29fe1f9f42113305beda91d6ef3a8f16fbc68b1ddeca5ee6f1b1f40df6c39cfc

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 00:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pbirds_setup.exe
Size 15.3MB
Sample260910-a2falsvxdt
SHA256 29fe1f9f42113305beda91d6ef3a8f16fbc68b1ddeca5ee6f1b1f40df6c39cfc
MD5 9b6270e9739c46ffc78b892eb73980d7
SHA1 b107376381710685a0f1f30b057f7b2ccac9f766
SHA512 04932ec28cad411109c829e13373248c34ec9f323a4418d17db39a79b64c2e8658ddea64970d1d642e77757822010c2b2429072c5b0f74f7d0a4cabc8acc7a4e
SSDEEP 393216:MF5s7kvPHun1TjBYPJEkcAamEYVCUoB2MxNl3tJ:qssM1QexPuVCH0MR7
TLSH
T1AFF63343C0494E21F350573BDED2F0D54EEE5DA24A61F41DB484A28EDD0B6E3A2E7B98
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

adware discovery installer spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	Pestering Birds.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	PreLoader.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage0\el\is-G6EIA.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\levels\adventure\is-4N0MO.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\sound\is-N3LU0.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\bird\is-7DUHN.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\bird\is-GF3A6.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\buttons\is-72J2F.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\gun\is-D6OAF.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\levels\arcade\is-52BC9.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\bird\is-6B13H.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\gun\is-KCOBH.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage3\is-SDPEJ.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\menu\is-KKJ5G.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\gun\is-86GHD.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\happy\is-V7E00.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\el\is-3N08P.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage4\is-O0PQE.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\is-QDRPM.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\bird\is-8GS68.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\bird\bonus\is-KLLPK.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\buttons\is-N8VQ2.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\font\is-PG2DC.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage0\el\is-5D723.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage3\is-C9A8V.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage4\is-EQL0R.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage4\el\is-PSBTQ.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\levels\action\is-CICUK.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\lnchdata\is-ENSV5.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\font\is-L1F8G.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\stolb\is-0TO0N.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage4\el\is-Q2S5J.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\bird\bonus\is-JDRTL.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\font\is-L5S9S.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\happy\is-HNA6B.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage0\el\is-F96CD.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage1\is-4M4SR.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage1\el\is-M8EIK.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage1\el\is-GOUL1.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage3\is-JI4S7.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\help\is-TF557.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage1\el\is-V2LQL.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage1\el\is-CKPIA.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\is-UMN7R.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage3\el\is-EDNLB.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage4\el\is-PFTC8.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage4\el\is-UPECC.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\levels\action\is-Q0NLM.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage1\el\is-QJ268.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage3\is-PP9RK.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage4\el\is-FBS15.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\levels\action\is-U18V4.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\levels\action\is-EPDR9.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage0\el\is-P5T02.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage0\stolb\is-0KKQ5.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage4\el\is-DQF9I.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\sound\is-VLVCR.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\sound\is-1QAII.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\gun\is-820CF.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\happy\is-BREFD.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage1\stolb\is-D9AV6.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\is-IH7BM.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage3\is-U514B.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage3\el\is-ADTR6.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\levels\adventure\is-C5H5I.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\is-P63O2.tmp	pbirds_setup.tmp

Executes dropped EXE 4 IoCs

pid	Process
1304	pbirds_setup.tmp
5624	Pestering Birds.exe
2972	PreLoader.exe
2292	game.exe

Loads dropped DLL 3 IoCs

pid	Process
1304	pbirds_setup.tmp
1304	pbirds_setup.tmp
2292	game.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pbirds_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pbirds_setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pestering Birds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PreLoader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	game.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3692	msedge.exe
2528	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/4768-1-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup
behavioral1/memory/4768-296-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup
behavioral1/memory/4768-3258-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	PreLoader.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	PreLoader.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	PreLoader.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Cache = e304000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	PreLoader.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	PreLoader.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\PreLoader.exe = "11001"	PreLoader.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\International\CpMRU	PreLoader.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	PreLoader.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334745644975587"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{7FB4642C-5F51-4E6E-ACF0-D2609ADA74F8}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{BF16A31A-4D83-4279-9EE2-652DBA974637}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2292	game.exe
2292	game.exe
1756	msedge.exe
1756	msedge.exe
4612	msedge.exe
4612	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1304	pbirds_setup.tmp
5012	msedge.exe
5012	msedge.exe
1756	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1756	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2972	PreLoader.exe
2972	PreLoader.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 1304	4768	pbirds_setup.exe	84
PID 1304 wrote to memory of 5012	1304	pbirds_setup.tmp	96
PID 5012 wrote to memory of 4900	5012	msedge.exe	97
PID 5012 wrote to memory of 3692	5012	msedge.exe	98
PID 5012 wrote to memory of 5592	5012	msedge.exe	100
PID 5012 wrote to memory of 5592	5012	msedge.exe	100
PID 5012 wrote to memory of 5592	5012	msedge.exe	100
PID 5012 wrote to memory of 4712	5012	msedge.exe	101
PID 5012 wrote to memory of 4712	5012	msedge.exe	101
PID 5012 wrote to memory of 5372	5012	msedge.exe	102
PID 5012 wrote to memory of 5372	5012	msedge.exe	102
PID 5012 wrote to memory of 5380	5012	msedge.exe	103
PID 5012 wrote to memory of 5372	5012	msedge.exe	102
PID 5012 wrote to memory of 5380	5012	msedge.exe	103
PID 5012 wrote to memory of 5380	5012	msedge.exe	103
PID 5012 wrote to memory of 5732	5012	msedge.exe	108
PID 5012 wrote to memory of 5156	5012	msedge.exe	109
PID 5012 wrote to memory of 5732	5012	msedge.exe	108
PID 5012 wrote to memory of 5156	5012	msedge.exe	109
PID 5012 wrote to memory of 2840	5012	msedge.exe	111
PID 5012 wrote to memory of 1756	5012	msedge.exe	113
PID 1756 wrote to memory of 5728	1756	msedge.exe	114
PID 1756 wrote to memory of 2528	1756	msedge.exe	116
PID 1756 wrote to memory of 5620	1756	msedge.exe	117
PID 1756 wrote to memory of 5620	1756	msedge.exe	117
PID 1756 wrote to memory of 5620	1756	msedge.exe	117
PID 1756 wrote to memory of 464	1756	msedge.exe	118
PID 1756 wrote to memory of 464	1756	msedge.exe	118
PID 1756 wrote to memory of 4252	1756	msedge.exe	122
PID 1304 wrote to memory of 5624	1304	pbirds_setup.tmp	124
PID 5624 wrote to memory of 2972	5624	Pestering Birds.exe	126
PID 2972 wrote to memory of 2292	2972	PreLoader.exe	129
PID 1756 wrote to memory of 5616	1756	msedge.exe	131
PID 1756 wrote to memory of 5660	1756	msedge.exe	132
PID 1756 wrote to memory of 4200	1756	msedge.exe	133
PID 1756 wrote to memory of 1936	1756	msedge.exe	136
PID 1756 wrote to memory of 1936	1756	msedge.exe	136
PID 1756 wrote to memory of 8	1756	msedge.exe	137
PID 1756 wrote to memory of 8	1756	msedge.exe	137
PID 1756 wrote to memory of 1888	1756	msedge.exe	138
PID 1756 wrote to memory of 1888	1756	msedge.exe	138
PID 1756 wrote to memory of 4612	1756	msedge.exe	139

C:\Users\Admin\AppData\Local\Temp\pbirds_setup.exe
"C:\Users\Admin\AppData\Local\Temp\pbirds_setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Users\Admin\AppData\Local\Temp\is-F71G9.tmp\pbirds_setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-F71G9.tmp\pbirds_setup.tmp" /SL5="$B026C,15739942,54272,C:\Users\Admin\AppData\Local\Temp\pbirds_setup.exe"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.myplaycity.com/install.html?utm_source=pestering_birds&utm_medium=downloadable_install
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffbc79ec188,0x7ffbc79ec194,0x7ffbc79ec1a0
      4⤵
      PID:4900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,16643448577398816370,14713636923123042903,524288 --field-trial-handle=2400,i,12098963692161463113,1677238264535486350,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:3
      4⤵
      System Time Discovery
      PID:3692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,12528125955090105935,12433167205846739664,262144 --field-trial-handle=2400,i,12098963692161463113,1677238264535486350,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:2
      4⤵
      PID:5592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2184,i,10708130312050834706,5835888079083606883,524288 --field-trial-handle=2400,i,12098963692161463113,1677238264535486350,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:8
      4⤵
      PID:4712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,14683693918355472127,9974469752463300151,2097152 --field-trial-handle=2400,i,12098963692161463113,1677238264535486350,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
      4⤵
      PID:5372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,1671828632060823164,7698361481680136691,2097152 --field-trial-handle=2400,i,12098963692161463113,1677238264535486350,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
      4⤵
      PID:5380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,11493264322578701432,10577822381379306746,524288 --field-trial-handle=2400,i,12098963692161463113,1677238264535486350,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
      4⤵
      PID:5732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,17401102763626974771,987358550554642225,524288 --field-trial-handle=2400,i,12098963692161463113,1677238264535486350,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
      4⤵
      PID:5156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,16026232295007179186,9487723384366217832,524288 --field-trial-handle=2400,i,12098963692161463113,1677238264535486350,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
      4⤵
      PID:1264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,16026232295007179186,9487723384366217832,524288 --field-trial-handle=2400,i,12098963692161463113,1677238264535486350,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
      4⤵
      PID:2840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1756
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x28c,0x7ffbc79ec188,0x7ffbc79ec194,0x7ffbc79ec1a0
        5⤵
        
        PID:5728
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,719558991937304252,6909819956425293283,524288 --field-trial-handle=2252,i,18192258581941755306,14107511757369229221,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:2528
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,4769028469755468091,3403843005901417732,262144 --field-trial-handle=2252,i,18192258581941755306,14107511757369229221,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
        5⤵
        
        PID:5620
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,13017834584766148357,11577311348828297497,524288 --field-trial-handle=2252,i,18192258581941755306,14107511757369229221,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:8
        5⤵
        
        PID:464
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,11515734583825563335,15079156493117885011,524288 --field-trial-handle=2252,i,18192258581941755306,14107511757369229221,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:8
        5⤵
        
        PID:3500
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,11515734583825563335,15079156493117885011,524288 --field-trial-handle=2252,i,18192258581941755306,14107511757369229221,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:8
        5⤵
        
        PID:4252
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4760,i,6604933558858453187,13353906233291278107,524288 --field-trial-handle=2252,i,18192258581941755306,14107511757369229221,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:8
        5⤵
        
        PID:5616
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,5706401966225748688,16453556883152610477,524288 --field-trial-handle=2252,i,18192258581941755306,14107511757369229221,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:8
        5⤵
        
        PID:5660
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4780,i,4323142781570846547,603394891745664962,524288 --field-trial-handle=2252,i,18192258581941755306,14107511757369229221,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:8
        5⤵
        
        PID:4200
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,100665440764424769,6788414867010905247,524288 --field-trial-handle=2252,i,18192258581941755306,14107511757369229221,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:8
        5⤵
        
        PID:1936
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=784,i,16640506432203590143,4293170464140444754,524288 --field-trial-handle=2252,i,18192258581941755306,14107511757369229221,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:8
        5⤵
        
        PID:8
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,3939762812929381545,7460845613006109581,524288 --field-trial-handle=2252,i,18192258581941755306,14107511757369229221,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
        5⤵
        
        PID:1888
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4956,i,8120912786786215251,960332196449101426,262144 --field-trial-handle=2252,i,18192258581941755306,14107511757369229221,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4612
- - C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\Pestering Birds.exe
    "C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\Pestering Birds.exe" first
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5624
  - - C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\PreLoader.exe
      "C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\PreLoader.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2972
    - - C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\game.exe
        
        "C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\game.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2292

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5868

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Pestering Birds.exe

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\Pestering Birds.exe
Size 2.3MB
SHA256 00d5bd612e049543cb3b80d684e9ba5f0b04ff628e231deeaabe722ac732104a
MD5 3a1c5c0b0ed25a2b997cb0cf068cbb61
SHA1 d39db9533f54ade9a2a5dfd91bfe21e2e7e23e4c
SHA512 8840b3e27137494ff1b640c0cb9f0cdb454b0b3b38a56829e5d6311f7447c997219bf043bb709e8fca0b147bc2581a6535dda3d0aa5a65bba341c5725aa27527
SSDEEP 24576:LBdWjTEZs4p0smiOFo8GdcflzCWOIxIoXDBaSoo7Kl6RKZ2WHPESc7eFob9T3rBV:PWkFpCF7X3XDESpbRSNH8Sc7e8TH
TLSH
T1F5B56C32B244653FC0BB1B398927A6B4983FB7526D07EC675BF4094CCE355412E2E68B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-1U7S7.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\buttons\is-1U7S7.tmp
Size 2KB
SHA256 52237594ee599c7b87e5162a352fa6db76d4f127284f6d128fb9c2b00cf57b8c
MD5 fcaa8d778d0dc4aaae5d955661016aed
SHA1 9528a7bd3c317e43ddbd8dbb833ed4e10192d803
SHA512 c761f69288e5eacd566690890ff6823262f8fa526498b6671d1e7c150b614a5b1ac801225077d2916a5804a4c0247d70271a00b84217391da783d2ab958901bd
TLSH
T1C3411A9F30B320AF16AC80E27E4102E43DDA963693BCFB8ED353834455F0620FA2E255
MD5 SHA1 SHA512 TLSH

Submit Download

is-QVVH9.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage1\el\is-QVVH9.tmp
Size 283B
SHA256 a876ed38f5b1e50858af719bc5d38b110e1a202cc063946899166cf073f0218e
MD5 94be55a139be906da83a573f3a694019
SHA1 6ed99fba03542a445d1bdc98cb4cd97e4b2f4630
SHA512 5f802852538f2f195d9788038e7d3bfa668671bd4fc21ab98a14b193292b989ac6053cde819f6dd4c3f2619ba0f3bd687dab5a4f2f6c712ac927ad05d2e350cd
TLSH
T196D023146880D175C8C160305C0C87205C574C4E44E9450C3F5C351135E6570739ADC1
MD5 SHA1 SHA512 TLSH

Submit Download

is-1A1QD.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\el\is-1A1QD.tmp
Size 541B
SHA256 b32cdeaf9a0ea928423bb466b3e88c745f33e583a2887ed9f2efc09b864f1edb
MD5 875d8e4cc0ad4a6191f346e1a0600414
SHA1 c55b824850de5bd063f0e365c31d3e6e903f91ff
SHA512 ca41c54faf91a3b89af166269cf894a2d5bb076271f21040ccde71dd8091d15a85afb4fe58198e05870e977912271000ae11cc61940e49c614c97c26b759f66e
TLSH
T1A8F02398F4F09A30D374F13D8CAEA1201038904681D1005532EC3C8C333D4EC222D9D0
MD5 SHA1 SHA512 TLSH

Submit Download

is-1JIIJ.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\el\is-1JIIJ.tmp
Size 535B
SHA256 154928a9283ed80e0c931d7ae3dc0a3bbca3ff0bc90caf77f50742b86bc77a54
MD5 af356d6cf509ed235d6af36305b1b6e4
SHA1 e70689e4c05318f5049b29c78f26e90fd4e2744b
SHA512 e348098b59596c0122370f3f2d358fa70635ba1592425f8364a32655d124bf2ad2776fae53afc2e244d7de0f52353a11941a16256db73419df68be19eacb7a4c
TLSH
T119F0AB5AD3A19904C908203A1485880A09B46E628CC953D96E6AB60FF6B45B28130760
MD5 SHA1 SHA512 TLSH

Submit Download

is-5QS39.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\el\is-5QS39.tmp
Size 529B
SHA256 3a9dad72702b1ec19905532596668670975a3b177f418260f327c4849585bc2f
MD5 db77074018ca9b8f8c76e55d46f6b8bc
SHA1 db8009e9670adc2e90d73c6e5caa564c8afc2536
SHA512 7654ddfb17048726e4e33b4b663410f6c486e5976c7d570a895b8a760a20224a7472aabde1b3f54a8d3cc1f732a674e5fe3d2748e48eb4313b652a2c7de13304
TLSH
T16FF0AB53FCE0C250EA705D36187E6349A0DA801E9E5923223E64A1ADB242223C320258
MD5 SHA1 SHA512 TLSH

Submit Download

is-ABAMK.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\el\is-ABAMK.tmp
Size 311B
SHA256 308f7cc97dbb9a6e5e5ffed00b1cd505c034807b5d4a00c4fa40d2193d59aa15
MD5 3d7282a2c686ce636629e37e13ef557b
SHA1 ff9135dfd64eee17cae9639fd5bfbc8a87a3b9fa
SHA512 b01cca4d67a124bb51d786939ce445ef11b9ed33e6c60bd064142accc20257b5673a0e074d8c6ca7d75bbb5f1c97af14bff0439b1e5e9430813d0c022b583641
TLSH
T192E02D3BAC60A1084014AAFCCE24120069B2C6063A1CDE8747C07228A25800893070D3
MD5 SHA1 SHA512 TLSH

Submit Download

is-DLNH5.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\el\is-DLNH5.tmp
Size 866B
SHA256 8c3a26330b1f0529c8617d81f8098e65c5215b5429d14c8e5611d90372d31e6e
MD5 cf76547e25591097012adb5f1e85298e
SHA1 94989147d047b02a88afaae346a4df8e9e33cb41
SHA512 5043c7cd87b0c6dc473d2738fb6cb490bc5d2ba66ea6fa2a9ea5f8d47158b6d594c9999a96c03fa5975a68c19e6d238a50bc33849e816d19ec159a407e321cce
TLSH
T17D1152E5B1BAE1232DF8163849C0CE62CC80242438624F8EF76B68A47345F956D2D13A
MD5 SHA1 SHA512 TLSH

Submit Download

is-DU0FK.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\el\is-DU0FK.tmp
Size 529B
SHA256 2688c33f9b9882eb53e721367d52e9a48b40a5f300e79961fa8137abb005f6af
MD5 8ae0ff78c2848c97f9603ca70c2990a5
SHA1 fbb1713386dbebe66256fc29c044a1b999822265
SHA512 5a1cfbaa1019625d62c33491327bf82c3920f71ced5a5cec14626272d650a4591a0cd1817e991a111ba947e4da8d047b10d829331065069fa1f0385eec76c4f1
TLSH
T148F0F1F6F40CD340CED502FB128781E517E9E3D64A0908047E0CF30DB85063080BB606
MD5 SHA1 SHA512 TLSH

Submit Download

is-E114S.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\el\is-E114S.tmp
Size 540B
SHA256 4c983fc11f07942a07656acec779ab144990f466dc2ef3ddc7a8de1e49d51670
MD5 bfb10bf99a0ad8728427caae048f462b
SHA1 3a2accd8bbb85e62e36c332e634029c693216552
SHA512 c0d219f3699578a2533c6eaf89e846761193ed8a2ef1a3a8a903974fe5ee68544614263782ef51553407673ba676bc144de2f52f31a466e0ed9e264d107998a3
TLSH
T184F0237C15D153A1D495C836495103850C8B183D9B9320CD7C9EEA08B7189721718240
MD5 SHA1 SHA512 TLSH

Submit Download

is-F2ES2.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\el\is-F2ES2.tmp
Size 872B
SHA256 fba6a6539b902dbe4b0b6d8083f7f635f7f1e5a9c82ecf084084ce44d4d193b0
MD5 cac90a430f88b1a6869f80cb496076a8
SHA1 8dbc2b398634e2be16a51cc7483168a93d9de005
SHA512 2d179d5b24ee7804cfd6961890174995d1081a96e4c2a466de788a7127827764dfa9a88a44af317dc7f901532057895b2cf25baf0174c27d512aca00d9194699
TLSH
T1F7116FA0F1B8D2232DF4493849C0CEA18C84162838721F4DB3AB2C846249B992D2C13A
MD5 SHA1 SHA512 TLSH

Submit Download

is-G0U2G.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\el\is-G0U2G.tmp
Size 874B
SHA256 c2a7b921b0ed2395dcd8db775ecdf7374169e6acc604b84ab348783250c08743
MD5 43a8d920a046d0a79d92459863da6ee3
SHA1 c3101d841b02aff933cf0ec7c149d4c8f956e8b0
SHA512 d73b089554517c2c81439d12e8c67034c513356170d5102a9a71ceb2c5b7845b9086ceb344da328304c77b6852908a8a876bff940bff9a379a5ecd6ca2c92613
TLSH
T13A1192A0B2BED1132DF405394AC0EFA28C84101535734F8DF6372894A24AFA52D2C13A
MD5 SHA1 SHA512 TLSH

Submit Download

is-HA1RK.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\el\is-HA1RK.tmp
Size 122B
SHA256 b399711d08b3195aa0114ded71c4c4bbe876ae2634b9bc9bbf7278902493e2e0
MD5 340062b3b28c77c5762eafd098ff7217
SHA1 7098fe463728b1240a9b5ea2301cdcbb8d863bdf
SHA512 4a88f25fbe4b318414af908f950756f8b8c870b1e440c5896f5ab2a4fe071108596e8bb4d03c384368092be3641581d0f12a16fc71e7e19b9818bbe98692b198
TLSH
T14CB012B4A370F43CC34784341F4859D1039CA2CBC40B43087BD81F09FC500355121832
MD5 SHA1 SHA512 TLSH

Submit Download

is-HMA17.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\el\is-HMA17.tmp
Size 881B
SHA256 ba3cc1c1e82f2f7e6c2d5a45cbf8550a77e9f87a29f6cd043ff320d032b372bb
MD5 0e89f9f31af006fd9868f76c690d64ee
SHA1 fa85978a0a7d3507e2c7f2701c96fa7392338882
SHA512 12f0e5a199302c57b17b81efbe644ecdfbc0f31052875e6411d6250ff45a1584526e843d7943754ae6fd82d5c088597fccfc9fac2e24ba220658a8a3771943e5
TLSH
T1371192E4F2FCD2132CF4453949808E71CCC8252434724F8DB32B2D94A289FAA6C2D13A
MD5 SHA1 SHA512 TLSH

Submit Download

is-IVHMA.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\el\is-IVHMA.tmp
Size 836B
SHA256 12e980c39ab822c691ea9e671db3fd75886f285f3de43805096d1e192783f76b
MD5 f0b747ffd36386cf9ff30c735831d859
SHA1 f9fd3fd151707a5668cc57470bb7d256a8d59791
SHA512 b4f77307cc038b41b1f347c37055d43bece5e0987998013c24ba7c50825bd5afdcba8abda9dd17bbebffd91981f4436d4baa3b817363b2da61ae19cdf438e1ad
TLSH
T1AA0112A4B1B9E1122DF555345DD08E61CC80151438620F4DF6A728946249F555D6D13A
MD5 SHA1 SHA512 TLSH

Submit Download

is-JAKQJ.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\el\is-JAKQJ.tmp
Size 883B
SHA256 7089029f084b0268cfed42b2071b1852c87903e89bfd0cfe3e3fa5a826326f1f
MD5 1b647b2fcc49063f68deb2bab09648fa
SHA1 26bed6e498b99cee4ae1bafefb59b96e1f1d33ce
SHA512 c9b329910d9064a50f8ce6bd14940702a0b97c6b7399ec286c28d2ab826cdf12542b2bceafbf5f19dad09a2389b940e37d2c1a62ddac84a73625f398e99006ec
TLSH
T1E31163D0B17DC1133DF4653949C0DE228C80155824620F8DF66729907245B951D2D13E
MD5 SHA1 SHA512 TLSH

Submit Download

is-MA53T.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\el\is-MA53T.tmp
Size 866B
SHA256 1e7eafb7cc2a318dce09d4ad9debff7d7c74a984ddd527ae2c11e365f3047336
MD5 097502c8c6b647372ea21689104c84b4
SHA1 77e3af64dc95da92a3ed6702304a4c7ff4103071
SHA512 251c6701437a6c6aa53be4cf24a9fb162de5fa9948d7a38c60e50eb2c4f8a91a3f06ed726cc0fca0a74e4479a6cc4d1c717fa45639ab50614c8361114db37d78
TLSH
T1221152E0B2A9D1232DF559395DC0CEB2CC80251838724F8EF66B28986249F661C2C23A
MD5 SHA1 SHA512 TLSH

Submit Download

is-Q3E08.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\el\is-Q3E08.tmp
Size 311B
SHA256 7a3b877142fe30b2e17516ea0409a0a548092f51c9636f2e8a91b8206021cf5f
MD5 cf2690cea45a125c75bb36c1ab5c1842
SHA1 083074a2cdc1ce2b5db60bba630096deb141b971
SHA512 642832f9875f3f11d4a43f36b3b1d9279efb563815f302394dcf7bd674b25fb22f0d8e70fcc649c31554078c70028f3c4995348da415f5bfedbe9023d1622aa5
TLSH
T1E8E0CD9EEAF7D112BD3C85366860665593B4CD06356DD6470041290AD928552A118BDD
MD5 SHA1 SHA512 TLSH

Submit Download

is-UD0AT.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\el\is-UD0AT.tmp
Size 311B
SHA256 67ed94e8ddd2e684415505a137e80d13f6b5369ba693716518c6743f294b3f7e
MD5 ac628cd3b7579063a96f5a00c3fd06b3
SHA1 501740ec12f22be0a8f61b1e404959586fd0c427
SHA512 b930386733edf870ff0a2e094f114aa0c771004935b55207d98c4b194aff00779c6e24c91aacb4a381bcd37031c70e1776bb3beae8af6cdea70b46f294d22301
TLSH
T16BE07D6EF9708998E0054479C021877C69604105464C6307A1D45BBF7BAD0E5A26D595
MD5 SHA1 SHA512 TLSH

Submit Download

is-FFUSA.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\is-FFUSA.tmp
Size 42B
SHA256 37b019e810ea7fcb14287dc783de6618fc54be23e632a77cec2002599acdff14
MD5 0eeae5bfe1f01643d54e800df9299727
SHA1 6502a3394a5595b75f44f463d9b1453443fdcec9
SHA512 9487029eeb57066f4c536df03d1ea85a9ae1e0a122a6b4b109150cc5b53783f48e51d77b62ff84ccee4cf57cd8b34cabfd1e1d08dba96410070282ca982cef43
MD5 SHA1 SHA512

Submit Download

is-LVG2G.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage3\el\is-LVG2G.tmp
Size 836B
SHA256 fa0552c3fc2d2f33d3fdb752bfa8e4f55dd6ff4a77a453755f7d13389a7608ec
MD5 a0638a321fdcb562454e2f9654febcc1
SHA1 21d2d82c5c5a584588c77a1d3a14bd1ede139405
SHA512 b77b5ecf72d0ebfa8bfd966f875e4d10afe86d7e41fed0e66c600531f6f69512b24f9b19130e7a29e27d4068b07e676c026f32a956e4e47de53576f11ab69ee6
TLSH
T1C90152D0B2A9D1122DF555784A808E618C84245438630F4DF37728A86245F651C2C13A
MD5 SHA1 SHA512 TLSH

Submit Download

is-43N0U.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage4\el\is-43N0U.tmp
Size 954B
SHA256 46113db4311c73a48c9cfa4672cef4e1501875fc1f8240884a70577d2756cbd3
MD5 624aeca17cc0d0598e67d3ecfc51e1cf
SHA1 833279a084f9c586a7aedf33956ff35661c8823b
SHA512 5b1c4b6935d5972e8c27c44ac6789acc463e8ce605ca25034f0f3cb681ab7ade54277d8387ef5152f91c6cc5f67623ebd8eeda79d2284325d6058a534e6f62ad
TLSH
T1F211FBD1B2F8C0233EF112389AC0CD25CC50215468530F8DF7273990110AF821E7D13B
MD5 SHA1 SHA512 TLSH

Submit Download

is-HIDJ4.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage4\is-HIDJ4.tmp
Size 381B
SHA256 e743b64dfddfd4c158c670585ff90a4b57c045decd8397062f12f00e1d39f073
MD5 b097c317041415b54f19115474457d09
SHA1 26f90149a6ec951e394b8b11384102246e408342
SHA512 40a649c4d0fb7bc4acdd72dcb74573999505473c44d175574eca76e72ab6a9a1465ddbaa8ea1748548bd8abca7b1d2ddc1aeff9adb18ce2004c3d52ce8c9f4e6
TLSH
T10AE06A737000C35717D24EB244548F6AB9C00F7049DB1945D907DA1F25C041F2D4ED17
MD5 SHA1 SHA512 TLSH

Submit Download

toolbar.ini

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\lnchdata\toolbar.ini
Size 604B
SHA256 fd963978563cd90c89f85aca4d53b18ab2799b4716bb13450033e86517497b00
MD5 8b4d6ede1ef03a68d9cc6b0161f4fbca
SHA1 d188ea0d0c7ce411ab68265e91a4e924fc0dbb2e
SHA512 4281526768d4cff769a2d41bbb7153979148093c391ecf9fbbb4fbcdde1041089198d348543a734930c35170692bb118640aea709057955659f0e3158dda894b
TLSH
T1B4F028EC48AD2DC94A368EA260FCC305DAAA60B51B568ED7D8510CE51595D2F2631304
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1756_1085915345\manifest.json
Size 78B
SHA256 c7e506687caffcf3906916ad3fc190a19212d67a2535479241096bd0d4418b03
MD5 259f068207f60fb9d4448c02c27b74ba
SHA1 99131d95cce94750a928738a99caa5c710bbc924
SHA512 fa41eac9d1ca244d06083e3d4230dd94700861155359722c1d815d0d9933dcd39c113b6f0f6ea02ff7ee1acd2fbc6ed40267d557afde16f417e80b678e8136bd
TLSH
T173A02230AC02E23320C803B002B083C383A02C02302A388C0B0320A232C823BE2F323C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1756_1554696504\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1756_864494049\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f
MD5 cfab81b800edabacbf6cb61aa78d5258
SHA1 2730d4da1be7238d701dc84eb708a064b8d1cf27
SHA512 ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6
SSDEEP 12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T14F724986B34494EFC883597189BD17903374F6EE5F02839B6A267A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e3dda413deb0056300d64212636a6785cc542fbbae4383b4383d4cf0ebbc4
MD5 fb1e85b1485d88ba9cec2cd1f023e621
SHA1 aa0fc9167f42bc9470e917c18515afaaad960620
SHA512 94193e242c6de1dd160dfed5c111ba549c783ae9bd7ef959f60c690664d2f3279ec6a50445fb7fe4b959e2c95eeb27fa56c5920a84e5d00761487e4265cb997b
TLSH
T1CAD0A7B61A1EB490F27D0A32A011C700776D16E32D52A305F32C880CDDBD0D526C66C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 83e54adfc6ac75bae4466793d0ce19b7f9225ba10756ba8e7771249f0f753f57
MD5 eb96b4f1910d9785666cb5f5444d456e
SHA1 fc4a673e2c4826f87cc7bdd8bdf8b5c286cdae8f
SHA512 a9cb14175a4f8066cc70511982d0e6de0cc001fe126028ff9539164529145aa6ffbee53d3c1e767c8ea9b762c89a937ef1d598d95404f2a879ee442e9565edb8
TLSH
T137D0A7E577097010F26E4A71B415CB14777E56912C62A714F22DA44C98AD0A522C92C5
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d4280e01e5b6f1eebb14f5537b4d5c1d68832ee3ffdebc8ee2947a822827ee0a
MD5 36fdc68ce43ab7589d21c627f73c5a40
SHA1 27b5515632f91ad9fee1ec8fdb0f8dbe7860def5
SHA512 424d9900d6efa960e90a6e487c8e3a9669879e148d97c0c16751cc8c275cd6b0bd1ebe4d8982c8f5314cf2e6b1e901610e33d7504a6519188b26eea08858a78d
TLSH
T149E02B69DC21EC3719FD1718A00D4B46EB0017172641494F3A3C82098FF863A45D5C5C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 917e617952749f71fa313cd27b6bac4e396f8137fe204e29383c1b5bc9f67c2d
MD5 ea3e10a1575f2a2a5cb893ad1c339c16
SHA1 d3e3ef6b156fee0dbfcd463fd446edcb9bf8eceb
SHA512 08edd92d897a87e0f31a22296822d06607bde200bffbe26291c9df6512669a82e97fd250d0bf66d1dd982dc111ed6d9aaa2556b783b0fa915e593141584f449a
SSDEEP 768:zIt6TAE0lBVxrJYl1dIMp8rtT6SOl/iqwWE:MtvVxtY2MirtGBl/iqw
TLSH
T1BE13C43E3A581CD6CAD7547D199F6A3EE33EE931FBC2134763347002476A70A6A4E990
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 43b533cbb9af42a418b4dd89188e14737637c767338ed700aaa87e9b8387aaf2
MD5 0a8eb9cf24d85c580da2d5579b49846d
SHA1 5080f4d1967c41ea1efd9369c8b21c0d4cd4c01f
SHA512 50c52160111e830114fa2ec4fd4eb9cf48866fcdac12b0040e1bc6f0802240a37daf2e15051dbb5500b05c29b352092c91a55c65519ce0f4519d17c11835eedf
SSDEEP 3072:TL/uL/EiOS0IL/PL/4L/hq05BnKSHGVOUb:TL/uL/t7VL/PL/4L/hXHib
TLSH
T184446FF70851A05BCBA802F6E2133E3DD177416D7DE1E8E9E6780CD52825B22B6BDE44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 0417d836dba1b1f3fc29f4efdb2788552218b0b8b00687e2182159b25d90d21a
MD5 64916a1b79d2e8a0287948782264a79e
SHA1 e2dd3631c76379e5e2dcc188e275a1a37847acd4
SHA512 23360f865ed3bb556c1b6680a35faee07f1ff9427ba3ec609ae7134a70cee5aa9fab74f72007fae8edd75bd5dbc14f499d4b19e8f787b56fae5a979b6478b8f1
SSDEEP 3072:ODf9y+HI5/uCBLv2b6aJN3QnlcZcvqxl7acrZG95mimByH0N/:if0v52gKhN3IcG87a0ZG957H
TLSH
T1192519EECB682C82DA6B877470E0D9077E712183B69CC0D3A944C5D897D6B8175F82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 84f6a417af3d83eba14039e41e72d1f0947a8512ccbacae7ef4f61e4fe4b1020
MD5 2e8480ffe6764fa08ea18fc77b791b10
SHA1 9bdd41c7ef08384e808f5d0fbb4d9dc288f6e761
SHA512 6b0b879d48cbba62d4d5e91201c1f3568f686bbed51a912b87b48f68e2a584c942cecb7892e8407b77c5b8454ba39f93019a213410621112fee27061de23211b
SSDEEP 24576:pYIolGXIYmkVoA59FSLlPygYWAM9PJhe49JVs6uYYH7+0Oq+6c5J+ZrLLPa7Aeu:pYeLmkYLlPTY+Py493sIYb+Lzn4OA
TLSH
T1C3867DEDCA6898C3CE639A30B1F0E9477C7413C3F595C1D6889CC584026B7C5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f71794a932a21b68750f7d1e9bfb52e61be17d20e055a739167b177908f7d30b
MD5 912a16c4aeaf98dac15df942edad9acf
SHA1 9287bcc0658d43d2469fe5c58d8e2e9d70210da5
SHA512 7a77a7fa7d2494d495eb1a50649d218ab750feaf024743dbe24a43e7735cacb21951e62c3493743e9aececd2fc8c04819519dda2123b494fc68940fe0edb0725
TLSH
T12381E97009D391A9F360013382DF050DF9B7CDF9FE236E916894A8B2136B37081ACA21
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe584021.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe584021.TMP
Size 3KB
SHA256 ce916f7e4f905e56df23d7ee1b10fd8886a9ac101572c36f1eaf2070f609a00f
MD5 6bba2d14a66f4d6911913a2e944416e6
SHA1 eb3be019008c55a63db6e944999dd783536fbb5d
SHA512 8bf85fd96ff211b51d2314379fb1ed76055d198ed0a3bea0872ab214514bdc75f008ac944e2faa56f1d259a4ef14a0c312bd2e8cd0f8bd47cfa685c1f5b8c1d4
TLSH
T1B181B57549D352A9F360413381DF054CB8B7CDF9FE276F916894A8B1272B37181ADA21
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 500604a66248861b340ecf13d1e15fe370da462266a92e5e433335caf72aaadc
MD5 bc4515186cf6faf1042c76eff9af76ed
SHA1 56a5e35317507b46a7503d91dc812de2174e231b
SHA512 2e36e90a0d968bff639cbd4709408c61c64cf169c762a1c4a3f70c4d6272f21db07f5d08bff5cb34a6af098d3b58ef65b10a5adfce4278850a5a31ea45661243
TLSH
T184E0D8A556C7C15ED66039C251346F1886853D82DB996F032B448CC47A02411FF46AAA
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 061bc760d9f237193915b830b7ee51a8e9a9d8886657297a7f1bdca19d8c7986
MD5 63027b3db31fc95dfbdb2fd608f4c19b
SHA1 2acae5a0a7415bf017758b9a2d2c1a3079cb43c4
SHA512 0d2fe64cce37961ece0c3c7a78bc25ad6f082ca47141f49acf823fe52e8aa532b7730a9553b7b1d39689a8944cd1fcf9f853a04bbafa2a3142bec04e79fda2f3
SSDEEP 24:TLAga0Zb7OaIbz+UOxUDDNzWjJ0npnyX7y+j3Vt+W5LVV7K5fKFtIqXLqYpqQ:Tyi+7f+UZD4jJ/BJIWxbCKFOqXLTpqQ
TLSH
T141E2EE8D3B11F521C8ED733EA0C2C5E05FBC686C864DB071963C9D768C53A65F49E51A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 7fdab6eda21b20f41187043e9db2337f2a93783a42b57bfb392291aeffead451
MD5 b49e774a64a15efca87bf2bd49b8b671
SHA1 319fa0e8c9c8fc82feeda0648010ef90eaa2271b
SHA512 10418df94b65b94662783ad0b383a636179554ec79a2059f887d538c9ed1d3920852672d57a5bb27831ef8035210181000e42fbb62866c4c3853ba5ab9ca1baf
TLSH
T13CE0207407C9C23AD65C7CBB427C5B0C96D139C2A28C3A412BC88844E201541EFC9354
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 07744384fd49e734c96391640f7c5041a7c7ac6fdf82e8e7e417a3295bcc8aa7
MD5 dc21168706fb7f214d33773b20ba2be2
SHA1 0b3d2547cab1f4a188c03c632461bd47bf385fab
SHA512 6f296fdf9e687a691687b277d9735bf96bd448a7f0cd96bb3a973785f49945cf7678f243c531845660083e0b1c27f499f409adf00adae8b46b91530935b91baf
SSDEEP 48:uzBmw6QU1Pz2cG01gSXZhr/xXtzHNSWcYVl1cGl:6BCx2czVX7pXlHNSWcAl1cu
TLSH
T1A692B5134F387052EF450E7B256B853AAD37D01CAFB5AC90393614A14CFC4A2D07AAAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 4c719c33f6fbb77d0c81d5064dc415e727caaf844637af01b12b90751f0ce01c
MD5 b26c048b58a758bb05a228469c4377d4
SHA1 c2094f75f178c5ce52d370bc8f56abc82973f7c0
SHA512 ada4ae031af09c1599758818c9a3c333e6b5a7fe8129103bb7a1b493e7eee7cdbb142b1a5c30e5ceb91e8697738355c29842990ea3cd93782f598403ef8f4048
SSDEEP 96:nZchIU+bGz83uy3+u4tgp4DLjGQLBze9z3Bc6jBHMsDEuspU0wbtqrOQpPfR4J+1:nZchf+G83uy3Ct7XBBK9cOH7DXspU3iV
TLSH
T1E214011E4F243721CDBD917669EB44B35D7DF03FCB1266DA686104B4CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 2b7c85f340a6db32b038b90823de72a2dad5a69174b76a6843ea884c3e9fe6dd
MD5 261732a3bf8f6df22f59b239bd05f103
SHA1 50baee64cc00ef3b9e08651c7f03300d10158a29
SHA512 9c192aa38078a7746635c24071604d7a0073cef01581a8dda001dfea842ee8d054c4d399a0a54b7b014c5da5c0e16f4ec385262891d813d0944ac2d3c2c177f5
TLSH
T11CE0D8744ACEC15EA149249B92347F0CD7A13946E6DD3B012B449844B501004EF897E9
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 30a6ca861680ed15cf013b03d4673be9785131dc290d969fbcc0ae0f5ddfd542
MD5 b5a40fbe7c0cd091c5f1dd6e1046422c
SHA1 272353acd05a40f688abfc80a030ec397e40b5e3
SHA512 8c4c06b13931130c9e9f1819ec979f1b8907e376ccccc708adc1b474e1774770e06caf5b07e859876dfd8d1bae258241cdb4864f6b0324f350770a1dc9720d32
SSDEEP 48:T2SLopFMatSaw/auUOt8BoQOeNbRkcpHM3loHnwzcY6ivwH:iSeMatUaAKoEHyqnqckvA
TLSH
T1ED9286DD1F287051C8E60F32CCE8CA262E3C11288333BF92990C10F28D95657BD052B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 9068ee81704e965f40475f7fe20c1065b64bf72ac0e34e61af2c2923e3b57080
MD5 096a8e361bdb689aedcf1ad02438a26e
SHA1 e4a2899d6ae093647a57f7e9bf8e6c8587074323
SHA512 985bdcfdcb448d21624b84980065656931195edfca5035bb0f22215e8f24ac83e2c2a982cdb6a8875950d7b8b1493ef1f1bcb55b0dc9160371a5a22c9125c523
TLSH
T1AB619CF783E4862EDA0191F0A6156E1BCE2D0614536C3D6A88E49F2BA7E34E1E14194F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 b24ec53078f9aeb920f4fc039f11b97d18f68f89d7af944930113b8050d7c084
MD5 82840ab749c0ffe2cbc28278af56acba
SHA1 b66be02bbd2d35bf1e549720e587f5c2692e51cb
SHA512 c0b618b578274b7930220cbb849b6641f45159affe22753298d349c0cdebc67bc8e608fb1d51039adfb469f9d5d5baf4487b732cb390a294831760835c0a1066
TLSH
T17451CDF783F4866EDA0191F0AA156E2BCE2D0514536C3D6A84E4DF2B97E34E1E141A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 1d6cddbc83e438e8d5c26b3fb7facdfda2c1a32c480a331aa40718bdcd577f63
MD5 4ae77e4473c41cfc6f414e2c48952408
SHA1 5d5f28f333060e06bcee868cef0c6a28775be416
SHA512 ed4e1fcebed476ee81fb27206e5a36ec7832a367d7fe9b2f713d5f87c296bdf476d20d663f810d3ed25b72b077f10f4e1b7e2c977f7834550683b7e8c578780f
SSDEEP 48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSvOlT:OIEumQv8m1ccnvSkLGeH2hf5nFXW+Z4g
TLSH
T1DDF2DDFA07276105D98444F0E400AF8EAF16014B47B6B7EC76D447E3F7A21E2B2B9796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 522B
SHA256 b718339ed2297c2920c828a16572903a4285e66d160e5f501e08922a94049195
MD5 4d593de47cebf54a3da5db8d9b413f2a
SHA1 ccac70044b0ff9c22a38fa952185b2639cf7936a
SHA512 5973a52a6a2c6380ce3c9f2084f2f4454fda32558f22e2b7f47cb217c3d96930540cb0071bd69dcbde9642f985d272277099e06ab4fef0ae5bd1a0cc54bcd88a
TLSH
T145F0E05B80BFE65711284A760E84BC455F7AB4314242A8B4DE6AD37C70945F7571702F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 97f2ee5495afafe21f788b4c9dc0dbb2c4d29a4423d2ff9e21e7c1e31aa51445
MD5 ecd7e9826b2f99c187c5459b2cf4c827
SHA1 b32180e28a493ba252417dd3fee97ff98a345481
SHA512 14135d29901c4099c3aa55c91bdb36584c0e58a3d2bdd3dde62b59567b5bebaa233d0c9f9a15625c4b3197c93dd029efd3a31593927050eed144ab64088fba6f
SSDEEP 384:sxZYcML/f7ss5WvY/azIKY3hHbG/XVrIZY:sgbL/f55YY/azCHbcXhB
TLSH
T12F72D716AA24597B8DD7D319FA45BF63D3F91567D1904E449AFC8A1C00EBBEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 e2d84fb9ca1230b5d6410a5aee1f32e9360cb0ff300d2e9896cee58bd417e37f
MD5 4b0f97c119208b8f89b0a96c53f2df0b
SHA1 df50100a992a8875e5d11f517994ceb06ac29ca4
SHA512 2dd79dadbf4e681416194186faab66c8627b6de791d6e2b54cfc2a57bc203ea7c8ecc61834388ff55a808e38186111bec5130ab5b170674409753f7fb9b2f7f3
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXysy10Llw:eY8Od/HEnFhWvFvmXu1javt10Lm2NuQq
TLSH
T151F2FB3B6C0CCF7E4F844E9CEC2A7F8A6DE802CB5698895447FA844C02C76EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 4003763db36b81df41aa6f0f4f722a7e48362fe1f4de8c598a077a2a05ef56b8
MD5 de209a31dc5b0e4e81dce0e9fc868121
SHA1 2ede0a263a4ca14f7fc85f7871f5d85b184b7635
SHA512 9eeb1acb1399988eb2de7199627fe15d0a0f764f4d36cf3f6fb9950e039e266ecfa45f2a91ef4cae0096acd67a4c14da7fc1d956094153c156f242eca8d0407d
TLSH
T12DE0206047C5C1FFA159654B1238A708C2D97957D2CC3F013FC4CC4C7742604F656260
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 af6fa48a279b90c999800f713363c2e4392bdc1991a5afed280b6c08566d82cf
MD5 41faf4c6e72da623c27bf093f5751c72
SHA1 77ecd16e3a39abfbfe32c85dadaa95395ca4f0b0
SHA512 381fd387a31cc6efd55afe453ac9ba7e362cf4c4ce3a502a2dd4d369870ff9efd140c7e41372cfe1adaca6949588c0d41b5f95cce5910596d8a24986a0a683fb
TLSH
T10DB01261BB0C650BC0CD2832164247F07660E80310030953CE6C8F708D8F758BEC1CD8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 0ab7e277d4f8bbc7c4c5eea767cd96de5882fe469fd0ec316ed5ebc21fcacba1
MD5 c4f0a47de502ac08b45cc06e9138a733
SHA1 8c3c0866df72793cc79a2a654b2352f0e964ef52
SHA512 4b5dddad107c80850ca79dc8a96bf9c74fdde8f22caa06b3894cafba7fd610cce3b347a03b64d8ca92c9ce359321d3352cd037040abbc4b7c8e33ac8e9959dff
TLSH
T11AE0D87027CAC6BBA189348BA238E708C1A379D6D6DC2A117F48D8447746144B75B260
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 df20fbf0193aa670be908ca1ea12299c58694001e2790cb55b5887b2c0c97451
MD5 5403af99a9e16ca0bb7e9b908a81827c
SHA1 2a81182117f554d84d4ebf0a3850430f118b53bd
SHA512 a340b93cc601ff4de6fc0a14df04affebef1d5c3d491089946d21f1ac3f136d6d53ab62681149920093ad2ea03537a7a6201332815e699bcc04e8f7287a8b7c0
TLSH
T169E020B057C5C67A9044B4879274AB0CC2F3BD9E97CD3F03A74888447641110F7FB291
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 1228f8f2f0b4dedc0a756f68a14cf552b3a6469438d4a7dff82c36ea6b23a5c7
MD5 a205b0174f5c9363125c7b99e54a9e64
SHA1 c2df9dec3f19fb994c154ecd89bb0548de26fba9
SHA512 4389aac6270d17cae88a19467cac155e5cd8dab6e791851d5a2a27c36b0fe24cb976b8da40cd167b3df649202f9974075b58b1ffb804eda1fc1e647588804c9b
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbG+:05ppxnY753RNBvRJJdt7p5J9VlfC
TLSH
T14AB29D1A713E0212397E2948B39696364F4235A37058E4BF7FB814A54F67E224CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 28KB
SHA256 552f48454d3fd49bf7a1d6ba5548e2ac90232203c4ea71b8d6752ad3d896f856
MD5 23f14c5331374bdb6d897fea7ab18376
SHA1 d32cf51f22e6a18b5c3b510f0080f8a959895fb7
SHA512 8df0e928a4882f4404377186a8b32203b5493032d6e9f0e9ff0b06ad16732eb41ce0049cf29ecf473214f1c9f3936ac55a90590befc914340d46a773e8b3ef25
SSDEEP 192:05ppxnY753RNBvRJJdt7p5J9VlfUJXCHd8:0LppY93PBZJPtN53VNUpC98
TLSH
T129D2BA16713E0211387E2948B3A596365F4235A37058E9BF7FB804A68F67E124CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 9fd508230cb00d362a0421a0f685c37d4ccb1caf9b1f130310b9e11ea23a3e90
MD5 3e835d4a11134a976f4f5bac6ff66e63
SHA1 5ef239450982d25f56489de452b88f3281d51bdc
SHA512 df5d34885c0267a6fda85c304b78843ca78459ac8bd6cb5befe8bf94b7ac765dc28911a48ca99496738d35b509b3ad76b404685cd8ce7e6e494c6f2f17ecf71a
SSDEEP 192:P+xWQwDofT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mx/xfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1FC24730A7B747001EDE6DD721CB080771E3CB16DCF22A6916DB654698DB2853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 0d72e5e69a6cb77cf49d1f9b18dc15f6d3c8d7d58ac241032c0bd965dfee8433
MD5 7c017c536f2974bff514545eb962ebc4
SHA1 d0405e6c47746539b8c13c0cb82977200032a6a5
SHA512 ba930a03967d815fbe60a8072be847263ebca61fb876f0cddd99539b870a1b441f7d3fc4edaf73ee71f56c0507e35e21de7ffce585ca88bc2268b4965da0fc7b
SSDEEP 48:DEK3tjkSI5IUltGhp22iSBgxYcGkOB2WcG8W:DEtSyGhp22iSUYcvWcA
TLSH
T1A1521C9FEE70A113CCE6877185C462E57E37912A8F80CB0288DA00466FF6692535F9CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 2KB
SHA256 85bde4d415baccc85b89ba523fc7a5bf75b142b7ca6522997b7390b5c22c8d11
MD5 a8f08da39fe0514fe335950f563c3315
SHA1 d92fe701d97d527b7a2fb416f83480985c691d79
SHA512 fc318da969055bda6608ac992097301429c4b67899e78295f544e05274bbc79b27a5d638d2c7e40686eb5c80cc0a4059b669ad955e7f4da9b65002cee32cc8f4
TLSH
T10251A6C0A3A950957F89A981D31A6613BDE13F5B260E98B1332D44F49F44C298F2FE35
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 10KB
SHA256 05c172a6b925c2ee5b1c9872947e7edf319d8d93f01ab4ed4b2ff61df2922833
MD5 f07b4c1c0d6b597563e960fe0c014d23
SHA1 4a50526f2a14cff259e8feaeb21d790284ac0d3d
SHA512 d98ba5801ca369ffb001eba301addba0ee12884dabe4f702bbd42bfbd354aa9f4efe17d6aa6756927ecc4f5766ca56ded729599271e2994cd10f698314af3d9f
SSDEEP 96:ua89+uFgxZ9jQgOXOZeDWXWY1lDkseCyAWVBDl9HNDWWVMFP40wl5N:mQOA4AsBDl9HNCsMFP4fl
TLSH
T1A322212CAB01B73BD00D6EB7227A4B5487D2E08342BB676E7564085D1FD262787C82F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 d873afb54ffd178e895db958aac454910a7ad4f8fc8faf0abe6bbc67dec341ef
MD5 de8f857209e6d5f3fab7701e3c965124
SHA1 d71b09906f8c42093c0c91b958fece2681a1098b
SHA512 890ea481f7627f7c884bc34e80a1ac9c470be409d816dae29692cbdc3a93ebc978f1764fb169cfec88cf8679aadddbd1626a41d83e2f1acdebf4dd0c3d73f8c7
TLSH
T127E0203057C5C17FE068248B61345718D3853D83EA9C2A452F40C8487541110FB592E1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 813943675d1e1a7c0fcf9ccbb89fff24be90fdb5d910cb641ac535c09cde1adf
MD5 c67f8d0b8ab1b78a586f94bdf7d27370
SHA1 e486e919c4b3293a18b13d345f95dbd1ecec9b98
SHA512 7f65e37388f0377007e76125a56ce26774addb71a44b192fb8b52dd19da1316d781748ac33d98aba2b600fc7d88c67265e67f1782cf36c71f44abf3e0eb91ae1
TLSH
T1E3214C15F720D158E18E863AA46BAB251378E8528FBCEC0F847924752D72F044E8B6E1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 829dc1c4d25b8ea968146ed46ac8d98478c748540fc1e2df0835bfd0c6d79dd5
MD5 0c19790763aaddceeba5b76fe16a0e1c
SHA1 abbc837c3267219373b4bea0d0be381e7cf95dfb
SHA512 ce96a83f8927f63d97eb5777b2cd9882867e508313daada02ed136bdc3d99c917b14762f0596e3ecc257c375455f99eadb11e0136f2f9e9bf5eaf0aa1997ea6d
TLSH
T18FE02030B7C9C17FD058249702749788D3963DC3EA9C2F422F44CC485641145FB6E2D1
MD5 SHA1 SHA512 TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b1132d92a25cc3b2bbf463a18464bea44cf876323f4958a29d896b3268fbed5d
MD5 2e337ab77e0b88ac85a922be8e841b80
SHA1 f5af04464872adaaabb9ccfba00229fa412f029b
SHA512 7595eb487eeeb7878002f7179461b1d8bf4a95983ccb0d5aac301a602717d1fdf465536a4d20645677745c5ca34d44a7483e411e605e26d5afb032a6ed76a81e
SSDEEP 3:MsEllllkEthXllkl2zEflIgXl:/M/xT02zE1
TLSH
T16B4404147FC00C05DD0510F04051F3543370F4D05711F7C334D104335DC75400C40040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d1ca7dd92b9da505b098f27e927da5236709fb90402c0791ac025a1e0b1d01b2
MD5 ea9fb3c29d2993e01a03036539339eb8
SHA1 07b1913ec701d1180b0e4957b118f123c03b627f
SHA512 5050a2bb5ea2de8e3aede45548e23b2d72d3732c02f36f9bd49e130ab5fc9176bc1e6ba38131d30e9448524a662a6d904f8143dc856b658ca4bf203e5f0edda6
SSDEEP 384:npYziFiZcI2sN98TUNTUlI4DQckCrV+rzXPphBftGnvAuxuvzxV+Mhdp1BDgL/76:pYeFQ2QwgSkuUrB1GvAu4184p1AW
TLSH
T1E7C23A71D854DDABECEB8B85BB4A3743AEF45163C9CC9AC4D9E95D0D008729E070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 f02d93a8abca53c64156a7457b4aaae2ba5af9a3815893c32228ac664bd0183f
MD5 49bc12632052f2a666be74da6a680386
SHA1 73acbd070880fd831cf84b4da49293c4b25d737e
SHA512 62e9a4d44f51f846a8a2fc8caf55554f75a628b76a35865b1b2a24f1a49f6a33f7dcf9bdaf56f4735353f4b0f25e5d6ac739cc17197e43ed9127d4faf32d5a09
SSDEEP 768:pYeFccpAewgIKkuBWB1GviVS9lCK4GHA4184p1X:pAO+SjMjgAbMX
TLSH
T1F6E23B71D8949DEB98D6DAC9A78AF203AEE01137858C899CE6F87D2D304F5FC070A915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 f7010385e571ee61b35ca05eb3ac3636f688e1f0807b2d6d4b1ac9b86c4191a2
MD5 5dc1a504fcb30fcb438928f922a01ed7
SHA1 9c9aeb2081ebf6161b9a6ac7b9f42daee972a1f0
SHA512 f853d886647e3e6c31868d2172ea7a70f623113e37a57dec5713829854ae12f1b805b900901dc76bd01a6303604dde9928e0cb79c51edcafcec754c0c90d225a
SSDEEP 768:pYeFccpAewgIKkuUWB1GviVS9lCK4GHA4184p1X:pAOjSjMjgAbMX
TLSH
T105E23B71D8949DEB98D6DAC9A78AF203AEF01137858C899CE6F87D2D304F5FC070A915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 12f1947da1f181a7e1276be02cc0e1f4c22933ce6e1f06f885477e845eee5fd2
MD5 af7fcacd42b62b1be57eed31fc51f0de
SHA1 ceb13e06f5b2b1e4434286f79b64d1bb21e1b741
SHA512 8816c72164f91b3ead0beb50c5470ea8d89902f01f34522f77f24557af95640ea205ee6cbef0da8eb2f5c28fc2a689f8631f9b0c621574e9b090cfecdd30f276
SSDEEP 384:npNiF9CcmyWCs3sNj8TUNTUlIm2QckCr9lWKphBftGnILpae4KV8p0mHpty/7IgI:pEFccps3mwgbkUUk1GIkI8p0wd
TLSH
T190B25C36DC58C9BBECE74F99BB4A7A03DEE41267869C99D4DAD81D0D10871DC070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 bfe3eae36d1a7b3e772d32ea86c7bb029f3ac04a7cf150c8f02aaccb6c344225
MD5 6e40b122d4e0372a45fa28052c525436
SHA1 fefbd0ac918deabd16410c61b3da326546bda117
SHA512 7d8a5e3a5136759ff58e4adc9edd355eb1b65bab125bcf62771162d87e19c2ec2a01d7b337afe7af9e5343c7e7e044d22c1a24142cb5c414b70305fcdb97dd17
SSDEEP 768:jgFQ2QwgSkuUrB1Gm9IWvCsG4FK184p1AW:F2tEOWKszPMAW
TLSH
T12ED24B31D854DDFBECEA9AC5AB49B603AEF44233C68C9AD8D6E86D1D108B1BD0307C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 896cc971cbdb60bb590b5b804234aa46a3a2da0fe8ba7d747f692d2669b06281
MD5 9d59c3d778c17bee515fac7aaa4ffd7e
SHA1 02b57e66558aa5c009b8728ecf5696fac4d624e4
SHA512 9454612e07137f01049f9fb8e8e93f57b0551f1d4f358eabfa3e59df7100c3e322d8980bd6398d432efc84d202c6837a2f6409a3b167bf8452124f03eb56b9e6
SSDEEP 384:njziFiZcI2sN98TUNTUlI4DQckCrV+rzXPphBftGnvAuxuvzxV+Mhdp1BDgL/7I5:jeFQ2QwgSkuUrB1GvAu4184p1AW
TLSH
T136C23A31D854DDABECEB8B85BB4A3743AEF45163C9CC9AC4D9E95D0D008729E070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 b90fb88026b67a346a6b0f33791695bc456617232221019f32172edf735f4018
MD5 4041946e585425755915acb1689e14e2
SHA1 482de836d230ad6ab587bd5a11b0777aa7b99e4a
SHA512 63eae3a1de7a1ff2e29a73387f49634a04de2f8a28e108b641553bacecb8d6b634006dc50c5a4bfc6c3556a475a727f66b7c8bad52fb3958be576881deb5b96f
SSDEEP 384:np8iF9CcmyWCs3sNv8TUNTUlIm2QckCr9ZwrMphBftGnviJ/e4KV8p0mHpty/7Iv:pnFccps3uwgbkUSra1GvipI8p0wd
TLSH
T15CC27C32D858CDABECD78B99B74A3643EEE41277C98C9AD4DAD85D0D00872DD0B0B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 45b46987d35123588c9093eb458e23d49674feb552841c131b9923382ff35813
MD5 3fe20bdc96cc432f2a71269d696c1fef
SHA1 8407d13d61debb72fa17b1cfb17a76bf78166480
SHA512 63363bf4816c2fc96cd14e2b5efa6ec142f1b9a3ba151ae9e04ed0ed764b7dfab9177c7452a9b91e57cb5ad45fc21e349d774cabdc29da91bc4ecd7fc0564af6
SSDEEP 3:MsEllllkEthXllkl2zEfl0e01VKXl:/M/xT02zVDK1
TLSH
T1884404147FC00407F50010704451C3507370FCD05D51F7C335D104335DC75410C04000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.8.3.1\keys.json
Size 8KB
SHA256 3d6c659801f1686ff3ac64bc3b24b1d0ae76ffdd5f0e9c399ba37d1354a15ab4
MD5 ee666d1b2290efa6cdbc89ea3d317333
SHA1 a8bdd2c1d7e76fef48a735a80524243cd453e0bc
SHA512 7b2b577c9a168f626a687ee158cc20fa0ad0f816fb0583abfe45f89222d1762eb4fc619e029856618479fb6096a02eb2f9934cb46334fa781cea5cbcec992ee9
SSDEEP 192:uNtGbR0m0GflPAyR9Pm4lOvMwkoR9PuGMXcy:O7mZpKjA
TLSH
T17F02B6BF14A41182CE7FC16D9F0774B78FB03C066BCA3A83925BEA49484196D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 3385622a2418d348162334d9044edf8fd02a598de2eb9650b0f45eb582567995
MD5 14e99dd628ed178ac758efa4781d2a1e
SHA1 c8b35872f522becd0398db73ad6b33b1bbfcbe93
SHA512 96cc88fc7fcbfa80ddbf1f444a4fd3140f99bbc4d89e05cec6e15a9abbfc0150df61f54494e61ac860ab5ee454628a756ff91346db92ae3c0bb2c4de0ddf22ad
TLSH
T1E34140D15C391ED2C4BD0AAEB89738FC85E8C32AF1A4707D5898E8940B7D54D744583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 07f63bba6c9be60922bfe2cb77fa3c387ac8e67a0af5f9c25d5f77f248883c10
MD5 3ad86b5140145f2cb1da86e2f9d42b3c
SHA1 0fcfdc551396e88ddaa80c8f5b7d138fa16d2c9f
SHA512 5d3be1e14c24dc5d70d9da0d302d9a6bf3b50133d06753c2efb40d91890ba5d9b17ad60bd72628ae7eb759d0d28acc1946ad247c22809d9598662798000a7c78
TLSH
T1C0413ED15C390AD2C4BD0AAEB49739FC84E8D72AB1E0347C6888E8940B6D54D708583F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4b08b1a704a367307a0aa7d04efc96e7a3eca31f22870044cbd1f2545d312675
MD5 a8cc30da3ae46583a5d6d12d1aa5cf7c
SHA1 ba1f927d2cefe3faa2827bcba1f6203f0a0dfe54
SHA512 a8de1456bb14d1903d9ca84207b933934843d0cc3eefa486cf05fe71c6f3dd4eefe83354e97fd23bbae5c0341a33808bd1767d466adcdb2301d11eb7a2f9ef73
TLSH
T1B341145CA6FD1148B3B77E5A9BF6A86D487AB9372F07A09E10110E4F4A26B40C971733
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 e2504468db78e37a5cc976dd1b903688fbc7d15aa1cec12a67b213b0cbb47630
MD5 969c56224d3cbd14ae10162274557e69
SHA1 b8a63a184ad6d60bdc50ad76edc7bd4f468e219b
SHA512 b2ec87c6842536ab22d4f2200d1726651ab1ee0e04a8d506145b8bf5bb0874e891bf620c87b672c8c0bd12dc765b5bd53fda69641c59a4dfccedd65b15117239
TLSH
T182514D5869FA1158B3777E5A6FF6786E887B79732F06D55D10120E4F0B22B00C861737
MD5 SHA1 SHA512 TLSH

Submit Download

innocallback.dll

Path C:\Users\Admin\AppData\Local\Temp\is-6T269.tmp\innocallback.dll
Size 63KB
SHA256 6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
MD5 1c55ae5ef9980e3b1028447da6105c75
SHA1 f85218e10e6aa23b2f5a3ed512895b437e41b45c
SHA512 1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b
SSDEEP 1536:+VqUE7JhgAzj/ZuhnOwKWSAXvze/V2C0mswp91:gWgAnB3XDAqt/p91
TLSH
T198534A17B5E14AB1E0A2CABC5C399314873FBD302E78D599A7BD0DCE8D393829858357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pbirds_setup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-F71G9.tmp\pbirds_setup.tmp
Size 680KB
SHA256 427fa988a8a8c63393693ffeb61ddec195f000220ee55fd5112ec91682e933b0
MD5 ed69e64731547eba52476a2d2a2f7882
SHA1 cbcd56bbb5230d11a01f18e9bf59f97802bb475b
SHA512 04202de8dafb4c8964230d94eb44ad8ffd1d138b24f445aa3d707f4d9a9e9520d3d6f80cb0731ab9ebb7143011fe0d856d7e262d9672272876958d5e8ad55afe
SSDEEP 12288:L0QfKb7nH5lrPo37AzHTA63I0ihE4UEQrrNtIECORGv35ELAfXExy8:ffKbT5lrPo37AzHTA63/cfU9IEU353f0
TLSH
T103E47C32F2A0D837D1731E789D1782955936FE103E39A5A776E81F0C4F792817A2B2D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1304-3256-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1304-8-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1304-302-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1304-625-0x0000000003230000-0x0000000003245000-memory.dmp

Download

memory/1304-37-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1304-2867-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1304-18-0x0000000003230000-0x0000000003245000-memory.dmp

Download

memory/1304-3254-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1304-628-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1304-7-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1304-2868-0x0000000003230000-0x0000000003245000-memory.dmp

Download

memory/1304-22-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1304-624-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/2292-3303-0x0000000010000000-0x000000001005A000-memory.dmp

Download

memory/2292-3300-0x0000000010000000-0x000000001005A000-memory.dmp

Download

memory/2972-3299-0x0000000000400000-0x00000000006F3000-memory.dmp

Download

memory/2972-3289-0x0000000000400000-0x00000000006F3000-memory.dmp

Download

memory/4768-0-0x000000000040D000-0x000000000040E000-memory.dmp

Download

memory/4768-3258-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4768-1-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4768-296-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5624-3259-0x0000000000400000-0x0000000000663000-memory.dmp

Download