Overview

overview

8

Static

static

1

we got big...ry.mp4

windows11-21h2-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    878s
  • max time network
    901s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    22/05/2026, 22:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    we got bigger fish to fry.mp4
  • Size 154KB
  • Sample260522-151ntsft9r
  • SHA256 59630bd429fe3aafcac48194e05231efc37445ac14faa55e4c8c56f435edb831
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryexecutionpersistencespywarestealer

Malware Config

Signatures

  • Downloads MZ/PE file 2 IoCs
  • Executes dropped EXE 15 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s) 7 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Probable phishing domain 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 4 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 28 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 4 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 12 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 12 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 4 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 62 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\we got bigger fish to fry.mp4"
    1⤵
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4312
    • C:\Windows\SysWOW64\unregmp2.exe
      "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4672
      • C:\Windows\system32\unregmp2.exe
        "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
        3⤵
        • Enumerates connected drives
        • Suspicious use of AdjustPrivilegeToken
        PID:4340
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 2216
      2⤵
      • Program crash
      PID:5948
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
    1⤵
    • Drops file in Windows directory
    PID:3764
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1012
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb36b4c728,0x7ffb36b4c734,0x7ffb36b4c740
      2⤵
        PID:3596
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,631365522624711319,1757866524621611929,262144 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1936 /prefetch:2
        2⤵
          PID:224
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2140,i,10856290091954545711,13273224477839193789,524288 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2144 /prefetch:11
          2⤵
          • Downloads MZ/PE file
          • System Time Discovery
          PID:2088
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,1044929329495914163,9715858312416295066,524288 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2360 /prefetch:13
          2⤵
            PID:2488
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,11276991113211636997,13881389733368153957,2097152 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:1
            2⤵
              PID:2524
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,11308693272807960388,6683476487965574002,2097152 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:1
              2⤵
                PID:4240
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4300,i,12810991494663628935,8510448025061611707,2097152 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4296 /prefetch:9
                2⤵
                  PID:1472
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3216,i,16253644836624320233,13768090921512048858,2097152 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4752 /prefetch:1
                  2⤵
                    PID:4992
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5520,i,10683043310398293666,4280204581886286115,524288 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5536 /prefetch:14
                    2⤵
                      PID:4492
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5812,i,10988146652788386531,7444251630532094068,2097152 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5836 /prefetch:1
                      2⤵
                        PID:1700
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3508,i,17774395118854186885,8531731567232548797,2097152 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3684 /prefetch:1
                        2⤵
                          PID:2360
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3536,i,9910203774628905984,17178806287719590686,2097152 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3584 /prefetch:1
                          2⤵
                            PID:3960
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6020,i,3122807858141090620,544445750473385990,524288 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6024 /prefetch:14
                            2⤵
                              PID:3004
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6000,i,12888790998935460242,18431595058047795679,524288 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6052 /prefetch:14
                              2⤵
                                PID:2204
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5996,i,15626769838661504177,6110288621834586092,524288 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5988 /prefetch:14
                                2⤵
                                  PID:2304
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3692,i,11261278995678932133,9176817676160329011,524288 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4300 /prefetch:14
                                  2⤵
                                  • NTFS ADS
                                  PID:4300
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5988,i,10481172499909368025,17931795060269748918,2097152 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6032 /prefetch:1
                                  2⤵
                                    PID:4356
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3676,i,5525013300315693589,6291108071961872764,2097152 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3892 /prefetch:1
                                    2⤵
                                      PID:4820
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6168,i,3433077386087750995,7582207227197881951,524288 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6224 /prefetch:14
                                      2⤵
                                        PID:3760
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6156,i,15954316631081991098,15559648031162183596,524288 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6096 /prefetch:12
                                        2⤵
                                          PID:4184
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6248,i,11737109599026130137,6340990851540160264,2097152 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6424 /prefetch:1
                                          2⤵
                                            PID:5140
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6636,i,11652362617413707495,16663439929851703100,524288 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6564 /prefetch:14
                                            2⤵
                                            • Subvert Trust Controls: Mark-of-the-Web Bypass
                                            • NTFS ADS
                                            PID:5416
                                          • C:\Users\Admin\Downloads\SynInstallerV2.exe
                                            "C:\Users\Admin\Downloads\SynInstallerV2.exe"
                                            2⤵
                                            • Executes dropped EXE
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            PID:5628
                                          • C:\Users\Admin\Downloads\SynInstallerV2.exe
                                            "C:\Users\Admin\Downloads\SynInstallerV2.exe"
                                            2⤵
                                            • Executes dropped EXE
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            PID:6060
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6620,i,17915118254101142348,3849270331987785179,262144 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6932 /prefetch:10
                                            2⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:2016
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6676,i,8127473359375890586,9752958281142723796,2097152 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6928 /prefetch:1
                                            2⤵
                                              PID:5592
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=7044,i,14563159461954837685,2887826744608298416,2097152 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7080 /prefetch:1
                                              2⤵
                                                PID:5648
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5780,i,4515260576137070093,16921725902317278075,2097152 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5544 /prefetch:1
                                                2⤵
                                                  PID:2904
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6996,i,15062730506773117176,16519967055091123416,2097152 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3684 /prefetch:1
                                                  2⤵
                                                    PID:6032
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6520,i,641313190551225866,17865337757769449561,2097152 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6136 /prefetch:1
                                                    2⤵
                                                      PID:6084
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=5204,i,4262581745022009311,5301065347166182319,2097152 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6020 /prefetch:1
                                                      2⤵
                                                        PID:3136
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6520,i,2527135021397234491,12883658759210059370,524288 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6456 /prefetch:14
                                                        2⤵
                                                        • NTFS ADS
                                                        PID:5384
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7048,i,12611663200318542118,16605275425456881964,524288 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6068 /prefetch:14
                                                        2⤵
                                                        • NTFS ADS
                                                        PID:3416
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5900,i,3070171691529554195,5794238706519621695,524288 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6436 /prefetch:14
                                                        2⤵
                                                          PID:1032
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2140,i,6437841892646754505,6693727662828676544,524288 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2144 /prefetch:11
                                                          2⤵
                                                          • System Time Discovery
                                                          PID:1916
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=4292,i,5405237322580115317,4838067109807125395,2097152 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6512 /prefetch:1
                                                          2⤵
                                                            PID:1528
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=3644,i,18375994681227922638,8086048350338430636,2097152 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6184 /prefetch:1
                                                            2⤵
                                                              PID:1160
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=5644,i,12885961851690790140,15395125620921414827,2097152 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5536 /prefetch:1
                                                              2⤵
                                                                PID:5828
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=3552,i,14923938984543056963,4679728148954760682,2097152 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7360 /prefetch:1
                                                                2⤵
                                                                  PID:660
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=6108,i,6902083394636269059,7071769572879553552,2097152 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7088 /prefetch:1
                                                                  2⤵
                                                                    PID:4876
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=7560,i,15821484377873031522,7033597651414391678,2097152 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7524 /prefetch:1
                                                                    2⤵
                                                                      PID:2044
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=5752,i,16993793596695897938,13494193175447368095,2097152 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4792 /prefetch:1
                                                                      2⤵
                                                                        PID:5668
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=7732,i,4020781635749176802,10817778784825418279,2097152 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7704 /prefetch:1
                                                                        2⤵
                                                                          PID:1116
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=7980,i,13104447615741080819,4500464301377373042,2097152 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3588 /prefetch:1
                                                                          2⤵
                                                                            PID:5208
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=5532,i,14843795088856805066,15903728707650301835,2097152 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7860 /prefetch:1
                                                                            2⤵
                                                                              PID:5944
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=8112,i,17947018864742410700,14326799608530208482,2097152 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8040 /prefetch:1
                                                                              2⤵
                                                                                PID:1196
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=4776,i,2894165359445824040,1123495118551529851,2097152 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8016 /prefetch:1
                                                                                2⤵
                                                                                  PID:5092
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=8092,i,438459067496678967,4854455657347846695,2097152 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8264 /prefetch:1
                                                                                  2⤵
                                                                                    PID:6048
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=8388,i,16471763992036887391,11503033617633675590,2097152 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8140 /prefetch:1
                                                                                    2⤵
                                                                                      PID:5680
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=8256,i,7353129981794622376,9403844627980938867,2097152 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8416 /prefetch:1
                                                                                      2⤵
                                                                                        PID:2112
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=8244,i,4091926679324582551,9116383721608190574,2097152 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8228 /prefetch:1
                                                                                        2⤵
                                                                                          PID:3960
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=7844,i,9616549142822520000,988411346139867186,2097152 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3892 /prefetch:1
                                                                                          2⤵
                                                                                            PID:5272
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8148,i,536070151014941828,13700654072221932257,524288 --field-trial-handle=1940,i,16941553125423087144,7191602726320436566,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5608 /prefetch:14
                                                                                            2⤵
                                                                                            • NTFS ADS
                                                                                            PID:4068
                                                                                        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                          1⤵
                                                                                            PID:980
                                                                                          • C:\Windows\system32\svchost.exe
                                                                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                            1⤵
                                                                                              PID:772
                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4312 -ip 4312
                                                                                              1⤵
                                                                                                PID:5924
                                                                                              • C:\Windows\System32\rundll32.exe
                                                                                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                1⤵
                                                                                                  PID:2108
                                                                                                • C:\Users\Admin\Downloads\Launcher\Launcher.exe
                                                                                                  "C:\Users\Admin\Downloads\Launcher\Launcher.exe"
                                                                                                  1⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:5048
                                                                                                  • C:\Users\Admin\Downloads\Launcher\bin\lua.exe
                                                                                                    "bin\\lua.exe" "cfg\\user-data.lua"
                                                                                                    2⤵
                                                                                                    • Drops file in Windows directory
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • NTFS ADS
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:4856
                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                      schtasks /create /sc daily /st 11:57 /f /tn CCleanerSkipUAC_7d7056 /tr ""C:\Users\Admin\AppData\Local\7d7056\7d7056.exe" "C:\Users\Admin\AppData\Local\7d7056\user-data.lua""
                                                                                                      3⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                      PID:5440
                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                      schtasks /create /sc daily /st 11:57 /f /tn Setup /tr "C:/Windows/System32/oobe/Setup.exe" /rl highest
                                                                                                      3⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                      PID:5576
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\sys64.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\sys64.exe"
                                                                                                      3⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Checks processor information in registry
                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:1460
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                        4⤵
                                                                                                          PID:5700
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                          4⤵
                                                                                                            PID:5380
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                            4⤵
                                                                                                              PID:5756
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                              4⤵
                                                                                                                PID:4892
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\sys64.exe
                                                                                                                4⤵
                                                                                                                  PID:4640
                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                    timeout /t 5
                                                                                                                    5⤵
                                                                                                                    • Delays execution with timeout.exe
                                                                                                                    PID:380
                                                                                                              • C:\Users\Admin\Downloads\Launcher\bin\lua.exe
                                                                                                                "C:\Users\Admin\Downloads\Launcher\bin\lua.exe" "C:\Users\Admin\AppData\Local\Temp\a.lua"
                                                                                                                3⤵
                                                                                                                • Drops file in Windows directory
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • NTFS ADS
                                                                                                                PID:5676
                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                  schtasks /create /sc daily /st 11:36 /f /tn OfficeClickToRunTask_7d7052 /tr ""C:\Users\Admin\AppData\Local\7d7052\7d7052.exe" "C:\Users\Admin\AppData\Local\7d7052\a.lua""
                                                                                                                  4⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                  PID:5452
                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                  schtasks /create /sc daily /st 11:36 /f /tn Setup /tr "C:/Windows/System32/oobe/Setup.exe" /rl highest
                                                                                                                  4⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                  PID:5772
                                                                                                                • C:\Users\Admin\Downloads\Launcher\bin\lua.exe
                                                                                                                  "C:\Users\Admin\Downloads\Launcher\bin\lua.exe" "C:\Users\Admin\AppData\Local\Temp\a.lua"
                                                                                                                  4⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:4424
                                                                                                          • C:\Windows\System32\oobe\Setup.exe
                                                                                                            C:/Windows/System32/oobe/Setup.exe
                                                                                                            1⤵
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:2036
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Windows\Setup\Scripts\ErrorHandler.cmd
                                                                                                              2⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4372
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                cmd /c ""C:\Users\Admin\AppData\Local\7d7056\7d7056.exe" "C:\Users\Admin\AppData\Local\7d7056\user-data.lua""
                                                                                                                3⤵
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:2204
                                                                                                                • C:\Users\Admin\AppData\Local\7d7056\7d7056.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\7d7056\7d7056.exe" "C:\Users\Admin\AppData\Local\7d7056\user-data.lua"
                                                                                                                  4⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:3360
                                                                                                          • C:\Users\Admin\AppData\Local\7d7056\7d7056.exe
                                                                                                            C:\Users\Admin\AppData\Local\7d7056\7d7056.exe
                                                                                                            1⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:1144
                                                                                                          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                            1⤵
                                                                                                              PID:5128
                                                                                                            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                              1⤵
                                                                                                                PID:1116
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                1⤵
                                                                                                                  PID:852
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                  1⤵
                                                                                                                    PID:3832
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                    1⤵
                                                                                                                      PID:5608
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                      1⤵
                                                                                                                        PID:3968
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                        1⤵
                                                                                                                          PID:1472
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                          1⤵
                                                                                                                            PID:5268
                                                                                                                          • C:\Users\Admin\AppData\Local\7d7052\7d7052.exe
                                                                                                                            C:\Users\Admin\AppData\Local\7d7052\7d7052.exe
                                                                                                                            1⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:2968
                                                                                                                          • C:\Users\Admin\Downloads\DeltaExecutor\DeltaExecutor.exe
                                                                                                                            "C:\Users\Admin\Downloads\DeltaExecutor\DeltaExecutor.exe"
                                                                                                                            1⤵
                                                                                                                              PID:1436
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://dw.xrsdownload.com/d/OBHCGJB?title=DependencyCore&tracker=DE
                                                                                                                                2⤵
                                                                                                                                • Drops file in Windows directory
                                                                                                                                • Enumerates system info in registry
                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                • Modifies registry class
                                                                                                                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                PID:4448
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2dc,0x2e0,0x2e4,0x2d8,0x2ec,0x7ffb305cc188,0x7ffb305cc194,0x7ffb305cc1a0
                                                                                                                                  3⤵
                                                                                                                                    PID:2064
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1824,i,6625996034177557090,2350717529890677903,262144 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:2
                                                                                                                                    3⤵
                                                                                                                                      PID:2636
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,16693257106051015050,10762960802292309755,524288 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:11
                                                                                                                                      3⤵
                                                                                                                                      • Downloads MZ/PE file
                                                                                                                                      • System Time Discovery
                                                                                                                                      PID:5276
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,359730302942725557,17436752084282965239,524288 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:13
                                                                                                                                      3⤵
                                                                                                                                        PID:5312
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,13627528387702233814,8066412726813276853,2097152 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
                                                                                                                                        3⤵
                                                                                                                                          PID:2484
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,3274782145086105117,2606068800704994274,2097152 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
                                                                                                                                          3⤵
                                                                                                                                            PID:5376
                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,7006027687432970399,8677415742310982102,2097152 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
                                                                                                                                            3⤵
                                                                                                                                              PID:3500
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4436,i,1214448098422628221,1673944661589431787,2097152 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:9
                                                                                                                                              3⤵
                                                                                                                                                PID:3336
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4640,i,14447981754449622801,6090813723223872748,2097152 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:1
                                                                                                                                                3⤵
                                                                                                                                                  PID:5824
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4696,i,3706363070314204467,9819670427956128286,2097152 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:9
                                                                                                                                                  3⤵
                                                                                                                                                    PID:5840
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4676,i,3878832328282788285,13886098101166264138,524288 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:14
                                                                                                                                                    3⤵
                                                                                                                                                      PID:4388
                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5400,i,6554400550757714152,3452856017568541197,2097152 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:1
                                                                                                                                                      3⤵
                                                                                                                                                        PID:5392
                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,12791923190430765848,12230816057812144444,524288 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
                                                                                                                                                        3⤵
                                                                                                                                                          PID:6208
                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5304,i,4128774250654873482,17194690720999264477,2097152 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:1
                                                                                                                                                          3⤵
                                                                                                                                                            PID:6436
                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,4017930774704760234,44458114368033310,524288 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:14
                                                                                                                                                            3⤵
                                                                                                                                                              PID:6528
                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,11341165316168849077,11056871996163740497,524288 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
                                                                                                                                                              3⤵
                                                                                                                                                                PID:6536
                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,91402700499639763,8417763525960400392,524288 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:6648
                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,91402700499639763,8417763525960400392,524288 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:6672
                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,14772918044873335849,8624459767063224910,524288 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:6820
                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                                                                                                                                                        cookie_exporter.exe --cookie-json=1132
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:6908
                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,17095217870182070746,16221106277044930451,524288 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:6288
                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,2528526791100623492,4524997271506283669,524288 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:6236
                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,8761926626959702095,12252547622066264437,524288 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:14
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:6748
                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,7858886386084822919,4970465564029983025,524288 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:6744
                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,9081863018024235534,15752329067786558413,524288 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:14
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:6308
                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6660,i,14560575207836803544,17318657366503107710,2097152 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:1
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:6648
                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4768,i,10795350689937210331,3938981098609024087,524288 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:7016
                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,13956135081951092675,1888281519037950812,524288 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:14
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:7032
                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,13857303246049893238,7600180878812904520,524288 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:14
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:7040
                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,17267571069660153417,60570887999932631,524288 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:3888
                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,17700309142949045194,13092638127606907142,524288 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:3124
                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=4552,i,3714481669711498305,18270338910059547389,2097152 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:1
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:3884
                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=868,i,16317209226161557425,9982163579874930589,524288 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:5524
                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=6872,i,4776575139708052923,2306832117289958492,2097152 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:1
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:7020
                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=4740,i,17011667357934759319,12064660304609803874,2097152 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:1
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:3528
                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,13868674320920940417,16202659964250343877,524288 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:4964
                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,4238911664331299455,499594909845631058,524288 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:2000
                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=6788,i,10356658346937381554,4894055163314149567,2097152 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:1
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:5744
                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=4964,i,17789728806094337039,1570621260185416492,2097152 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:1
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:2052
                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=4916,i,11600542070967929562,15822887774749231833,2097152 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:1
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:5212
                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=4736,i,1597434622795585117,15643294293713073346,2097152 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:744
                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=6820,i,16327547133951403472,6493397400976806954,2097152 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:1
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:5612
                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=6900,i,12967287994893929813,14986873421644277644,2097152 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:1
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:5012
                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7172,i,16841637811751713207,3795045546971575383,262144 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=7232 /prefetch:10
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                      PID:716
                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=7280,i,14699689798909097728,14223886103719061704,2097152 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=7192 /prefetch:1
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:4304
                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4660,i,12753412257345738139,1739846530762129410,524288 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:14
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:1200
                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7572,i,14662095079400639429,7664429067599031355,524288 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:14
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:1568
                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=6700,i,12654436277572675432,18252600786604755623,2097152 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:1
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:6228
                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8092,i,1898914474466172614,3676607977002638571,524288 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=7632 /prefetch:14
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • NTFS ADS
                                                                                                                                                                                                                              PID:3092
                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1124,i,6971087369425199687,12959116430494506300,524288 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:14
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:6572
                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,5062103540352814327,10419909375581429668,524288 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=7892 /prefetch:14
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:5640
                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7920,i,7345739914546551886,12422569443606982880,524288 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=7524 /prefetch:14
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:5956
                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7952,i,13284757487240547080,10900478136942621309,524288 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=8112 /prefetch:14
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:944
                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8332,i,9173974845600282165,715066401429299677,524288 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=8336 /prefetch:14
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:584
                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=7240,i,2195982095705371446,10578509161557947073,2097152 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=1120 /prefetch:1
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:3520
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=7556,i,5511795015538593038,5130486994532356850,2097152 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:1
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:3928
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8064,i,15037888177107212245,12915267217988000524,524288 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=7692 /prefetch:14
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:6664
                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=7404,i,5263833904732510315,14495963725274294242,2097152 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=7772 /prefetch:1
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:1152
                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,15372826737675121086,6225813841812130647,524288 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=8364 /prefetch:14
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                                                                                                                                                                                                                • NTFS ADS
                                                                                                                                                                                                                                                PID:6384
                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8376,i,8901902503228962869,13118197188689078435,524288 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:14
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:7100
                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8376,i,8901902503228962869,13118197188689078435,524288 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:14
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:5740
                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=7220,i,1184050897916079486,8593756799498899099,2097152 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=7312 /prefetch:1
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:6772
                                                                                                                                                                                                                                                    • C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.8-win-x86.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.8-win-x86.exe"
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:784
                                                                                                                                                                                                                                                      • C:\Windows\TEMP\{07739554-D1DC-4CAD-AFFB-EEE504DEA569}\.ba\wixstdba.exe
                                                                                                                                                                                                                                                        "C:\Windows\TEMP\{07739554-D1DC-4CAD-AFFB-EEE504DEA569}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{1BCADCE5-50AC-4776-BBD7-0C2B002B0C71} {0DD45BC9-A6DD-46F1-8B7E-1D289571597D}
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:2248
                                                                                                                                                                                                                                                      • C:\Windows\TEMP\{07739554-D1DC-4CAD-AFFB-EEE504DEA569}\.be\windowsdesktop-runtime-10.0.8-win-x86.exe
                                                                                                                                                                                                                                                        "C:\Windows\TEMP\{07739554-D1DC-4CAD-AFFB-EEE504DEA569}\.be\windowsdesktop-runtime-10.0.8-win-x86.exe" -q -burn.elevated BurnPipe.{996AB689-B25A-4E41-A180-1B47638E9585} {51517E78-608C-4DF3-9992-43D786887A4B} 784
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                        PID:1432
                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8348,i,3431701456106073974,15925968758457633992,524288 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=8900 /prefetch:14
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:920
                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7352,i,17842665159109464117,9014943836098395342,524288 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=8348 /prefetch:14
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:688
                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9032,i,9632308721051206845,11392213868080316395,524288 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=9060 /prefetch:14
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:5152
                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9188,i,2037452099789747390,14986902649078590721,524288 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:2000
                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=7708,i,13439776956447700115,8570264664358428961,2097152 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=7768 /prefetch:1
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:1204
                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=8480,i,7334859264031484092,2943327046839125375,2097152 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:1
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:2828
                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=7716,i,17879508673126905198,17482123935852189650,2097152 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=9328 /prefetch:1
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:3316
                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=9484,i,5061861459100169965,3320014435032833085,2097152 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=8884 /prefetch:1
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:5580
                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=8348,i,11389471167283007021,12094250831775538889,2097152 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=7292 /prefetch:1
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:2528
                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9692,i,11293488057592414461,16263678077381322212,524288 --field-trial-handle=2040,i,17023505935000530019,290345165637694288,262144 --variations-seed-version --mojo-platform-channel-handle=9684 /prefetch:14
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:2852
                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                        PID:1588
                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                          PID:7160
                                                                                                                                                                                                                                                                        • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                          • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                          PID:5288
                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\Velocity.7z"
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                            PID:5340
                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:5356
                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=984793FDCA1D61B465CF62D4532186F8 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                PID:2604
                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=C2066B65C5E1AEFE397CF92DE2663AEE --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=C2066B65C5E1AEFE397CF92DE2663AEE --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1
                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                PID:4472
                                                                                                                                                                                                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                            PID:7128
                                                                                                                                                                                                                                                                          • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                            PID:6516
                                                                                                                                                                                                                                                                            • C:\Program Files\7-Zip\7z.exe
                                                                                                                                                                                                                                                                              "C:\Program Files\7-Zip\7z.exe" "C:\Users\Admin\Downloads\Velocity.7z"
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:5268
                                                                                                                                                                                                                                                                            • C:\Program Files\7-Zip\7z.exe
                                                                                                                                                                                                                                                                              "C:\Program Files\7-Zip\7z.exe" "C:\Users\Admin\Downloads\Velocity.7z"
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                PID:1212
                                                                                                                                                                                                                                                                              • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                                                                                PID:1036
                                                                                                                                                                                                                                                                                • C:\Program Files\7-Zip\7zFM.exe
                                                                                                                                                                                                                                                                                  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Velocity.7z"
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                  • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                                                                                                                                                                                                                                                  • NTFS ADS
                                                                                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                                                                                  PID:1936
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zO097A4393\Velocity.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7zO097A4393\Velocity.exe"
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:1916
                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win-x86&os=win10&apphost_version=10.0.0&gui=true
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                      • System Time Discovery
                                                                                                                                                                                                                                                                                      PID:3212
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zO09797AE4\Velocity.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7zO09797AE4\Velocity.exe"
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:6380
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zO09797AE4\Bin\Decompiler.exe
                                                                                                                                                                                                                                                                                      "Bin\Decompiler.exe"
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      PID:6888
                                                                                                                                                                                                                                                                              • C:\ProgramData\Package Cache\{DA4D6331-BCC8-4AEC-9120-498589CB7983}\windowsdesktop-runtime-10.0.8-win-x86.exe
                                                                                                                                                                                                                                                                                "C:\ProgramData\Package Cache\{DA4D6331-BCC8-4AEC-9120-498589CB7983}\windowsdesktop-runtime-10.0.8-win-x86.exe" /burn.runonce
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                PID:6792
                                                                                                                                                                                                                                                                                • C:\ProgramData\Package Cache\{DA4D6331-BCC8-4AEC-9120-498589CB7983}\windowsdesktop-runtime-10.0.8-win-x86.exe
                                                                                                                                                                                                                                                                                  "C:\ProgramData\Package Cache\{DA4D6331-BCC8-4AEC-9120-498589CB7983}\windowsdesktop-runtime-10.0.8-win-x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.8_(x86)_20260522232816.log"
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  PID:6624
                                                                                                                                                                                                                                                                                  • C:\Windows\TEMP\{07DF083C-397F-4653-8A3E-1D5DE20632DB}\.ba\wixstdba.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\TEMP\{07DF083C-397F-4653-8A3E-1D5DE20632DB}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{E0495902-E0DF-46F4-B8DB-44236F9D5123} {4B739A59-7DC2-44F5-B63C-2CF36A688D35}
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:6028
                                                                                                                                                                                                                                                                              • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                PID:6220
                                                                                                                                                                                                                                                                                • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                  C:\Windows\syswow64\MsiExec.exe -Embedding 604E824A2736A0BDF1BD015ED67269CC
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  PID:3256
                                                                                                                                                                                                                                                                                • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                  C:\Windows\syswow64\MsiExec.exe -Embedding 2F3789EB72537855044819C61A7F9E07
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  PID:3136
                                                                                                                                                                                                                                                                                • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                  C:\Windows\syswow64\MsiExec.exe -Embedding 060C57A0B80D689CECAB6AFDC1A43545
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  PID:6888
                                                                                                                                                                                                                                                                                • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                  C:\Windows\syswow64\MsiExec.exe -Embedding 7099B32E9D2F8BF39CB4344D9083E8B7
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  PID:3076

                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                    Reconnaissance

                                                                                                                                                                                                                                                                                    Resource Development

                                                                                                                                                                                                                                                                                    Initial Access

                                                                                                                                                                                                                                                                                    Phishing

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1566

                                                                                                                                                                                                                                                                                    Execution

                                                                                                                                                                                                                                                                                    Scheduled Task/Job

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1053

                                                                                                                                                                                                                                                                                    Scheduled Task

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1053.005

                                                                                                                                                                                                                                                                                    Persistence

                                                                                                                                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1547

                                                                                                                                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1547.001

                                                                                                                                                                                                                                                                                    Scheduled Task/Job

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1053

                                                                                                                                                                                                                                                                                    Scheduled Task

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1053.005

                                                                                                                                                                                                                                                                                    Privilege Escalation

                                                                                                                                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1547

                                                                                                                                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1547.001

                                                                                                                                                                                                                                                                                    Scheduled Task/Job

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1053

                                                                                                                                                                                                                                                                                    Scheduled Task

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1053.005

                                                                                                                                                                                                                                                                                    Defense Evasion

                                                                                                                                                                                                                                                                                    Modify Registry

                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                    T1112

                                                                                                                                                                                                                                                                                    Subvert Trust Controls

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1553

                                                                                                                                                                                                                                                                                    SIP and Trust Provider Hijacking

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1553.003

                                                                                                                                                                                                                                                                                    Credential Access

                                                                                                                                                                                                                                                                                    Credentials from Password Stores

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1555

                                                                                                                                                                                                                                                                                    Credentials from Web Browsers

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1555.003

                                                                                                                                                                                                                                                                                    Unsecured Credentials

                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                    T1552

                                                                                                                                                                                                                                                                                    Credentials In Files

                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                    T1552.001

                                                                                                                                                                                                                                                                                    Discovery

                                                                                                                                                                                                                                                                                    Browser Information Discovery

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1217

                                                                                                                                                                                                                                                                                    Peripheral Device Discovery

                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                    T1120

                                                                                                                                                                                                                                                                                    Query Registry

                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                    T1012

                                                                                                                                                                                                                                                                                    System Information Discovery

                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                    T1082

                                                                                                                                                                                                                                                                                    System Location Discovery

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1614

                                                                                                                                                                                                                                                                                    System Language Discovery

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1614.001

                                                                                                                                                                                                                                                                                    System Time Discovery

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1124

                                                                                                                                                                                                                                                                                    Lateral Movement

                                                                                                                                                                                                                                                                                    Collection

                                                                                                                                                                                                                                                                                    Data from Local System

                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                    T1005

                                                                                                                                                                                                                                                                                    Command and Control

                                                                                                                                                                                                                                                                                    Web Service

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1102

                                                                                                                                                                                                                                                                                    Exfiltration

                                                                                                                                                                                                                                                                                    Impact

                                                                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                                                                    e64793b.rbs
                                                                                                                                                                                                                                                                                    • Path C:\Config.Msi\e64793b.rbs
                                                                                                                                                                                                                                                                                    • Size 10KB
                                                                                                                                                                                                                                                                                    • SHA256 363eb621c9576f73ddfccd921b8a600561eafb14649d9c6a2f7e6ce69108b0fc
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    e647940.rbs
                                                                                                                                                                                                                                                                                    • Path C:\Config.Msi\e647940.rbs
                                                                                                                                                                                                                                                                                    • Size 8KB
                                                                                                                                                                                                                                                                                    • SHA256 b88fb3a4db589d982c2091bedef05fbea9cf435dec2cf2e2c088693b50b4f7c9
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    e647945.rbs
                                                                                                                                                                                                                                                                                    • Path C:\Config.Msi\e647945.rbs
                                                                                                                                                                                                                                                                                    • Size 49KB
                                                                                                                                                                                                                                                                                    • SHA256 db37b2f081587106b22d7f763fad6e45a977528506b0f484c41193f895b69975
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    e64794a.rbs
                                                                                                                                                                                                                                                                                    • Path C:\Config.Msi\e64794a.rbs
                                                                                                                                                                                                                                                                                    • Size 72KB
                                                                                                                                                                                                                                                                                    • SHA256 f92c4aaec58481eb63d4852c983488b25bf9c958a640e57d45f9512c11370a57
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    LICENSE.txt
                                                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\dotnet\LICENSE.txt
                                                                                                                                                                                                                                                                                    • Size 9KB
                                                                                                                                                                                                                                                                                    • SHA256 7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    ThirdPartyNotices.txt
                                                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\dotnet\ThirdPartyNotices.txt
                                                                                                                                                                                                                                                                                    • Size 77KB
                                                                                                                                                                                                                                                                                    • SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    dotnet.exe
                                                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\dotnet\dotnet.exe
                                                                                                                                                                                                                                                                                    • Size 141KB
                                                                                                                                                                                                                                                                                    • SHA256 48aebe5d1e710676074e4dc6cd72330015604bcc6eba8ca3138aca2afd5ed6cf
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    E42EA85B-B798-3637-0C33-E04F148BA8E7.txt
                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\E42EA85B-B798-3637-0C33-E04F148BA8E7.txt
                                                                                                                                                                                                                                                                                    • Size 64B
                                                                                                                                                                                                                                                                                    • SHA256 b9785b338e72f6946dba2afe3dce0a7c938a3bbd7f69a1eff40a78109abaf1cf
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D
                                                                                                                                                                                                                                                                                    • Size 2KB
                                                                                                                                                                                                                                                                                    • SHA256 059654849f8f817a26fa71d15ee9f20961c8a5316a8c3fa029417be1000e46f9
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
                                                                                                                                                                                                                                                                                    • Size 471B
                                                                                                                                                                                                                                                                                    • SHA256 17b90c217cb9f84ff2a984c5831961a866bead729a1fcd054f8a9d9e421bc152
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D
                                                                                                                                                                                                                                                                                    • Size 560B
                                                                                                                                                                                                                                                                                    • SHA256 92bbbacd874e98e589c0156b0099f2e7f47811610b7f6e09976ebb96ed45c823
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
                                                                                                                                                                                                                                                                                    • Size 412B
                                                                                                                                                                                                                                                                                    • SHA256 7be8543eef5ec56ba1ab294634db584687d8d3adaca7c489b61faa055e9fa6f4
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    7d7052.exe
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\7d7052\7d7052.exe
                                                                                                                                                                                                                                                                                    • Size 14KB
                                                                                                                                                                                                                                                                                    • SHA256 2123365e1f5a621cf8cee56fef8868f3210d2083c212501cdeac628851bbcf3b
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    BookmarkMergedSurfaceOrdering
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                                                                                                                                                                                    • Size 6B
                                                                                                                                                                                                                                                                                    • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    BrowsingTopicsState
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                                                                                                                                                                                                                    • Size 649B
                                                                                                                                                                                                                                                                                    • SHA256 7893888d7b59c583ca06c1e318ada9872e8011b0a75557e10fb889e37c1afb84
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    f_000008
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
                                                                                                                                                                                                                                                                                    • Size 38KB
                                                                                                                                                                                                                                                                                    • SHA256 7165713d3e1a610399471a5e93d5677508f62ef072c1151e72273bf4bd54f916
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    f_00000a
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
                                                                                                                                                                                                                                                                                    • Size 507KB
                                                                                                                                                                                                                                                                                    • SHA256 b22a5ea9ca1a528874fbad6b07566ba15fd905106df8c653e2c4ab5512275a80
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    f_00000b
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b
                                                                                                                                                                                                                                                                                    • Size 81KB
                                                                                                                                                                                                                                                                                    • SHA256 74bb87079ed46b17750701b528befa2b52175b25c1d42714f62c98799207c3d0
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    f_00000c
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
                                                                                                                                                                                                                                                                                    • Size 60KB
                                                                                                                                                                                                                                                                                    • SHA256 9e454fbf818f7b44aa9546ea7ede55f04f8e98d288cc0382cbe627e5b6c9cdb4
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    f_00000d
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d
                                                                                                                                                                                                                                                                                    • Size 72KB
                                                                                                                                                                                                                                                                                    • SHA256 3f629f74dfd693b38686debb1a1a0b263259e0c6eed716bf618c0f1e0d02131e
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    f_00000e
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e
                                                                                                                                                                                                                                                                                    • Size 32KB
                                                                                                                                                                                                                                                                                    • SHA256 449dac135b065708da7bf716edda6d7b538866dd207d010e64ff39f65ca7b7bb
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    f_00000f
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f
                                                                                                                                                                                                                                                                                    • Size 91KB
                                                                                                                                                                                                                                                                                    • SHA256 b1aaa150d6f07192e69c7b51f58c9d9b6de4fd83aa288ceb3e42b1282298db1c
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    f_00002e
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002e
                                                                                                                                                                                                                                                                                    • Size 50KB
                                                                                                                                                                                                                                                                                    • SHA256 db5c97cac7b445e8bfb2c7493f48575fae914c8b157f7497ad015a0833494b29
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    f_000047
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000047
                                                                                                                                                                                                                                                                                    • Size 158KB
                                                                                                                                                                                                                                                                                    • SHA256 60072b4eb6fc5f1f1214a34fcd55b3cbd1d05eddf778f85611f9b352c4c6452d
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    f_000056
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000056
                                                                                                                                                                                                                                                                                    • Size 24KB
                                                                                                                                                                                                                                                                                    • SHA256 a3cf4861c7d0c966f0ed6564f6aad6b28cbd3421a9ca4f60e2246848d249f196
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    f_000057
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000057
                                                                                                                                                                                                                                                                                    • Size 22KB
                                                                                                                                                                                                                                                                                    • SHA256 c3e646e385b7f7fa06a4ff8d6a1c628b92948b58fec797f37c357257ed61e7c5
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    f_000058
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000058
                                                                                                                                                                                                                                                                                    • Size 21KB
                                                                                                                                                                                                                                                                                    • SHA256 d2263711c4bed4e203c88ed278049c80d1d3b1fff690be0b3a516749cbb38c58
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    f_000059
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000059
                                                                                                                                                                                                                                                                                    • Size 24KB
                                                                                                                                                                                                                                                                                    • SHA256 f254eb93b015455a3c89aaf970631bc989fe2bd387f79e871b514992359651aa
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    f_00005a
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005a
                                                                                                                                                                                                                                                                                    • Size 41KB
                                                                                                                                                                                                                                                                                    • SHA256 75fb7769ac4a592cc3d9d83bbaceb0cac3867ecb247c385609a2b934e949c448
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    f_00005b
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005b
                                                                                                                                                                                                                                                                                    • Size 77KB
                                                                                                                                                                                                                                                                                    • SHA256 8a87d5c715a74733b10eaf2d870c33183ed8d191f3f1cdbaf2beb9233cbae6e1
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    0b6a1a40d4e1a911_0
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\0b6a1a40d4e1a911_0
                                                                                                                                                                                                                                                                                    • Size 11KB
                                                                                                                                                                                                                                                                                    • SHA256 4ca69d919e78b95b1bc798adf8c9a2a1d71526711b46e1f976ed42f9d284b8d6
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    53eb86b149b2fbbd_0
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\53eb86b149b2fbbd_0
                                                                                                                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                                                                                                                    • SHA256 c58bfab0d04215a85aa0bfebcf624f0b5daa65de932af13b346911c42bb38b02
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    fe056ca9cb157d56_0
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\fe056ca9cb157d56_0
                                                                                                                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                                                                                                                    • SHA256 3a5fe6c1f3245d56adf134dfb2fb401d1220e991530853b26e738786e1fa9d8d
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    the-real-index
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                    • Size 408B
                                                                                                                                                                                                                                                                                    • SHA256 3960b10a4c295c569f2c5803941ef1b60a5b757a5ca4139be505730e7f43200d
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    the-real-index
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                                                                                                                    • SHA256 951a39e18f9161b2c3b1f23a12eb382f28c2f78a5c379746e7d889e720f409e0
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    the-real-index
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                    • Size 768B
                                                                                                                                                                                                                                                                                    • SHA256 9ef3e874559013dc181a42668a575a7a113202647aa9ad7523dfafab577abbf8
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    the-real-index
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                    • Size 2KB
                                                                                                                                                                                                                                                                                    • SHA256 38be76331372fbb1425b8aff528def9834fb41150b38956b82bec3c84bf34a11
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    the-real-index
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                    • Size 3KB
                                                                                                                                                                                                                                                                                    • SHA256 f9a462225acdd8cdecd6b79ecb9e966cf7bbd3d2b34d4e594135a868822f5019
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    the-real-index
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                    • Size 840B
                                                                                                                                                                                                                                                                                    • SHA256 4134d01e5c5301d3e76c3e2619f7db28e661ee86a2af05ab26bb5d56be836754
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Cookies
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
                                                                                                                                                                                                                                                                                    • Size 20KB
                                                                                                                                                                                                                                                                                    • SHA256 2f46dcd0051d1aa6157ae9c83704e410ceb2c8e1b6a59e8a795d31b7bcd90de4
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Network Persistent State
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                    • Size 6KB
                                                                                                                                                                                                                                                                                    • SHA256 73734af3ae8c88b606a48e82e27221926801109f4ebaa212bce0da1fbb95c398
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Network Persistent State
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                    • Size 34KB
                                                                                                                                                                                                                                                                                    • SHA256 0b4ef2dba3d84496b72e7e0b7dec2ab1abf562d4d15913e547d3795ee4d31885
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Network Persistent State
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                    • Size 26KB
                                                                                                                                                                                                                                                                                    • SHA256 936cc2cc5c245e9d41c647e8f4516e32c7fb7b27122fbe34bdbf0f93d7013ce4
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Network Persistent State
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                    • Size 26KB
                                                                                                                                                                                                                                                                                    • SHA256 1dfa03345bfb0379df71dd32a75941057143e0776f2e159e2e488a4723a5525d
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Network Persistent State
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                    • Size 9KB
                                                                                                                                                                                                                                                                                    • SHA256 09dabfd32829e716df302c1671655ebabe89d4479c8a579a0bb40b076024c458
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Network Persistent State
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                    • Size 34KB
                                                                                                                                                                                                                                                                                    • SHA256 a18f20151256c8eb636fc1234aa1ab99b8a2973d33e0e9388204453263a9d31d
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Network Persistent State
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                    • Size 19KB
                                                                                                                                                                                                                                                                                    • SHA256 11ac0c56381d770f0fbe83e455122424cf01a49a2605ac16e92592239024c007
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    SCT Auditing Pending Reports
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                                                                                                                    • Size 2B
                                                                                                                                                                                                                                                                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    TransportSecurity
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                                                    • Size 2KB
                                                                                                                                                                                                                                                                                    • SHA256 5472aa17808f722534473dd121a9c17a7de2f5b796b7b586dc82bc8923220282
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Preferences
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                    • Size 15KB
                                                                                                                                                                                                                                                                                    • SHA256 a4c67b24bcd0e438fd9493e59b0ce65c19b41937455427c45d15b73eb3e10ecc
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Preferences
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                    • Size 14KB
                                                                                                                                                                                                                                                                                    • SHA256 3a589eb0a46eb93a70749b61e3685576e86d67dfcf1dd512df1fc44ba7d09738
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Preferences
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                    • Size 14KB
                                                                                                                                                                                                                                                                                    • SHA256 ed7325a52b922a9a844eaa69b6679705a8166cea9b14db23a02d5d3337642525
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Preferences
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                    • Size 13KB
                                                                                                                                                                                                                                                                                    • SHA256 ebc6e9a138d853e1fc784df481f38b36762ce3dbfadb5732978a697a2bbdc79f
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Preferences
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                    • Size 13KB
                                                                                                                                                                                                                                                                                    • SHA256 3f2ae0b468bd1fda53c182de8d1040afc9728c52c988b8bf4b3d529607048fa1
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Preferences
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                    • Size 12KB
                                                                                                                                                                                                                                                                                    • SHA256 c131dbb9fd862839e89c6a12ee08560385a327e029a1ce9afe14034584753438
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Preferences
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                    • Size 14KB
                                                                                                                                                                                                                                                                                    • SHA256 d181c5e61a5c2f131054be849d54f5d0e917cc93c33bee6918e914fe14937526
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Preferences
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                    • Size 15KB
                                                                                                                                                                                                                                                                                    • SHA256 49fd1f2446b0a5edb2d97c535106c7675b08539c6285c4ac94b6619e731f9bf5
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Preferences
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                    • Size 15KB
                                                                                                                                                                                                                                                                                    • SHA256 96485c8ce3a1926abfa880ed69bf951da8c768730bf6b3e9a8c13775b8e988c6
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Preferences
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                    • Size 15KB
                                                                                                                                                                                                                                                                                    • SHA256 8bdacd2d0c7eed76b428d4f58c5ddc2d461de3feffc7f39f41395cc5f8acf936
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Preferences
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                    • Size 16KB
                                                                                                                                                                                                                                                                                    • SHA256 3f73ffb0efd57fe56a095396c63ef26dcf5723a0aa7f8c3ad2d1c1fd9a9f3f30
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Preferences
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                    • Size 15KB
                                                                                                                                                                                                                                                                                    • SHA256 647b4411a0e09d0013c43da9c573801015a6ca01c4b38ae363c22478011951ed
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Preferences
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                    • Size 16KB
                                                                                                                                                                                                                                                                                    • SHA256 8af52d2ab6ecb65fdbd71ba473957185d1442345a4d0df285e2ab151f1e2ed52
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Preferences
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                    • Size 14KB
                                                                                                                                                                                                                                                                                    • SHA256 72a4bfeb993780048da58d3c1df25f1f8f5fdae0148884769ebf99b58712d3c2
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Preferences
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                    • Size 15KB
                                                                                                                                                                                                                                                                                    • SHA256 5392e8e7eb747ef8ad1e88a38ca6c6c2b6bf1280e6486c946be7fd814af65bdb
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Preferences
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                    • Size 14KB
                                                                                                                                                                                                                                                                                    • SHA256 b9a128261d250367b461c5cad40fc1a36cbeea594585cf74e015fd1c28fb1f44
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Preferences
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                    • Size 15KB
                                                                                                                                                                                                                                                                                    • SHA256 618d22cc7c424a77dc1ef09cc4ab8a4aa8d0ca863341c13ce60ac05f7e96e08e
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Secure Preferences
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                                                                    • Size 17KB
                                                                                                                                                                                                                                                                                    • SHA256 86a708718cf15f4439caa697f6058448e2b7016cb1cef9cd2e54315587d87208
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    the-real-index
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                                                                                                                                                                    • Size 120B
                                                                                                                                                                                                                                                                                    • SHA256 aaec84e92cf8f63c605fcf7ef631ffceaea8585303e2b07aa61f0b81fbb1ab38
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    the-real-index~RFe58a0b0.TMP
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a0b0.TMP
                                                                                                                                                                                                                                                                                    • Size 96B
                                                                                                                                                                                                                                                                                    • SHA256 964a83c563d13a479f4d1f9bdae3551f7780691b2ae9e64b36e1a725f6bedb9a
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    the-real-index
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
                                                                                                                                                                                                                                                                                    • Size 72B
                                                                                                                                                                                                                                                                                    • SHA256 4b3da04340d11f7d4160f9f0605c9d0c61e3f3070dbc8f81272944ff93c7895a
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    db
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\db
                                                                                                                                                                                                                                                                                    • Size 44KB
                                                                                                                                                                                                                                                                                    • SHA256 5881fadc1621bae0469139024c1be234b1b0e9210f789899cfb5f15c0e2972fc
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Web Data
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
                                                                                                                                                                                                                                                                                    • Size 138KB
                                                                                                                                                                                                                                                                                    • SHA256 697ad61e3ff76e8d10a475fd2a4eb2b62bc19524ae9227a7f93dc02f5821d58a
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    index.txt
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
                                                                                                                                                                                                                                                                                    • Size 150B
                                                                                                                                                                                                                                                                                    • SHA256 af6e38ae96f2e0e4f64c0c71592136ce0daa84be7192ba804ea4c96815678440
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    index.txt~RFe59d6ee.TMP
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe59d6ee.TMP
                                                                                                                                                                                                                                                                                    • Size 157B
                                                                                                                                                                                                                                                                                    • SHA256 f811d896a2fb7b53574f156e3573d9e0dc3cdb2055967dc66c82b749daa64a89
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Local State
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                    • Size 232KB
                                                                                                                                                                                                                                                                                    • SHA256 dbe8449a6b35f1020ac62004863514372513f8cdc9397e1cb31bdd78da544539
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Local State
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                    • Size 232KB
                                                                                                                                                                                                                                                                                    • SHA256 fa770f2207d8230515078b0a63b1693d6c56d9c5053b634f17a4f4eb3b4bb922
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Local State
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                    • Size 231KB
                                                                                                                                                                                                                                                                                    • SHA256 8762a95afaabf83f62e9565410b1628da550ebed80fd8fb1c6b40865e1f2a676
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Local State
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                    • Size 232KB
                                                                                                                                                                                                                                                                                    • SHA256 73a16ca67167310d2fe4c2a6e701ad494915122d067d7e0beb264e5975934f35
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Local State
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                    • Size 232KB
                                                                                                                                                                                                                                                                                    • SHA256 b79a463e987fa6123bcee522ccd14925b9e9e3340cf1156503cbb746f3896b57
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Local State
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                    • Size 116KB
                                                                                                                                                                                                                                                                                    • SHA256 a4d6a9953782f55b989aec3bdc058c8d8f577a390eba5ff87d8c403de3d21b7a
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Local State
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                    • Size 232KB
                                                                                                                                                                                                                                                                                    • SHA256 4d47970f3db912fa329d1cfb8b08d020a5938470adf0bb374ebab5a593c00690
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Local State
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                    • Size 232KB
                                                                                                                                                                                                                                                                                    • SHA256 f17e37055c16de02d690345fda270e84a2867e14b3c0422a61d5660214ebf19b
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Local State
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                    • Size 115KB
                                                                                                                                                                                                                                                                                    • SHA256 b6c22943588113e9b3f9c23316e1ca5a0aaa3930835272a46485f12d8be4234c
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Local State
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                    • Size 232KB
                                                                                                                                                                                                                                                                                    • SHA256 49183b5f77d3e7e17dc7ef6ede3f937b440e97d93731b111a06a71bdc5101974
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    data_1
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
                                                                                                                                                                                                                                                                                    • Size 264KB
                                                                                                                                                                                                                                                                                    • SHA256 ffe7ba499a021a0bfe096e63e9265d38625061344cba6362a59fb062be140108
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    blocklist
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                                                                                                                                                                                                                                    • Size 105KB
                                                                                                                                                                                                                                                                                    • SHA256 3b4e8a7493e47d173ac97c8bc0294a499febe7d1a689bf45257065c984c376ef
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    protocols.json
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
                                                                                                                                                                                                                                                                                    • Size 3KB
                                                                                                                                                                                                                                                                                    • SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    crl-set
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2025.9.4\crl-set
                                                                                                                                                                                                                                                                                    • Size 22KB
                                                                                                                                                                                                                                                                                    • SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    settings.dat
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                    • Size 280B
                                                                                                                                                                                                                                                                                    • SHA256 940cbc9ecbe8080b4f78231e8ea559e5f25ba4586d9b9c7484580010ea141f8b
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    settings.dat
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                    • Size 280B
                                                                                                                                                                                                                                                                                    • SHA256 3d6022b8b09d410224e6f49ce6c5693abe531fcaf66bb13ef03126afd2691fe0
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    LOG.old
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                                                                                                                                                                                                    • Size 769B
                                                                                                                                                                                                                                                                                    • SHA256 e2cbc44432366df0d8fe3e5bccec3ff2c539cf217464caec79c23d11804c521f
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    MANIFEST-000001
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
                                                                                                                                                                                                                                                                                    • Size 158B
                                                                                                                                                                                                                                                                                    • SHA256 3162af488c283bbdb6565f4200727821b4e60ce0c47948b8d5b3655271a2625a
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    f_000086
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
                                                                                                                                                                                                                                                                                    • Size 47KB
                                                                                                                                                                                                                                                                                    • SHA256 3100e775e8616cd2611beecfa23a4263d7037586789b43f035236a2e6fbd4c62
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    f_000087
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
                                                                                                                                                                                                                                                                                    • Size 34KB
                                                                                                                                                                                                                                                                                    • SHA256 5125c10807645fde11ab55f63655f00447a2ec066027c483783b7937bf12d69a
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    f_000088
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
                                                                                                                                                                                                                                                                                    • Size 34KB
                                                                                                                                                                                                                                                                                    • SHA256 ca36ea379200cb2b9850c80e55a943e4c5302fb294357343c98d014d4433757e
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    f_000089
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
                                                                                                                                                                                                                                                                                    • Size 96KB
                                                                                                                                                                                                                                                                                    • SHA256 b5cbf937d316c21e9ff19bca9141f56204c1134877848d77c519271ed0ae3e61
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    f_00008a
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
                                                                                                                                                                                                                                                                                    • Size 400KB
                                                                                                                                                                                                                                                                                    • SHA256 a4c853620a7c2d01f7c75db203efe9c2b8bd6d0e7ff55c8fd10c12faa372d407
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    f_00008b
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
                                                                                                                                                                                                                                                                                    • Size 67KB
                                                                                                                                                                                                                                                                                    • SHA256 f24dfdd6bc3511efb4058eef7e8f89dbfe260fcd8c0d3641cf5738d870365630
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    f_00008c
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
                                                                                                                                                                                                                                                                                    • Size 169KB
                                                                                                                                                                                                                                                                                    • SHA256 e3f566a2c3061b8319d36211c8c9782978225758ea756db644342aedfa7e39ad
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    f_0000aa
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000aa
                                                                                                                                                                                                                                                                                    • Size 27KB
                                                                                                                                                                                                                                                                                    • SHA256 018d55da966a03741f7854eb52ab570524de1b968c6ddcc131907166ce35b7ec
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    f_0000b9
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b9
                                                                                                                                                                                                                                                                                    • Size 26KB
                                                                                                                                                                                                                                                                                    • SHA256 dcf4f73d9160b2c557c8e94c83a520408e924172a82f1698e21a5c2fe7939806
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    f_0000d0
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d0
                                                                                                                                                                                                                                                                                    • Size 62KB
                                                                                                                                                                                                                                                                                    • SHA256 df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    f_0000d1
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d1
                                                                                                                                                                                                                                                                                    • Size 68KB
                                                                                                                                                                                                                                                                                    • SHA256 6e6d6c048ac3fcab59d85f1bfa512de1702bdc81daa76de54c7015bf42495d17
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    f_0000d2
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d2
                                                                                                                                                                                                                                                                                    • Size 19KB
                                                                                                                                                                                                                                                                                    • SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    f_0000d3
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d3
                                                                                                                                                                                                                                                                                    • Size 63KB
                                                                                                                                                                                                                                                                                    • SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    f_0000d4
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d4
                                                                                                                                                                                                                                                                                    • Size 37KB
                                                                                                                                                                                                                                                                                    • SHA256 434227651ea94f4e750e2f487b71196f20adf5e553dcc4f747deaa7d6e48807f
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    f_000115
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000115
                                                                                                                                                                                                                                                                                    • Size 20KB
                                                                                                                                                                                                                                                                                    • SHA256 57e12433622a0f043d950bc766a5bc423008d0468cab6497f3ead4e55df7c1c7
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    f_00011a
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00011a
                                                                                                                                                                                                                                                                                    • Size 364KB
                                                                                                                                                                                                                                                                                    • SHA256 8659c125bc8718eb28f8269dfb43a22a2b080ffa264928c0370e09a444ec142d
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    f_00011b
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00011b
                                                                                                                                                                                                                                                                                    • Size 39KB
                                                                                                                                                                                                                                                                                    • SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    temp-index
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                                                                                                                                                                                                                    • Size 8KB
                                                                                                                                                                                                                                                                                    • SHA256 e665e582ed61c41db3b50c2fb3e47f41de8f207b814045afd3ac179185cd3ed6
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    the-real-index
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                    • Size 3KB
                                                                                                                                                                                                                                                                                    • SHA256 f0cd82cb34f67ccaaf09aae4783428f6802a284c7031d4ac58d74350f6873cd9
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    the-real-index
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                    • Size 9KB
                                                                                                                                                                                                                                                                                    • SHA256 54b081acb294b0099de65c5fab8960d60236cb5cbafa90da0f667f836ec121ad
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    the-real-index~RFe609a02.TMP
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe609a02.TMP
                                                                                                                                                                                                                                                                                    • Size 3KB
                                                                                                                                                                                                                                                                                    • SHA256 7ecea900359370bf50cfb0054ce9f920b31901fca7353764320a1b2b4ce7190e
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    SiteList-Enterprise.json
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                                                                                                                                                                    • Size 2B
                                                                                                                                                                                                                                                                                    • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Edge Profile.ico
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                                                                                                                                                                                    • Size 70KB
                                                                                                                                                                                                                                                                                    • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    HubApps
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                                                                                                                                                                                                                                    • Size 106KB
                                                                                                                                                                                                                                                                                    • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Network Persistent State
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                    • SHA256 dfee608a930ecf039d5ce3877539d18ebc908de2888478feab0f112db9f474b8
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Network Persistent State
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                    • Size 14KB
                                                                                                                                                                                                                                                                                    • SHA256 60ce8b398f4127e89253691cc019f86a18e23dbc76965b5fb3ed04a332e41ded
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Network Persistent State
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                    • Size 111B
                                                                                                                                                                                                                                                                                    • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Sdch Dictionaries
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                                                                                                                                                                                    • Size 210B
                                                                                                                                                                                                                                                                                    • SHA256 ccfa567628d6e9f8f855ee3fb7df4b2085499660cde40e0a63c0ae09aefa115e
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Sdch Dictionaries
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                                                                                                                                                                                    • Size 209B
                                                                                                                                                                                                                                                                                    • SHA256 3cfb865e41a25b4518fa9ae70e4c9d3013c2777e7c9408358c8eece7ff68737e
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Sdch Dictionaries~RFe624149.TMP
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe624149.TMP
                                                                                                                                                                                                                                                                                    • Size 40B
                                                                                                                                                                                                                                                                                    • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Preferences
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                    • Size 13KB
                                                                                                                                                                                                                                                                                    • SHA256 09b4597d6b9c1a161db1d76a372fd6f4b7b95f3303633c3813d6bdcfc65b0e2a
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Preferences
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                    • Size 21KB
                                                                                                                                                                                                                                                                                    • SHA256 426d53359f4480b775057ec0b70276f214ec2f0ba58ed78b881c3260daab3710
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Preferences
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                    • Size 37KB
                                                                                                                                                                                                                                                                                    • SHA256 9b5153cfaf7554932ea0c359ac5f49ef515c6ebe12a97ee800f4e38bcd90cb22
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Preferences
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                    • Size 17KB
                                                                                                                                                                                                                                                                                    • SHA256 998233c52ca4afc73b095ddd0b3b28dfa083efcf2be744648daaa78b65233a23
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Preferences
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                    • Size 36KB
                                                                                                                                                                                                                                                                                    • SHA256 f976655389698bd8fcd4ead8f619a0142ae31d4ef6beef01ce777f2d14111cac
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Preferences
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                    • Size 38KB
                                                                                                                                                                                                                                                                                    • SHA256 e76a020cede2c944aa47e247919ab3f2b40b36c1c84337de47dbe95355560efe
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Secure Preferences
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                                                                    • Size 36KB
                                                                                                                                                                                                                                                                                    • SHA256 df33e9e8a72df740f4cca94cec3ee80788de399503d0d991223817884457fba2
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    the-real-index
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b38f76fc-0bdb-4056-95ec-6b53c77ee934\index-dir\the-real-index
                                                                                                                                                                                                                                                                                    • Size 3KB
                                                                                                                                                                                                                                                                                    • SHA256 011aadcdff77f6aba38073abb9203e753aafce4e9c99e3e12d3d69bc812eba56
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    the-real-index
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b38f76fc-0bdb-4056-95ec-6b53c77ee934\index-dir\the-real-index
                                                                                                                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                                                                                                                    • SHA256 c78531b19f71f356f069ecadf77034a284b0926b4de3c1b957cb73338045f09c
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    the-real-index~RFe61cf26.TMP
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b38f76fc-0bdb-4056-95ec-6b53c77ee934\index-dir\the-real-index~RFe61cf26.TMP
                                                                                                                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                                                                                                                    • SHA256 34a61c127b0c6100304ad6524185008b82f88ef85adbce5af7ecb5daad5ff7a1
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    623cd082b6202da0_0
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\db051936-6c70-47c1-b269-fb19c118fa19\623cd082b6202da0_0
                                                                                                                                                                                                                                                                                    • Size 62KB
                                                                                                                                                                                                                                                                                    • SHA256 09694d5d0d41bd8b6c6256cbdb2696756e76182b7530a5a3ce1288d744ba8771
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    the-real-index
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\db051936-6c70-47c1-b269-fb19c118fa19\index-dir\the-real-index
                                                                                                                                                                                                                                                                                    • Size 72B
                                                                                                                                                                                                                                                                                    • SHA256 a3939b531d35bead3a912002043e027faa939177ca9c88accbc0f01bfd281ebb
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    the-real-index
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\db051936-6c70-47c1-b269-fb19c118fa19\index-dir\the-real-index
                                                                                                                                                                                                                                                                                    • Size 72B
                                                                                                                                                                                                                                                                                    • SHA256 2cc7ca36688ec98e34d52eaf1f32145b47ed2ab170b0dc333264204204deb212
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    the-real-index
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\db051936-6c70-47c1-b269-fb19c118fa19\index-dir\the-real-index
                                                                                                                                                                                                                                                                                    • Size 72B
                                                                                                                                                                                                                                                                                    • SHA256 3e4054eacc486ca796afa26de3c8a8a32bedf3e0fa28651882b275983e33bcc5
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    index.txt
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                                                                                                                                                                                                    • Size 371B
                                                                                                                                                                                                                                                                                    • SHA256 7eefd811bb82c3c688f4b80c38ad0ebad706295a93575a3e2f9c49519e3d654e
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    index.txt
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                                                                                                                                                                                                    • Size 481B
                                                                                                                                                                                                                                                                                    • SHA256 3d663b60fd10bc6c0cdab60f718b31a93a0c597d4c8123ce35fd6fa4e3e85ce5
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    the-real-index
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                                                                                                                                                                    • Size 72B
                                                                                                                                                                                                                                                                                    • SHA256 ec198166ef37495af092285f30221e3cd92298b68a32b6bedd86acd19b66cb1b
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    the-real-index~RFe6221fa.TMP
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe6221fa.TMP
                                                                                                                                                                                                                                                                                    • Size 48B
                                                                                                                                                                                                                                                                                    • SHA256 20827843a59ccc0238dcd6f155a0258726a232ef11c05132d5d3fe3056569acf
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    sync_diagnostic.log
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                    • SHA256 f098e5d5801700dffb6d53b1a54f1ac7c03e6a8bb00868899816b6eefda5e8ee
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    index.txt
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
                                                                                                                                                                                                                                                                                    • Size 161B
                                                                                                                                                                                                                                                                                    • SHA256 84f96b9158ff8c9d5dc26b13bd2f4cc8c2ff1a0d9fa6cc2557bb61c2597567e5
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    index.txt~RFe6256d5.TMP
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe6256d5.TMP
                                                                                                                                                                                                                                                                                    • Size 168B
                                                                                                                                                                                                                                                                                    • SHA256 ccffb13415fc8b6ac14d1542b002cf8d6fa362afd91d783c14ae3efc2b3c408a
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    000001.dbtmp
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\000001.dbtmp
                                                                                                                                                                                                                                                                                    • Size 16B
                                                                                                                                                                                                                                                                                    • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    MANIFEST-000001
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\MANIFEST-000001
                                                                                                                                                                                                                                                                                    • Size 23B
                                                                                                                                                                                                                                                                                    • SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    OperationConfig
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                                                                                                                                                                                                                    • Size 22KB
                                                                                                                                                                                                                                                                                    • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    OperationConfig~RFe613392.TMP
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe613392.TMP
                                                                                                                                                                                                                                                                                    • Size 3KB
                                                                                                                                                                                                                                                                                    • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    office_endpoints_list.json
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
                                                                                                                                                                                                                                                                                    • Size 3KB
                                                                                                                                                                                                                                                                                    • SHA256 8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Local State
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                    • Size 30KB
                                                                                                                                                                                                                                                                                    • SHA256 69d1407cebc96330312efdca025ba9bde05adc7ba5a42262d84641b5c6212fe1
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Local State
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                    • Size 30KB
                                                                                                                                                                                                                                                                                    • SHA256 7af015ea4f24304d258f1c72363f739b698b064a32dd31922b7135a0b402853e
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Local State
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                    • Size 30KB
                                                                                                                                                                                                                                                                                    • SHA256 15143a3c18e09b844fde3b861b87c1633c36386bd9a923dcbf6c320db15e34bc
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Local State
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                    • Size 19KB
                                                                                                                                                                                                                                                                                    • SHA256 c707e8682289d1e47c11a0ca1fcaed43565c24c2e5fe7c1a04c311de52aa1ec8
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Local State
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                    • Size 30KB
                                                                                                                                                                                                                                                                                    • SHA256 112131da5336bee541b5211618a5985ba9cbf917d59130bc0fb851d62954188a
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Local State
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                    • Size 8KB
                                                                                                                                                                                                                                                                                    • SHA256 8f4aa2a14fa45b2e0617d2ba670ec1a60fbc92bafbff6cb84a3d19ea4b564207
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Local State
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                    • Size 19KB
                                                                                                                                                                                                                                                                                    • SHA256 f7279cbbcbdd92d8ab126a9a25b6bc45381acb1a1f5e53c167314446547dff8d
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Local State
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                    • Size 12KB
                                                                                                                                                                                                                                                                                    • SHA256 1e049dbdb5046ea740c5303814dcdb70497f968db1ad847ba2c5318a259b6b4b
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Local State
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                    • Size 31KB
                                                                                                                                                                                                                                                                                    • SHA256 ace552cc48253e4dbe59e8ba26a2c2cdfd1a6fab50fe42b0b4dcd81da4b428f2
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Local State
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                    • Size 31KB
                                                                                                                                                                                                                                                                                    • SHA256 2aaf84d7fe628796943adaef2fba94437c193cf8483c1416f2cc1c034696ded6
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Local State
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                    • Size 8KB
                                                                                                                                                                                                                                                                                    • SHA256 afe00a5c86dc28bef7991ee6fae71786acbfff9e430c73f86c49b4aca67e869f
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Local State
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                    • Size 30KB
                                                                                                                                                                                                                                                                                    • SHA256 95cb15f2e145d7b5d7e924e53af5b02eb3cb3ce743a1ff3a6cf75ac0296f771b
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    RevisitationBloomfilter
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                                                                                    • Size 392B
                                                                                                                                                                                                                                                                                    • SHA256 448cede7de445284c836a35c9fff0b14dff313eb1b7df4e1063de0a7f999e101
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    RevisitationBloomfilter
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                                                                                    • Size 392B
                                                                                                                                                                                                                                                                                    • SHA256 cce8b7ff396c2cc1149e93152556ab96196ab58679aa066ec9d35ef79b113d74
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    RevisitationBloomfilter
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                                                                                    • Size 392B
                                                                                                                                                                                                                                                                                    • SHA256 1aee6bb485c620b880537e59f4f672e94aee9a424bd4050dd9762af1389aa8d0
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    RevisitationBloomfilter
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                                                                                    • Size 392B
                                                                                                                                                                                                                                                                                    • SHA256 0321a6e35d2b3ff7dbb2e656726542e57d7298242fb1f016e50f4768730d56fa
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    RevisitationBloomfilter
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                                                                                    • Size 392B
                                                                                                                                                                                                                                                                                    • SHA256 5b2fdc434ad26ccc63eed061df748d47a04c52b57c30f0ceb036054ac954b7a7
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    RevisitationBloomfilter
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                                                                                    • Size 392B
                                                                                                                                                                                                                                                                                    • SHA256 948438a2fbc7464ed5d48da2c5bde6aebaa57ee41f5858e09aac69c3ea09c9ac
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    RevisitationBloomfilter
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                                                                                    • Size 392B
                                                                                                                                                                                                                                                                                    • SHA256 83f8f2101831a366f881e626ce2b0534d58cd392582946584ee8de2468d9d353
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    RevisitationBloomfilter~RFe614cb8.TMP
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe614cb8.TMP
                                                                                                                                                                                                                                                                                    • Size 392B
                                                                                                                                                                                                                                                                                    • SHA256 1425ba396f840e487f8a63d71e263e80e29bd9cb0edfdd0c594bef5967047028
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    keys.json
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.3.23.1\keys.json
                                                                                                                                                                                                                                                                                    • Size 8KB
                                                                                                                                                                                                                                                                                    • SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    nav_config.json
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
                                                                                                                                                                                                                                                                                    • Size 2KB
                                                                                                                                                                                                                                                                                    • SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    metadata.json
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                                                                    • Size 612B
                                                                                                                                                                                                                                                                                    • SHA256 ce7879978d6dc1ebc353b93e509ab0dcd980bc78615af00080f3db1cb23e79d4
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    metadata.json
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                                                                    • Size 852B
                                                                                                                                                                                                                                                                                    • SHA256 453a08edb83095062ff59beb4f28403a177007ecdc5b93c88074cf8ae24c9b39
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    metadata.json
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                                                                    • Size 132B
                                                                                                                                                                                                                                                                                    • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    metadata.json
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                                                                    • Size 372B
                                                                                                                                                                                                                                                                                    • SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    metadata.json
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                                                                    • Size 492B
                                                                                                                                                                                                                                                                                    • SHA256 30e8b5d48a130d6bf81847b89c208c7a087525e9b7d9a0a97bcf21598332b63b
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    metadata.json
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                                                                    • Size 972B
                                                                                                                                                                                                                                                                                    • SHA256 46c96e720b20237d9768e9cb90aaa62c9c7b0c8f15fddee836a76d41dfa420cd
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    metadata.json
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                                                                    • Size 732B
                                                                                                                                                                                                                                                                                    • SHA256 0c1b4dc8f72139abc5b2e25e5d0097c1d3529ae18001b1a64ff535e345378b32
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    metadata.json
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                                                                                                                    • SHA256 692457b7a9a71da2f86a2d9c00ee5e439ede0bfca8d82ca033d6f592dbfa5469
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    metadata.json
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                                                                    • Size 252B
                                                                                                                                                                                                                                                                                    • SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    7c07805e-bd10-4454-943c-fe88a58c19f0.tmp
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7c07805e-bd10-4454-943c-fe88a58c19f0.tmp
                                                                                                                                                                                                                                                                                    • Size 13B
                                                                                                                                                                                                                                                                                    • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    CurrentDatabase_400.wmdb
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
                                                                                                                                                                                                                                                                                    • Size 256KB
                                                                                                                                                                                                                                                                                    • SHA256 f99282e05598337335fc8e4cc445be34ed1ab49544f2dc593e8af66cfe1a88ef
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    CurrentDatabase_400.wmdb
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
                                                                                                                                                                                                                                                                                    • Size 1024KB
                                                                                                                                                                                                                                                                                    • SHA256 6798722e7511db558d0e4ecb4682b97f9af407595003276c82e0fd03900d08d1
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    LocalMLS_3.wmdb
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
                                                                                                                                                                                                                                                                                    • Size 68KB
                                                                                                                                                                                                                                                                                    • SHA256 2451a22003b2e348dfbfa77dfac5ffadf4cb03f87416afae85c6d5140d46c250
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    WMSDKNS.DTD
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD
                                                                                                                                                                                                                                                                                    • Size 498B
                                                                                                                                                                                                                                                                                    • SHA256 644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    WMSDKNS.XML
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
                                                                                                                                                                                                                                                                                    • Size 9KB
                                                                                                                                                                                                                                                                                    • SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    json[1].json
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\N6A0MYNN\json[1].json
                                                                                                                                                                                                                                                                                    • Size 301B
                                                                                                                                                                                                                                                                                    • SHA256 3e2ae47758f452f17b75d90414fe67a0b72e97a73ac6ec5b26b87c9493f35dfe
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    7f11bb46-9da9-4511-b607-e5ec245e79f0.tmp
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7f11bb46-9da9-4511-b607-e5ec245e79f0.tmp
                                                                                                                                                                                                                                                                                    • Size 10KB
                                                                                                                                                                                                                                                                                    • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Velocity.exe
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zO097A4393\Velocity.exe
                                                                                                                                                                                                                                                                                    • Size 30.0MB
                                                                                                                                                                                                                                                                                    • SHA256 993d58531d1f9c3d47ed2f18c4b8631a89d59fdf508fc116b127435fd4687a6e
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Velocity.exe:Zone.Identifier
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zO097A4393\Velocity.exe:Zone.Identifier
                                                                                                                                                                                                                                                                                    • Size 208B
                                                                                                                                                                                                                                                                                    • SHA256 1aee162a8b90da5a0e2a274d6b01f5de4ff4953810d82b20ff130f1b50a2361c
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    a.lua
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\a.lua
                                                                                                                                                                                                                                                                                    • Size 301KB
                                                                                                                                                                                                                                                                                    • SHA256 4e99d7b29a9a1779454d799e525c010980120995ca4a485e1123e94c1d1c0805
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    d89c1d11-0d19-4c2c-9d0f-a6e60661763e.tmp
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\d89c1d11-0d19-4c2c-9d0f-a6e60661763e.tmp
                                                                                                                                                                                                                                                                                    • Size 1B
                                                                                                                                                                                                                                                                                    • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    content_new.js
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4448_1090076678\CRX_INSTALL\content_new.js
                                                                                                                                                                                                                                                                                    • Size 10KB
                                                                                                                                                                                                                                                                                    • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    5e1495ad-7bd8-488d-846e-e2dc88658619.tmp
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4448_392446628\5e1495ad-7bd8-488d-846e-e2dc88658619.tmp
                                                                                                                                                                                                                                                                                    • Size 147KB
                                                                                                                                                                                                                                                                                    • SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    wmsetup.log
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
                                                                                                                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                                                                                                                    • SHA256 bfb9adfc04fc3e8e7cc12898e644285fc116138f79fbaf79cd5826f581c7cad6
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                                                                                                                                                                    • Size 3KB
                                                                                                                                                                                                                                                                                    • SHA256 887590763510dd88bf854dea38918bda866165f4d6e9c2cf50b4f4daca7e00c1
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                                                                                                                    • SHA256 da9dd63375db6ec2a74c39682b73858938cc3653eea90fdb72034aaaa04ddec4
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    DeltaExecutor.zip.crdownload
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\Downloads\DeltaExecutor.zip.crdownload
                                                                                                                                                                                                                                                                                    • Size 1.1MB
                                                                                                                                                                                                                                                                                    • SHA256 165ca33f5b540209a670886a144206047ea0c5ea347b2fd595f2174942c5486c
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Launcher.zip.crdownload
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\Downloads\Launcher.zip.crdownload
                                                                                                                                                                                                                                                                                    • Size 7.6MB
                                                                                                                                                                                                                                                                                    • SHA256 43f7b27a2b9e739326af8e3cbd3e2240dc5b6d7c002f7bf270cf927d06cd81f2
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    Launcher.zip:Zone.Identifier
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\Downloads\Launcher.zip:Zone.Identifier
                                                                                                                                                                                                                                                                                    • Size 152B
                                                                                                                                                                                                                                                                                    • SHA256 6d4a8619890fd5eb45ee29a72d647b9b40205fdfdf5e823d102cefe0c90409cf
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    SynInstallerV2.exe
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\Downloads\SynInstallerV2.exe
                                                                                                                                                                                                                                                                                    • Size 11.5MB
                                                                                                                                                                                                                                                                                    • SHA256 df8b9956ebe49287c81c326cce297058fd25ee4ff0cb5dd8d4881b11bbfc159e
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    SynInstallerV2.exe:Zone.Identifier
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\Downloads\SynInstallerV2.exe:Zone.Identifier
                                                                                                                                                                                                                                                                                    • Size 119B
                                                                                                                                                                                                                                                                                    • SHA256 bdb31c15939c8bf2520dde9232b7be17bd3826a3104203d53d2beaff71b5dfa8
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    YUB-X UI.rar:Zone.Identifier
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\Downloads\YUB-X UI.rar:Zone.Identifier
                                                                                                                                                                                                                                                                                    • Size 106B
                                                                                                                                                                                                                                                                                    • SHA256 edb227336c474a4f09fa9b2178d6edab03844ae299db6fdbd9f2500baf80b1d8
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    MSI81D8.tmp
                                                                                                                                                                                                                                                                                    • Path C:\Windows\Installer\MSI81D8.tmp
                                                                                                                                                                                                                                                                                    • Size 346KB
                                                                                                                                                                                                                                                                                    • SHA256 1caa470031f4f3fb53bb38187d522990a3a7423476b1b5aaa27443a3e2fc62c0
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    e647938.msi
                                                                                                                                                                                                                                                                                    • Path C:\Windows\Installer\e647938.msi
                                                                                                                                                                                                                                                                                    • Size 900KB
                                                                                                                                                                                                                                                                                    • SHA256 7977a2d7704819ff5d9a260ff69257eb0f4938b01cb929618d733d9887a73035
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    e647942.msi
                                                                                                                                                                                                                                                                                    • Path C:\Windows\Installer\e647942.msi
                                                                                                                                                                                                                                                                                    • Size 26.1MB
                                                                                                                                                                                                                                                                                    • SHA256 92320a26ae4f50aae7f30da73d43d9459fb5dc50d2a936fc7b335764d39e7bbf
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    ErrorHandler.cmd
                                                                                                                                                                                                                                                                                    • Path C:\Windows\Setup\Scripts\ErrorHandler.cmd
                                                                                                                                                                                                                                                                                    • Size 120B
                                                                                                                                                                                                                                                                                    • SHA256 17f4d573471b2923d619e2da6c993dd4c90a67222a5c894ed1955dbbce1dd39e
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    manifest.json
                                                                                                                                                                                                                                                                                    • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1169359038\manifest.json
                                                                                                                                                                                                                                                                                    • Size 113B
                                                                                                                                                                                                                                                                                    • SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    manifest.json
                                                                                                                                                                                                                                                                                    • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1372666373\manifest.json
                                                                                                                                                                                                                                                                                    • Size 43B
                                                                                                                                                                                                                                                                                    • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    LICENSE
                                                                                                                                                                                                                                                                                    • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1730846665\LICENSE
                                                                                                                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                                                                                                                    • SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    manifest.json
                                                                                                                                                                                                                                                                                    • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1730846665\manifest.json
                                                                                                                                                                                                                                                                                    • Size 79B
                                                                                                                                                                                                                                                                                    • SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    manifest.json
                                                                                                                                                                                                                                                                                    • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1755136245\manifest.json
                                                                                                                                                                                                                                                                                    • Size 135B
                                                                                                                                                                                                                                                                                    • SHA256 cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    manifest.json
                                                                                                                                                                                                                                                                                    • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1777029934\manifest.json
                                                                                                                                                                                                                                                                                    • Size 177B
                                                                                                                                                                                                                                                                                    • SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    manifest.json
                                                                                                                                                                                                                                                                                    • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_190143979\manifest.json
                                                                                                                                                                                                                                                                                    • Size 85B
                                                                                                                                                                                                                                                                                    • SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    manifest.json
                                                                                                                                                                                                                                                                                    • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_379197811\manifest.json
                                                                                                                                                                                                                                                                                    • Size 160B
                                                                                                                                                                                                                                                                                    • SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    manifest.json
                                                                                                                                                                                                                                                                                    • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_528921020\manifest.json
                                                                                                                                                                                                                                                                                    • Size 135B
                                                                                                                                                                                                                                                                                    • SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    manifest.json
                                                                                                                                                                                                                                                                                    • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_686274355\manifest.json
                                                                                                                                                                                                                                                                                    • Size 160B
                                                                                                                                                                                                                                                                                    • SHA256 2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    manifest.json
                                                                                                                                                                                                                                                                                    • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_96379334\manifest.json
                                                                                                                                                                                                                                                                                    • Size 238B
                                                                                                                                                                                                                                                                                    • SHA256 1bdda4a8fc3e2b965fbb52c9b23a9a34871bc345abfb332a87ea878f4472efbd
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    windowsdesktop-runtime-10.0.8-win-x86.exe
                                                                                                                                                                                                                                                                                    • Path C:\Windows\Temp\{07739554-D1DC-4CAD-AFFB-EEE504DEA569}\.be\windowsdesktop-runtime-10.0.8-win-x86.exe
                                                                                                                                                                                                                                                                                    • Size 966KB
                                                                                                                                                                                                                                                                                    • SHA256 8697a266af684cee7052f536de345470a8539ec9d611f045623878a8b590a4fd
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    memory/1436-4939-0x0000021C460E0000-0x0000021C460F0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/1436-4941-0x0000021C46120000-0x0000021C46132000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/1436-4942-0x0000021C460F0000-0x0000021C460FA000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/1436-4943-0x0000021C5E9C0000-0x0000021C5E9C8000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/1436-4944-0x0000021C5EBD0000-0x0000021C5EC86000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/1436-4947-0x0000021C5E9D0000-0x0000021C5E9D8000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/1436-4946-0x0000021C5ED90000-0x0000021C5EDF2000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/1436-4945-0x0000021C5ED10000-0x0000021C5ED90000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/1436-4948-0x0000021C5EBA0000-0x0000021C5EBB2000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/1436-4940-0x0000021C5E9F0000-0x0000021C5EA76000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/1436-4938-0x0000021C5E920000-0x0000021C5E95A000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/1436-4937-0x0000021C444B0000-0x0000021C444FE000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-112-0x00000000056B0000-0x00000000056C0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-149-0x00000000056B0000-0x00000000056C0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-113-0x00000000056B0000-0x00000000056C0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-111-0x00000000056B0000-0x00000000056C0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-110-0x00000000056B0000-0x00000000056C0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-119-0x00000000056B0000-0x00000000056C0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-114-0x00000000056B0000-0x00000000056C0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-117-0x0000000007D90000-0x0000000007DA0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-120-0x0000000007D90000-0x0000000007DA0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-109-0x00000000056B0000-0x00000000056C0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-139-0x00000000056B0000-0x00000000056C0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-140-0x00000000056B0000-0x00000000056C0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-98-0x00000000056B0000-0x00000000056C0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-144-0x00000000056B0000-0x00000000056C0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-143-0x00000000056B0000-0x00000000056C0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-142-0x00000000056B0000-0x00000000056C0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-141-0x00000000056B0000-0x00000000056C0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-145-0x00000000056B0000-0x00000000056C0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-147-0x0000000007D90000-0x0000000007DA0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-148-0x00000000056B0000-0x00000000056C0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-146-0x00000000056B0000-0x00000000056C0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-151-0x0000000007D90000-0x0000000007DA0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-101-0x00000000056B0000-0x00000000056C0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-115-0x00000000056B0000-0x00000000056C0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-150-0x0000000007D90000-0x0000000007DA0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-152-0x0000000005340000-0x0000000005350000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-102-0x00000000056B0000-0x00000000056C0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-100-0x00000000056B0000-0x00000000056C0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-99-0x0000000007D90000-0x0000000007DA0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-97-0x0000000007D90000-0x0000000007DA0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-96-0x0000000007D90000-0x0000000007DA0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-130-0x0000000007D90000-0x0000000007DA0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-95-0x0000000007D90000-0x0000000007DA0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-153-0x00000000056B0000-0x00000000056C0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-94-0x0000000007D90000-0x0000000007DA0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-154-0x00000000056B0000-0x00000000056C0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-116-0x00000000056B0000-0x00000000056C0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-93-0x00000000056B0000-0x00000000056C0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-118-0x00000000056B0000-0x00000000056C0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-92-0x00000000056B0000-0x00000000056C0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-87-0x0000000005340000-0x0000000005350000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-121-0x0000000007D90000-0x0000000007DA0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-122-0x0000000005340000-0x0000000005350000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-123-0x00000000056B0000-0x00000000056C0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-126-0x0000000007D90000-0x0000000007DA0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-124-0x00000000056B0000-0x00000000056C0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-125-0x0000000007D90000-0x0000000007DA0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-42-0x0000000007D90000-0x0000000007DA0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-41-0x0000000004FD0000-0x0000000004FE0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-40-0x0000000004FD0000-0x0000000004FE0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-39-0x0000000007D90000-0x0000000007DA0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-38-0x0000000007D90000-0x0000000007DA0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-127-0x0000000007D90000-0x0000000007DA0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-36-0x0000000004FD0000-0x0000000004FE0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-37-0x0000000004FD0000-0x0000000004FE0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-33-0x0000000004FD0000-0x0000000004FE0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-35-0x0000000004FD0000-0x0000000004FE0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-34-0x0000000004FD0000-0x0000000004FE0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-30-0x0000000004FD0000-0x0000000004FE0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-128-0x0000000007D90000-0x0000000007DA0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-129-0x00000000056B0000-0x00000000056C0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-133-0x00000000056B0000-0x00000000056C0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-132-0x00000000056B0000-0x00000000056C0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/4312-131-0x00000000056B0000-0x00000000056C0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download