C9707345B72DB3F129FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B002M4XMAW.flac

Path C:\Users\Admin\Music\B002M4XMAW.flac
Size 28.8MB
SHA256 64ecec7dbd17aeb33c07d62fa7015c5deaa297ec30b510cc0e8e2b49d28f74b1
MD5 a0a5037049cc51c29d0a58a80ee8f506
SHA1 feee66a5e7e217f550d37089aeedd1e7f198e214
SHA512 2695ea5f4a86c1d8ff7232aa5dccac46593d01261f2a91c9561f1c12d09e6ad52dfced64424b2a4681eedc27f29588aac1cf9af37743c7641e2966615a9b7620
SSDEEP 786432:1BfaNgvcammU6n3IaFH3pEwjZ6QmOxozPzBZqlKf1LtQTjv:1ZYgxpU63R3pEwjMQ1ozgWtQTD
TLSH
T1F7673331DFC869B4E255EA3ED6045D7A761A2BCCE52294C390C2705389F62CF3B1297B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1648-1792-0x00007FF69E480000-0x00007FF6A1E44000-memory.dmp

Download

memory/1648-2313-0x00000171F5FB0000-0x00000171F5FB1000-memory.dmp

Download

memory/1648-2130-0x00007FF69E480000-0x00007FF6A1E44000-memory.dmp

Download

memory/1648-2011-0x00007FF69E480000-0x00007FF6A1E44000-memory.dmp

Download

memory/1648-2172-0x00007FF69E480000-0x00007FF6A1E44000-memory.dmp

Download

memory/1648-2099-0x00007FF69E480000-0x00007FF6A1E44000-memory.dmp

Download

memory/1648-2080-0x00007FF69E480000-0x00007FF6A1E44000-memory.dmp

Download

memory/1648-1810-0x00007FF69E480000-0x00007FF6A1E44000-memory.dmp

Download

memory/1648-1841-0x00007FF69E480000-0x00007FF6A1E44000-memory.dmp

Download

memory/1648-2331-0x00007FF69E480000-0x00007FF6A1E44000-memory.dmp

Download

memory/1648-1877-0x00007FF69E480000-0x00007FF6A1E44000-memory.dmp

Download

memory/1648-1548-0x00007FF69E480000-0x00007FF6A1E44000-memory.dmp

Download

memory/1648-2049-0x00007FF69E480000-0x00007FF6A1E44000-memory.dmp

Download

memory/1648-2315-0x00000171F6050000-0x00000171F62AB000-memory.dmp

Download

memory/1648-2311-0x00000171F5F90000-0x00000171F5F91000-memory.dmp

Download

memory/1648-2312-0x00000171F5FA0000-0x00000171F5FA4000-memory.dmp

Download

memory/1648-2340-0x00007FF69E480000-0x00007FF6A1E44000-memory.dmp

Download

memory/1648-2301-0x00007FF69E480000-0x00007FF6A1E44000-memory.dmp

Download

memory/1648-2314-0x00000171F6000000-0x00000171F6001000-memory.dmp

Download

memory/1648-1881-0x00007FF69E480000-0x00007FF6A1E44000-memory.dmp

Download

memory/1648-2249-0x00007FF69E480000-0x00007FF6A1E44000-memory.dmp

Download

memory/1648-2002-0x00007FF69E480000-0x00007FF6A1E44000-memory.dmp

Download

memory/1648-2020-0x00007FF69E480000-0x00007FF6A1E44000-memory.dmp

Download

memory/1652-2329-0x00007FF6C83D0000-0x00007FF6C93D0000-memory.dmp

Download

memory/2328-1666-0x00007FFE12CC0000-0x00007FFE12CC1000-memory.dmp

Download

memory/2328-1661-0x00007FFE11B70000-0x00007FFE11B71000-memory.dmp

Download

memory/2832-1603-0x00007FFE138D0000-0x00007FFE138D1000-memory.dmp

Download

memory/2900-2230-0x0000014BAA570000-0x0000014BAA571000-memory.dmp

Download

memory/2900-2226-0x0000014BAA570000-0x0000014BAA571000-memory.dmp

Download

memory/2900-2228-0x0000014BAA570000-0x0000014BAA571000-memory.dmp

Download

memory/2900-2229-0x0000014BAA570000-0x0000014BAA571000-memory.dmp

Download

memory/2900-2231-0x0000014BAA570000-0x0000014BAA571000-memory.dmp

Download

memory/2900-2232-0x0000014BAA570000-0x0000014BAA571000-memory.dmp

Download

memory/2900-2227-0x0000014BAA570000-0x0000014BAA571000-memory.dmp

Download

memory/2900-2220-0x0000014BAA570000-0x0000014BAA571000-memory.dmp

Download

memory/2900-2221-0x0000014BAA570000-0x0000014BAA571000-memory.dmp

Download

memory/2900-2222-0x0000014BAA570000-0x0000014BAA571000-memory.dmp

Download

memory/2968-1724-0x00007FFE138D0000-0x00007FFE138D1000-memory.dmp

Download

memory/5920-208-0x0000015168BB0000-0x0000015169BB0000-memory.dmp

Download

memory/6024-2298-0x00007FF74B660000-0x00007FF74C660000-memory.dmp

Download