hxxps://gamejolt[.]com/games/peopleplayground/744018

Analysis

user interaction
yes
max time kernel
364s
max time network
362s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/05/2026, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gamejolt.com/games/peopleplayground/744018
Sample260528-mtf86aex8w

Score

8^/10

discovery installer

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
229	4716	msedge.exe
229	4716	msedge.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	People Playground.exe

Executes dropped EXE 6 IoCs

pid	Process
2856	people-playground.exe
5804	people-playground.tmp
2300	people-playground (1).exe
3252	People Playground.exe
4880	UnityCrashHandler64.exe
1796	PPGModCompiler.exe

Loads dropped DLL 59 IoCs

pid	Process
3252	People Playground.exe
3252	People Playground.exe
3252	People Playground.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe
1796	PPGModCompiler.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dll\UnityPlayer_Win64_mono_x64.pdb	People Playground.exe
File opened for modification	C:\Windows\system32\WindowsPlayer_Master_mono_x64.pdb	People Playground.exe
File opened for modification	C:\Windows\system32\symbols\exe\WindowsPlayer_Master_mono_x64.pdb	People Playground.exe
File opened for modification	C:\Windows\system32\symbols\DLL\kernel32.pdb	People Playground.exe
File opened for modification	C:\Windows\system32\dll\mono-2.0-bdwgc.pdb	People Playground.exe
File opened for modification	C:\Windows\system32\symbols\dll\UnityPlayer_Win64_mono_x64.pdb	People Playground.exe
File opened for modification	C:\Windows\system32\exe\WindowsPlayer_Master_mono_x64.pdb	People Playground.exe
File opened for modification	C:\Windows\system32\kernel32.pdb	People Playground.exe
File opened for modification	C:\Windows\system32\symbols\dll\ntdll.pdb	People Playground.exe
File opened for modification	C:\Windows\system32\UnityPlayer_Win64_mono_x64.pdb	People Playground.exe
File opened for modification	C:\Windows\system32\DLL\kernel32.pdb	People Playground.exe
File opened for modification	C:\Windows\system32\mono-2.0-bdwgc.pdb	People Playground.exe
File opened for modification	C:\Windows\system32\ntdll.pdb	People Playground.exe
File opened for modification	C:\Windows\system32\dll\ntdll.pdb	People Playground.exe
File opened for modification	C:\Windows\system32\symbols\dll\mono-2.0-bdwgc.pdb	People Playground.exe

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\PEOPLE~1\PEOPLE~1.PIF	people-playground.tmp
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2744_1344000939\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2744_451219515\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2744_451219515\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2744_439375691\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2744_822997640\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2744_1388813591\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2744_439375691\automation.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2744_822997640\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2744_1597044555\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2744_1597044555\smart_switch_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2744_1388813591\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2744_1388813591\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2744_439375691\classification.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2744_439375691\extraction.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2744_439375691\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2744_1597044555\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2744_1388813591\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2744_439375691\travel-facilitated-booking-kayak.js	msedge.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\dll\UnityPlayer_Win64_mono_x64.pdb	People Playground.exe
File opened for modification	C:\Windows\symbols\exe\WindowsPlayer_Master_mono_x64.pdb	People Playground.exe
File opened for modification	C:\Windows\DLL\kernel32.pdb	People Playground.exe
File opened for modification	C:\Windows\symbols\DLL\kernel32.pdb	People Playground.exe
File opened for modification	C:\Windows\ntdll.pdb	People Playground.exe
File opened for modification	C:\Windows\symbols\dll\UnityPlayer_Win64_mono_x64.pdb	People Playground.exe
File opened for modification	C:\Windows\symbols\dll\ntdll.pdb	People Playground.exe
File opened for modification	C:\Windows\exe\WindowsPlayer_Master_mono_x64.pdb	People Playground.exe
File opened for modification	C:\Windows\kernel32.pdb	People Playground.exe
File opened for modification	C:\Windows\symbols\dll\mono-2.0-bdwgc.pdb	People Playground.exe
File opened for modification	C:\Windows\WindowsPlayer_Master_mono_x64.pdb	People Playground.exe
File opened for modification	C:\Windows\dll\ntdll.pdb	People Playground.exe
File opened for modification	C:\Windows\mono-2.0-bdwgc.pdb	People Playground.exe
File opened for modification	C:\Windows\dll\mono-2.0-bdwgc.pdb	People Playground.exe
File opened for modification	C:\Windows\PIF	people-playground.tmp
File opened for modification	C:\Windows\UnityPlayer_Win64_mono_x64.pdb	People Playground.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	people-playground.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	people-playground.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PPGModCompiler.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3016	msedge.exe
4864	msedge.exe
4716	msedge.exe
5428	chrome.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/2856-3235-0x0000000000400000-0x00000000004CF000-memory.dmp	innosetup
behavioral1/memory/2856-3295-0x0000000000400000-0x00000000004CF000-memory.dmp	innosetup
behavioral1/memory/2856-6722-0x0000000000400000-0x00000000004CF000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\HARDWARE\DESCRIPTION\System\CentralProcessor\0	People Playground.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	People Playground.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	People Playground.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	People Playground.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134244387225857370"	msedge.exe

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{3828F97E-386B-4C13-8E89-6BEF57BF0D03}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{6E801A72-BA8E-4AF5-8479-C62B0D1C2056}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{7B260EB0-35D2-430D-86FA-290D9131E800}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe
6140	chrome.exe
6140	chrome.exe
5804	people-playground.tmp
5804	people-playground.tmp
3252	People Playground.exe
3252	People Playground.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 30 IoCs

pid	Process
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
6140	chrome.exe
6140	chrome.exe
6140	chrome.exe
6140	chrome.exe
5724	msedge.exe
5724	msedge.exe

Suspicious use of AdjustPrivilegeToken 61 IoCs

description	pid	Process
Token: SeRestorePrivilege	5940	7zG.exe
Token: 35	5940	7zG.exe
Token: SeSecurityPrivilege	5940	7zG.exe
Token: SeSecurityPrivilege	5940	7zG.exe
Token: SeShutdownPrivilege	6140	chrome.exe
Token: SeCreatePagefilePrivilege	6140	chrome.exe
Token: SeShutdownPrivilege	6140	chrome.exe
Token: SeCreatePagefilePrivilege	6140	chrome.exe
Token: SeShutdownPrivilege	6140	chrome.exe
Token: SeCreatePagefilePrivilege	6140	chrome.exe
Token: SeShutdownPrivilege	6140	chrome.exe
Token: SeCreatePagefilePrivilege	6140	chrome.exe
Token: SeShutdownPrivilege	6140	chrome.exe
Token: SeCreatePagefilePrivilege	6140	chrome.exe
Token: SeShutdownPrivilege	6140	chrome.exe
Token: SeCreatePagefilePrivilege	6140	chrome.exe
Token: SeShutdownPrivilege	6140	chrome.exe
Token: SeCreatePagefilePrivilege	6140	chrome.exe
Token: SeShutdownPrivilege	6140	chrome.exe
Token: SeCreatePagefilePrivilege	6140	chrome.exe
Token: SeShutdownPrivilege	6140	chrome.exe
Token: SeCreatePagefilePrivilege	6140	chrome.exe
Token: SeShutdownPrivilege	6140	chrome.exe
Token: SeCreatePagefilePrivilege	6140	chrome.exe
Token: SeShutdownPrivilege	6140	chrome.exe
Token: SeCreatePagefilePrivilege	6140	chrome.exe
Token: SeShutdownPrivilege	6140	chrome.exe
Token: SeCreatePagefilePrivilege	6140	chrome.exe
Token: SeShutdownPrivilege	6140	chrome.exe
Token: SeCreatePagefilePrivilege	6140	chrome.exe
Token: SeShutdownPrivilege	6140	chrome.exe
Token: SeCreatePagefilePrivilege	6140	chrome.exe
Token: SeShutdownPrivilege	6140	chrome.exe
Token: SeCreatePagefilePrivilege	6140	chrome.exe
Token: SeShutdownPrivilege	6140	chrome.exe
Token: SeCreatePagefilePrivilege	6140	chrome.exe
Token: SeShutdownPrivilege	6140	chrome.exe
Token: SeCreatePagefilePrivilege	6140	chrome.exe
Token: SeShutdownPrivilege	6140	chrome.exe
Token: SeCreatePagefilePrivilege	6140	chrome.exe
Token: SeShutdownPrivilege	6140	chrome.exe
Token: SeCreatePagefilePrivilege	6140	chrome.exe
Token: SeShutdownPrivilege	6140	chrome.exe
Token: SeCreatePagefilePrivilege	6140	chrome.exe
Token: SeShutdownPrivilege	6140	chrome.exe
Token: SeCreatePagefilePrivilege	6140	chrome.exe
Token: SeShutdownPrivilege	6140	chrome.exe
Token: SeCreatePagefilePrivilege	6140	chrome.exe
Token: SeShutdownPrivilege	6140	chrome.exe
Token: SeCreatePagefilePrivilege	6140	chrome.exe
Token: SeShutdownPrivilege	6140	chrome.exe
Token: SeCreatePagefilePrivilege	6140	chrome.exe
Token: SeShutdownPrivilege	6140	chrome.exe
Token: SeCreatePagefilePrivilege	6140	chrome.exe
Token: SeShutdownPrivilege	6140	chrome.exe
Token: SeCreatePagefilePrivilege	6140	chrome.exe
Token: SeShutdownPrivilege	6140	chrome.exe
Token: SeCreatePagefilePrivilege	6140	chrome.exe
Token: SeShutdownPrivilege	6140	chrome.exe
Token: SeCreatePagefilePrivilege	6140	chrome.exe
Token: SeDebugPrivilege	1796	PPGModCompiler.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
5940	7zG.exe
2744	msedge.exe
6140	chrome.exe
6140	chrome.exe
6140	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
6140	chrome.exe
6140	chrome.exe
6140	chrome.exe
6140	chrome.exe
6140	chrome.exe
6140	chrome.exe
6140	chrome.exe
6140	chrome.exe
6140	chrome.exe
6140	chrome.exe
6140	chrome.exe
6140	chrome.exe
6140	chrome.exe
6140	chrome.exe
6140	chrome.exe
6140	chrome.exe
6140	chrome.exe
6140	chrome.exe
6140	chrome.exe
6140	chrome.exe
6140	chrome.exe
6140	chrome.exe
6140	chrome.exe
6140	chrome.exe
6140	chrome.exe
6140	chrome.exe
6140	chrome.exe
6140	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3252	People Playground.exe
5392	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 4084	2744	msedge.exe	89
PID 2744 wrote to memory of 2756	2744	msedge.exe	90
PID 2744 wrote to memory of 4716	2744	msedge.exe	91
PID 2744 wrote to memory of 2756	2744	msedge.exe	90
PID 2744 wrote to memory of 2756	2744	msedge.exe	90
PID 2744 wrote to memory of 832	2744	msedge.exe	92
PID 2744 wrote to memory of 832	2744	msedge.exe	92
PID 2744 wrote to memory of 204	2744	msedge.exe	93
PID 2744 wrote to memory of 596	2744	msedge.exe	94
PID 2744 wrote to memory of 204	2744	msedge.exe	93
PID 2744 wrote to memory of 204	2744	msedge.exe	93
PID 2744 wrote to memory of 596	2744	msedge.exe	94
PID 2744 wrote to memory of 596	2744	msedge.exe	94
PID 2744 wrote to memory of 2920	2744	msedge.exe	95
PID 2744 wrote to memory of 960	2744	msedge.exe	96
PID 2744 wrote to memory of 2920	2744	msedge.exe	95
PID 2744 wrote to memory of 2920	2744	msedge.exe	95
PID 2744 wrote to memory of 960	2744	msedge.exe	96
PID 2744 wrote to memory of 960	2744	msedge.exe	96
PID 2744 wrote to memory of 4740	2744	msedge.exe	99
PID 2744 wrote to memory of 4740	2744	msedge.exe	99
PID 2744 wrote to memory of 4068	2744	msedge.exe	100
PID 2744 wrote to memory of 4068	2744	msedge.exe	100
PID 2744 wrote to memory of 3528	2744	msedge.exe	102
PID 2744 wrote to memory of 1236	2744	msedge.exe	103
PID 2744 wrote to memory of 3528	2744	msedge.exe	102
PID 2744 wrote to memory of 1236	2744	msedge.exe	103
PID 2744 wrote to memory of 4952	2744	msedge.exe	105
PID 2744 wrote to memory of 3428	2744	msedge.exe	108
PID 2744 wrote to memory of 3428	2744	msedge.exe	108
PID 2744 wrote to memory of 4240	2744	msedge.exe	109
PID 2744 wrote to memory of 4240	2744	msedge.exe	109
PID 2744 wrote to memory of 1312	2744	msedge.exe	110
PID 2744 wrote to memory of 1312	2744	msedge.exe	110
PID 2744 wrote to memory of 1124	2744	msedge.exe	111
PID 2744 wrote to memory of 1124	2744	msedge.exe	111
PID 2744 wrote to memory of 4232	2744	msedge.exe	112
PID 2744 wrote to memory of 4232	2744	msedge.exe	112
PID 2744 wrote to memory of 5780	2744	msedge.exe	116
PID 2744 wrote to memory of 5780	2744	msedge.exe	116
PID 2744 wrote to memory of 5780	2744	msedge.exe	116
PID 2744 wrote to memory of 5788	2744	msedge.exe	117
PID 2744 wrote to memory of 5788	2744	msedge.exe	117
PID 2744 wrote to memory of 6132	2744	msedge.exe	121
PID 2744 wrote to memory of 6132	2744	msedge.exe	121
PID 2744 wrote to memory of 6132	2744	msedge.exe	121
PID 2744 wrote to memory of 5332	2744	msedge.exe	124
PID 2744 wrote to memory of 5344	2744	msedge.exe	125
PID 2744 wrote to memory of 5332	2744	msedge.exe	124
PID 2744 wrote to memory of 5344	2744	msedge.exe	125
PID 2744 wrote to memory of 5344	2744	msedge.exe	125
PID 2744 wrote to memory of 5448	2744	msedge.exe	126
PID 2744 wrote to memory of 3512	2744	msedge.exe	127
PID 2744 wrote to memory of 4060	2744	msedge.exe	128
PID 2744 wrote to memory of 5664	2744	msedge.exe	135
PID 2744 wrote to memory of 5944	2744	msedge.exe	136
PID 2744 wrote to memory of 5944	2744	msedge.exe	136
PID 2744 wrote to memory of 5944	2744	msedge.exe	136
PID 2744 wrote to memory of 6000	2744	msedge.exe	137
PID 2744 wrote to memory of 6000	2744	msedge.exe	137
PID 2744 wrote to memory of 5484	2744	msedge.exe	140
PID 2744 wrote to memory of 5484	2744	msedge.exe	140
PID 2744 wrote to memory of 5484	2744	msedge.exe	140
PID 2744 wrote to memory of 5536	2744	msedge.exe	141

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gamejolt.com/games/peopleplayground/744018
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffd88d7c188,0x7ffd88d7c194,0x7ffd88d7c1a0
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,446799299680488748,4677577650657172828,262144 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:2
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,5306950826750838609,316153630637442360,524288 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2372,i,4730515935686386955,14414790137213300925,524288 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:8
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,2211096168390938340,10580818341964607808,2097152 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,8665959197896088425,695795579691001826,2097152 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,1599874280787793078,3702940629812581206,2097152 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,9158398546853712116,3007784741118063408,2097152 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:2
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,8232436465521330034,1873786341344596353,524288 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:8
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,14726015941211004711,4080117956707535295,524288 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,9784051681648904622,1583701259378248775,524288 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,10431260843042679890,17246821733630262907,524288 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,9314639202596768100,13190090462495935011,524288 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,9314639202596768100,13190090462495935011,524288 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,1883446890144369316,5254639012418374701,524288 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,11308643323762805017,17071724448052273977,524288 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,584411489966473005,15441396349542083126,524288 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:8
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,11100457067294338326,17822295769129839888,524288 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6908,i,17354304604669660427,2193998137366975002,524288 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:8
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5104,i,10121222553219512342,14579705178364981594,2097152 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,11530802574792183945,12050759574975629573,524288 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4420,i,14663822710625194736,2627917418817351026,2097152 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:1
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4620,i,18195791423131638284,3485390744235822236,524288 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:8
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4624,i,13023808041887798220,4689814671436314905,2097152 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:1
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6892,i,11588752695940392587,6764108228232188354,524288 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:8
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,13323136455285883723,10394117104115804202,524288 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:8
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,9512173257131420556,7498995679454636527,524288 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:8
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,9455041610634568759,8106020885142382868,524288 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=5796,i,2858848823025601525,6396451896513173777,2097152 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7092,i,8275166680162940136,14564324597732027042,524288 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:8
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=3600,i,11380440294234762834,13540094717609091560,2097152 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=5796,i,7956183136749014474,1257561149992147385,2097152 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4116,i,13076886490249423407,2834120814732832203,524288 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:8
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7328,i,13600347672342724499,13137331457051333065,524288 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:8
  2⤵
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,13763247192380225111,12552257377597018207,524288 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:8
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7528,i,4750348483588193112,18430174263325241132,2097152 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=7556 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7392,i,5615394754755895883,9667618554716436500,2097152 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:1
  2⤵
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=5444,i,5395521121892492665,6598393137475478535,2097152 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=7696,i,5165644223777633089,887963902452504687,2097152 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=7724 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=7660,i,15699232988181759387,7743498725650731076,2097152 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=7740 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7904,i,2673349010213765897,157129947015397462,524288 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=7336 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8004,i,1531553963039616791,1567282021233013367,524288 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=7856 /prefetch:8
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=8088,i,4549903950382634566,4410693041165363360,2097152 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=8104 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=8152,i,9055823687870345817,5097121425947361887,2097152 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=7976 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=4204,i,11568195563640841852,17935804503021566567,2097152 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=6864,i,11921869939978831651,3732860371829596189,2097152 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=6520,i,9067656674370188290,13651597166741434459,2097152 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8188,i,1985987227687639000,14214739325283907993,524288 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5840,i,3452357559543422976,4145668200841147613,262144 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7752,i,6135547570562115608,17591791971796442448,524288 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:8
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,16991396923592824111,14703648328056146727,524288 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:8
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,15012093869190096497,4004063220124875858,524288 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=8128 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2132,i,11750140746633943805,8213339007170614228,524288 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:8
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8208,i,760357437481444795,8528159845739197083,524288 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8292,i,11326443023759586956,13846416962797931974,524288 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=8212 /prefetch:8
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=5952,i,2114882034149732336,5438014188578315929,2097152 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=8304 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=8172,i,63536217657378269,5189380409868086517,2097152 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=8420 /prefetch:1
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=7880,i,16515485973354288375,1396808049648150300,2097152 --field-trial-handle=2360,i,4426373748330953180,14857609768971372450,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:1232

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4604

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:960

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap29657:96:7zEvent4953
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5940

C:\Users\Admin\Downloads\people-playground.exe
"C:\Users\Admin\Downloads\people-playground.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2856
- C:\Users\Admin\AppData\Local\Temp\is-6IDGA.tmp\people-playground.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-6IDGA.tmp\people-playground.tmp" /SL5="$18003A,310548335,793600,C:\Users\Admin\Downloads\people-playground.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ggntw.com/finish
    3⤵
    PID:4596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://ggntw.com/finish
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      PID:5724
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ffd88d7c188,0x7ffd88d7c194,0x7ffd88d7c1a0
        5⤵
        
        PID:2676
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,3373946280590756592,5867134829885168950,524288 --field-trial-handle=2320,i,6077332652936127170,6248935524553308877,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:3016
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,3702739291028842657,7271314795005218732,262144 --field-trial-handle=2320,i,6077332652936127170,6248935524553308877,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
        5⤵
        
        PID:4568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2308,i,2879915518667672897,12736469044235857094,524288 --field-trial-handle=2320,i,6077332652936127170,6248935524553308877,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:8
        5⤵
        
        PID:1164
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,1157903016569043659,10777034491381530568,2097152 --field-trial-handle=2320,i,6077332652936127170,6248935524553308877,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
        5⤵
        
        PID:1364
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,1510135729050605528,396732738835656407,2097152 --field-trial-handle=2320,i,6077332652936127170,6248935524553308877,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
        5⤵
        
        PID:2840
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,6734832751281766522,16605725880608591110,524288 --field-trial-handle=2320,i,6077332652936127170,6248935524553308877,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:8
        5⤵
        
        PID:5444
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,17131601050226218439,9923050121907223278,524288 --field-trial-handle=2320,i,6077332652936127170,6248935524553308877,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
        5⤵
        
        PID:3160
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,11337573933143873309,13060637461823836110,524288 --field-trial-handle=2320,i,6077332652936127170,6248935524553308877,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
        5⤵
        
        PID:5500
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,14589099985310553306,16607634282300481414,524288 --field-trial-handle=2320,i,6077332652936127170,6248935524553308877,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
        5⤵
        
        PID:3816
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,14589099985310553306,16607634282300481414,524288 --field-trial-handle=2320,i,6077332652936127170,6248935524553308877,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
        5⤵
        
        PID:368
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        5⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        
        PID:1324
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffd88d7c188,0x7ffd88d7c194,0x7ffd88d7c1a0
        6⤵
        
        PID:4372
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,2526989388365848109,4665658919558733993,524288 --field-trial-handle=2252,i,3428463853470564460,857871975680548093,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:4864
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,1038333219577047621,11833444985325316860,262144 --field-trial-handle=2252,i,3428463853470564460,857871975680548093,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
        6⤵
        
        PID:4340
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,5344566284716882392,13118739333519934279,524288 --field-trial-handle=2252,i,3428463853470564460,857871975680548093,262144 --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:8
        6⤵
        
        PID:4176
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,11460156818401718516,16405100933671224390,524288 --field-trial-handle=2252,i,3428463853470564460,857871975680548093,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
        6⤵
        
        PID:1476
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,11460156818401718516,16405100933671224390,524288 --field-trial-handle=2252,i,3428463853470564460,857871975680548093,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
        6⤵
        
        PID:4584
- - C:\Games\People Playground\1.25 beta 1\win64\People Playground.exe
    "C:\Games\People Playground\1.25 beta 1\win64\People Playground.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3252
  - - C:\Games\People Playground\1.25 beta 1\win64\UnityCrashHandler64.exe
      "C:\Games\People Playground\1.25 beta 1\win64\UnityCrashHandler64.exe" --attach 3252 2453100957696
      4⤵
      Executes dropped EXE
      PID:4880
  - - C:\Games\People Playground\1.25 beta 1\win64\ppgModCompiler\PPGModCompiler.exe
      "C:\Games\People Playground\1.25 beta 1\win64\ppgModCompiler\PPGModCompiler.exe" 3252
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1796

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd950fc728,0x7ffd950fc734,0x7ffd950fc740
  2⤵
  PID:2504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,3346428278455218005,17428125085800898176,262144 --field-trial-handle=1920,i,7658606022522126407,15430648368157357183,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1412 /prefetch:2
  2⤵
  PID:4152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1772,i,939479209279001946,6728334879603336936,524288 --field-trial-handle=1920,i,7658606022522126407,15430648368157357183,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1604 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,9634523494639846151,17995085566049672167,524288 --field-trial-handle=1920,i,7658606022522126407,15430648368157357183,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2520 /prefetch:8
  2⤵
  PID:5584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,8772198591706577437,14020787571009302168,2097152 --field-trial-handle=1920,i,7658606022522126407,15430648368157357183,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3396,i,8011190245930558201,17537163619585852424,2097152 --field-trial-handle=1920,i,7658606022522126407,15430648368157357183,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4532,i,15865279639101928964,3490608787509661495,2097152 --field-trial-handle=1920,i,7658606022522126407,15430648368157357183,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4576 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5348,i,17660565261746937612,17964919981680663871,524288 --field-trial-handle=1920,i,7658606022522126407,15430648368157357183,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:4072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5544,i,16084721010712804527,10597932204772494325,2097152 --field-trial-handle=1920,i,7658606022522126407,15430648368157357183,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:5052

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:5824

C:\Users\Admin\Downloads\people-playground (1).exe
"C:\Users\Admin\Downloads\people-playground (1).exe"
1⤵
- Executes dropped EXE
PID:2300

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2972

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4908

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3d0 0x3d8
1⤵
PID:4228

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

is-0K60P.tmp

Path C:\Games\People Playground\1.25 beta 1\win32\MonoBleedingEdge\etc\mono\4.5\Browsers\is-0K60P.tmp
Size 1KB
SHA256 8a1082057ac5681dcd4e9c227ed7fb8eb42ac1618963b5de3b65739dd77e2741
MD5 0d831c1264b5b32a39fa347de368fe48
SHA1 187dff516f9448e63ea5078190b3347922c4b3eb
SHA512 4b7549eda1f8ed2c4533d056b62ca5030445393f9c6003e5ee47301ff7f44b4bd5022b74d54f571aa890b6e4593c6eded1a881500ac5ba2a720dc0ff280300af
TLSH
T1EA3171A238DCACE0ED7300B3FA1F14897F1A897F5B8A1505748BA1560B019B443BB39D
MD5 SHA1 SHA512 TLSH

Submit Download

is-1E5KA.tmp

Path C:\Games\People Playground\1.25 beta 1\win32\MonoBleedingEdge\etc\mono\4.5\is-1E5KA.tmp
Size 59KB
SHA256 751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a
MD5 f7be9f1841ff92f9d4040aed832e0c79
SHA1 b3e4b508aab3cf201c06892713b43ddb0c43b7ae
SHA512 380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5
SSDEEP 768:6CEPutHjvpMgMwP9h5Ij7khsp/6JtEZwMXVtkUI3t3CXyEyk3VbNbqDvJ4oT1y:/r6CdsCOZwMX3k5dWyklh+Dvbw
TLSH
T18C43C4A0EE5C8D36499B52D9F48140DCB9BCC43191299CF3FCDDA12AF09CC6DA278676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

People Playground.exe

Path C:\Games\People Playground\1.25 beta 1\win32\People Playground.exe
Size 626KB
SHA256 c468744d699731ee8261d798d3482db50ce6d08dc3917fcb805f0aae5f3bdf51
MD5 342a8efea83f50ec631a3f5a3ecb2e91
SHA1 c2fb72b3baaf5f28b0167c4218d4d6cb5d07beb4
SHA512 9d81c350141268462fb8e08eb24d45f3d347406dd76d76c0d78ba51125639a94c70349393b9af009dbcf922dda4430f2fa14f2ac96f0166fdb28bdc7a3e75aa6
SSDEEP 3072:oqLorb1Or6o9b38/WSu5YZnsz0FGw8Bfx96lcs:oqA0bOu5YZoNJgcs
TLSH
T123D4F6BE07878415E59BCF748E6A7DA3C0D055C92273C5EEE9327CB29C28E60550BF92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ControlScheme.json

Path C:\Games\People Playground\1.25 beta 1\win64\ControlScheme.json
Size 2KB
SHA256 c03722be9176427eb7a9e50f92ae62079622bea0cbd3c992bd6afd19ac7fa33c
MD5 9d1e884a8f66861e0f40092eb3c4e7e9
SHA1 caf91336c4a82731a3e59e2b1fa7be5b32f50b61
SHA512 6fefc6a002e3cd48f0a1bbe2d8204846997a222386d4c998c3739038b62db1bc7d29a810789eff418f0b634829bb101e2c48323ae9568fd5efdf9058dd4594a9
TLSH
T193511D10EBB08DBF327E0675E1750313E34457A7511C0E4FB5B42B8EAF778A926A49AC
MD5 SHA1 SHA512 TLSH

Submit Download

ControlScheme.json

Path C:\Games\People Playground\1.25 beta 1\win64\ControlScheme.json
Size 4KB
SHA256 774f78f8cba0fb56ff65f27d251fd353b29c70f51d987b211d8a5f03563ea588
MD5 ac187ff40bd3d71813d9e5a30c0c6638
SHA1 0be3719d74119c35dce3f984b701989d14be80c3
SHA512 b410709ff6496aa7f6e738bf267a67165564b130e5e004cef7f2961e8e0d620e4b658ae7e2affc37f6bf704d073ee4e3f824e146854793515317b33ae0de8f70
SSDEEP 96:xyLmMLtTLT6LTOFHL/zLkmlLy3LNOLw8ULjgLeTLJ6L8FL/sLMVL1sLfwLNFLHHZ:sLPLhL+LqLrLlLWLULVULkLuLkLyLELY
TLSH
T12BA12B10EBA48DBF327E0671E1750323E34457A7510C0E4FB5B4278EAF778A927A49AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-IEL5B.tmp

Path C:\Games\People Playground\1.25 beta 1\win64\MonoBleedingEdge\etc\mono\4.0\is-IEL5B.tmp
Size 18KB
SHA256 f1a6416eeedd9d040387fd85dcf7d6e074b6644c6829d08be220ff9fc32efb31
MD5 b127480ee9f0b8dab6a3f73ad79dd332
SHA1 7d776d730cbd253564713f36573dd8366782788c
SHA512 00ddca43ad38127cf71477810c46617fc2ccdc33f197e26ba761151107eff701fec2caa51e43575fb5b4fbc11f640f525ba70b6b3e97811cecabc63773492401
SSDEEP 384:lJJuAr8F1mJ1ayCk5+HK5YaW41DBWTwahst/tlLvSqwwU4FVXaS7L3nHIXYFXc//:jbpJX91Xbi
TLSH
T1E1820030472EDEDE8E522B9355208A9272AB575B23449C8CF1FF2365EB46487D3321E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-TS396.tmp

Path C:\Games\People Playground\1.25 beta 1\win64\MonoBleedingEdge\etc\mono\4.0\is-TS396.tmp
Size 2KB
SHA256 ce1db1ad8a9512073164e3eccdc193f7eda036e1a9733caec4635de21b2865c8
MD5 ba17ade8a8e3ee221377534c8136f617
SHA1 8e17e2aec423a8e6fb43e8cbe6215040217bb8a3
SHA512 c18bcbcbd4b9a20a72b1a934d70db1eafef047f34f3ba2c6357d8e3afed07ecaab861e5571ceb58c22d4d3e5ebb34b51e366a0553c3153fbc263d1d80472e297
TLSH
T1DF511238F748B5F50682092EA45A84D243B6063FB679499C71ECD13D6F2684B93B32DD
MD5 SHA1 SHA512 TLSH

Submit Download

is-OE3FQ.tmp

Path C:\Games\People Playground\1.25 beta 1\win64\People Playground_Data\Managed\is-OE3FQ.tmp
Size 4KB
SHA256 cfe102fa094b665f8a5f0ce3a2865b36d04a4151ad377e6202ec952c0d117007
MD5 32ef31ce8f95223db2acf5f1290a362d
SHA1 2749429f417eed7111c824bf7df0d48049a68bdd
SHA512 f6f77a3298403cdf779144e5d4d29829cac3957392e7480ef2410e994f90aa96aeb21ebf1b0e0fbca804796abf22897f926f7fc2faa59a4b502201586cdcd070
SSDEEP 48:6w+lLNBtXSe2Z8aVBjbiDvIsRflH7LUpNRFkGIJlYhdFSrZjQlgX65QL:2TtCe2ZRvODv7RfJUKl02cuXq
TLSH
T1BF91941297B8877BED760B3AEEB307421376F5658E53877E0A4593069C4566C0F32B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2744_1344000939\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2744_1388813591\manifest.json
Size 85B
SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
MD5 8ce95626b39ebc2401eee0b34c24fc7c
SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
TLSH
T106A0121018015DE318880320213143D2D3A51C05247437001106108019B8636027A22E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2744_1597044555\manifest.json
Size 160B
SHA256 2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
MD5 a24a1941bbb8d90784f5ef76712002f5
SHA1 5c2b6323c7ed8913b5d0d65a4d21062c96df24eb
SHA512 fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2
TLSH
T133C04C23ED18BABA12F587D40971DB43F7F0031B34E169463B39948C5F761B8925175A
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2744_439375691\manifest.json
Size 135B
SHA256 cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5
MD5 4055ba4ebd5546fb6306d6a3151a236a
SHA1 609a989f14f8ee9ed9bffbd6ddba3214fd0d0109
SHA512 58d39f7ae0dafd067c6dba34c686506c1718112ad5af8a255eb9a7d6ec0edca318b557565f5914c5140eb9d1b6e2ffbb08c9d596f43e7a79fdb4ef95457bf29a
TLSH
T1CEC09223CC019CB119743B642AB2AB82F7B41B0B6869705A3AB3148C1F7E1B48082680
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2744_451219515\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2744_822997640\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\LocalLow\Studio Minus\People Playground\Unity\local.6bce8b3bf82e8d747b49c7986b5f6dba\Analytics\ArchivedEvents\177996547600002.1bcd9e52\c
Size 1B
SHA256 d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35
MD5 c81e728d9d4c2f636f067f89cc14862c
SHA1 da4b9237bacccdf19c0760cab7aec4a8359010b0
SHA512 40b244112641dd78dd4f93b6c9190dd46e0099194d5a44257b7efad6ef9ff4683da1eda0244448cb343aa688f5d3efd7314dafe580ac0bcbf115aeca9e8dc114
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\LocalLow\Studio Minus\People Playground\Unity\local.6bce8b3bf82e8d747b49c7986b5f6dba\Analytics\ArchivedEvents\177996547600002.1bcd9e52\s
Size 441B
SHA256 1f07ef9530ce9423c7a547a0f7a96c66060f0c48cacff1f015718fde8e0f615e
MD5 ec338a8c07f51c5a14ed6d6f94737ca1
SHA1 3709105f5d052a6bcb5f4e2ec18a71ae024d285f
SHA512 a6bec7c5d83f7f2220ce8d6ae094b0abb1d5b89f8c397cb20c1395bbf8ade6e350cc35ecea8cecf9dfbb0464f57d78ec8d95481aa39d7c2b683c840e835df38f
TLSH
T11FF05C234FE69D35877265B56A151C21287020D07020F62ED5B081EC0BD814D1346136
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 d3fa4b359ad19993c36ff68898eef3243786c331b0ae676b992d981e0310bbe5
MD5 4c6ab172a0e1ef1567019e489e2a25af
SHA1 34df3df6702ec9e8e3a9337258b6d613ca3d24d8
SHA512 c863a9d6e3bcdbd0aa50df9fef2a7e84304ad1234a7ab9a7d63d5a18f68fcb3c8fd1ce4b888b6c576aedfebd40e86ec19fad2e78998046ea267cb6aa2cd4ab52
TLSH
T11AF0F9B6D921AC3B18FC472C30944B4AE75013572B80999F3A3C820DCFB5A3B465981C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 624B
SHA256 b7a036a6b5336d8ac86ff6a628478df925b257c740b3aa651aa440c950419286
MD5 9c2102ae010cd7b8426dfec7eb9a372b
SHA1 f8a05991fbc81fee515bca06c65c98e8e78074d0
SHA512 fdc7ee43bad0bb495181266910ed0a9dae6a87eb91b78a4308e56766a28c17880a4a042e784c8a4ad63d9d913f57f61d413501b0fd5c7345f5d042d6cf62fbfe
TLSH
T150F0E23C53598129F7FA06F054DD0B506C367A3590530D9FC3835841AD2FA75E35135D
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 26a013e54e9defb5341518fc1a23cf5e5960a37e882501d696ddf229870ed5fc
MD5 88b1e287391e9550d8d5265df62b5c30
SHA1 62d41ae14e3638e95264e3eec97229267c6cd9cb
SHA512 2ee7158acb9cf010efccdbf32cc99a8d530367606a3c8be19caf9e76747c628b3b19d778860796bdb7d394e87fc3241c30d8507f148b140d6ad48541d6df3d27
SSDEEP 48:YALlhm9qSqwq7hSV0hHWhEZhdhEhLCsmRs4XLsCffoKswfs5osHKsKX+sotsFfJN:DMnTaXYuzCSvjfjY3UXmYf7uEiPdz7E
TLSH
T1F2D17BF7C3D8C62D881156F4AB156F2FCE290A58432D3C26C8D8AF4B93E2872D25575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 438125496b4f0e06323a0074330d2cbe02228970fdacea4f686bacc922f3f3ec
MD5 0330a59f88057a8679f36adf70a6f011
SHA1 29307ab428c4c6e857e996a69e23713ce9f49cc3
SHA512 9caf504ff88b584ea43c95f2a29052d9cd2f7511ba0bdc2534543c5bf091b7968bca7d250ff04d7dff0c02b6f6e06629070023ee495448780ba9584b01c7daaa
TLSH
T1BDF059BBA7BEB473117E49EB0D00BD0954FEA834198168E4CEEA816CE0815B31B16843
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 67e2b3bbf5c80d5ad003865b754058c3f363f432dd6d76e8c08ad10f9fc7bc23
MD5 99d3fc81475e9f49361c7fa14b2998e5
SHA1 2dbe7e460f29400b82050228ebbbd9af2ed409d9
SHA512 e3e9e966eb849fdf5ed918f50e2191d4602539e7ebf01e4997fccce721a67137064404ccd2eb893543ca0f783febfd8025c99b35416eee78eef4270463315827
SSDEEP 192:ARYcBzBxmzv78pAPRp2ZcK9DHsb+WNndi4IH25WM8kw7YVyIsnAUgtaJ:ARYmzBAL4UXg5w0j2eY8
TLSH
T1D442E72FB910693B5CDBC21AFD267757E7F6102265912E84EAFC8A2C14DB9CC3227117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d704ce8c63c3e8ad309f10116efb7a7ddf7bb661d3936e673494b24658da6b3d
MD5 f9ef076b30a07e118c346b089a4280c1
SHA1 f246b2e7720776d64c6613dbda3e70e2ea1e4e7f
SHA512 421913ff2c219165e137d1897ae4b9c098244c168a11bcdda5542904709f0c9a2514da66d68ff402809ea24750428ec6ee40e28c8b391f5259c57c0520633813
SSDEEP 192:ARYcBzBxmwv78pAPRp2ZcK9DHsb+WN3qdi4AfeGWM8kw7uPyIsnAUgtaJ:ARYmzBAs4UXg5w13e/U8
TLSH
T17F42D72FB920693B5CDBD229FD267757D7F6102265912E84EAFC8A1C14EB9CC3227107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
MD5 be6f9d6a2cbcb56c02708e735863c266
SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
TLSH
T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 e0ebc16f3f8142c39640d7d596e7c4d2a3355ae07f487350acb278140ca4973a
MD5 c85a7ccaef1773d809d498df3217f5d3
SHA1 ec4c14f12f72013341d6a1a17bb15bc78ba0cac8
SHA512 38d3426e58aec8d027d43e89c5df4b0c70a1f61217fb5f59f2f2ab50c17c35a943147659b9034de05900c3ea418930b769d18fe843155708d7c4f5d8865230bb
TLSH
T1CBA0025033C03D65DC0002F315D185C16216A920020AD60B79D484C88C6A24343F6189
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 449ac34070d3c2d085675ffeea1dd5f609fc8ed20889944d318993709183695d
MD5 8c67a5c50a5a07b6d301aac7ac4fd9a3
SHA1 c7e49dec0afd5494f08dc9f0cfd0be928698a8cd
SHA512 668ec34640af4dbc57612f654bf677adc2200c6f0b5485ca5c1625d25aa645e62034cf7c2130557dc640b23e3902630d36d4ef11abc62ac6be4fd85035c156d1
SSDEEP 6144:5tJhwBOBa9oIDg9Qm7Rkm1tYpBeh2BAou:5tIOBa/Et9oBGcAou
TLSH
T1233412258D727D7E8EADB71EA05E0B1E2EA09D51AF21D7D6C8C09B04639A7C80C5CE70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 8797e5eac71ff9f7f400ce239103f5f44a939dbdea14db3e7ae80eb9115131b2
MD5 5ba0188c2a97405e33d3736134a49b53
SHA1 c7bb609f8920de4a2627b791a950e6db82021fca
SHA512 f3c10f1fd87b131955aee87603ca2edcaeb82d7014615292c2a09dc771ca5849254306346eff1568cad73f582c0a7f51b50c48a6e184c9279900cb9fd332079e
SSDEEP 3072:/Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:um7Rkm1tYpBeh2BAoO
TLSH
T129C3123B5D65E9375979A71EB48E0B1E1EF24DA6C930DE42C8D86B0437FA7CC1A04A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 07e0259f84dfb0ea789f57d962410f9f0336aadc663c929d1d21fa3c2cad3fd2
MD5 c88ac2c0d80cab139887f00c7416f63e
SHA1 bd23e2b9a4a094df58a8d81a562f2cdc9c724ba5
SHA512 0158c884bbc41033a07b784e01a748aaf985bf6d156afe81a177a6504441373282d9f1d5814281602a95e90499d4021d839e9bacad4cb58eebbc6891d1afe61e
SSDEEP 6144:JtJhwBOBa9oIDg9Qm7Rkm1tYpBeh2BAou:JtIOBa/Et9oBGcAou
TLSH
T1E33412258D727D7E8EADB71EA05E0B1E2EA09D52AF21D7D6C5C09B04639A7C80C5CE70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9290f31943fea28c016e6ceaec332806f773a65990bba3d3ea4bd73961aad160
MD5 80a4128b7a2e569f38a74361ff44b2b1
SHA1 f070e5ca906b7a803e400cd6323666ff3f2d7695
SHA512 31f6f15bdd9ed0209aa73a9d7d612c5bcc86e5876cbd0d9d963a4d20eaf191b09425270cc4d6c0adb4e6b48940b5df5c5f20faa1bd2084b6755ca13ddd79e156
TLSH
T11DD02265BA379AEAF2B8243F28A2E507134CDAB257032223E3448C0C8CBB64748C08C0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9cb8bf239f61b6049ad57030f971b893e704f03b468284ac36da9c4d4b4b22eb
MD5 f18c2bebbfdca75040f08b9845c0c540
SHA1 93498851fc161c75068534ecf5059b14381d401c
SHA512 96327577ba0545bcb315be08336716f2016795962dc1b86b0a63157bf8cac5baa10712706ec5ea1d9ca3753e3e4db6e16f32ff9017fead09340cfa9d6a78c796
TLSH
T114D022ADB22289DAE3D4683F284BF60F274DDDB0A6922672D3854C484EA7A0684C44C0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11f8f5509e0ea5de91167e8c2771f316388e5d28710186a6b992a413e6ad52ea
MD5 dc6e4547d38feeb78ed2ca0274a7f56b
SHA1 abaf0aeeca64fdf09056e35526a2d1af88591b16
SHA512 100833f7ba93813f0b6e9b4e1d13d25b7a55bf8d4a1d658c2bb9235a14b750e78a2a833fe002e89f85cc693ba3302b132c15dcc9347fef0a83964e0acfa7a3a2
TLSH
T1FED022ADB62289DAE3D4683F2C5AF60F374DDDF4A6922672D3894C484EA7A0684C44C0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 059dbf762c6822a72e146e7a87ca6eaa9a1bd12a0b9b0bc7116b63d543d6b73b
MD5 ce8c32f3ba43fa62fa09300f81fceb4d
SHA1 4c725099e4e1e860bff494e33cde77bc8b967566
SHA512 b4584aa51188aaa4466171d7648db0b59b7412dcb057e8f423ea60760b681a45f909f7eda714dde77fc465a0fac8a529d98eed4386950ff3244683c20e60dab7
TLSH
T1F0E02BB9C921DC670CFD072938005A4AE760131B2B40894F3B3CA3088FF163A455BC9C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 62KB
SHA256 df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3
MD5 c813a1b87f1651d642cdcad5fca7a7d8
SHA1 0e6628997674a7dfbeb321b59a6e829d0c2f4478
SHA512 af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b
SSDEEP 1536:Q9pfnSa+E9Az52gNbkYtUtqvUhZRHuLdrx07LXz:uhnSpE9A1EY6tBPix07Lj
TLSH
T1695301D4670EE2A579F2CF23BF59C5C00803162D8E11AA68FFA063878D8430BA793D1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 68KB
SHA256 6e6d6c048ac3fcab59d85f1bfa512de1702bdc81daa76de54c7015bf42495d17
MD5 3499c423bddb45798c3f42fc61887582
SHA1 b55818fcce5d96cdc100af791c34eab84bfc20fb
SHA512 398743927ee55db3b51f28f5495fd4bae00461b581be9df41e66141780907186b8abb4fa41a75cbf8af1e7fd0c8cda00c9947758743bbbd29bacd92d2ff00a43
SSDEEP 1536:3aeJNwpYVSnTcmFS4JFXLgXI8lo8PojNVKpn5eQfEM0ATxOMA2pG:3ay2YVkN44JFXLgY8lo8MrKpn5eQ25+G
TLSH
T11B6302609175D50BF9C81B89AE7AB6DFF1212B07F861CFD4421815D0622B7FA42F8C67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 19KB
SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863
SSDEEP 384:/Und3PKicut4yiFkC9RWzlJpa2/CKYOyDJmCZyXJTW4PO821GyLjSoBwNeS:0UizQDYlJpaQCKYOyDJpI5Kx821DS3Nz
TLSH
T13692E1670BCE314E422EE25FA316A51733E41BE1EFE49640D6AA70D81C38DA243179D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 28KB
SHA256 f4a02d08ade170f64fd7e6c000c9843d7c0f3503a5608cb9f2a353f094fe4bb7
MD5 110bf42cc09ba466b2210e4e118c81ac
SHA1 85c55d77c2dfdcc1770f846edf765e9d577c949a
SHA512 1baa085f01ee5a7ba487fbbf9b04e6577707d020ab7c889248e7d2e0fff1b8a212f65c6c89ab756d4e23deab6d470a2ab0d723383d9ae299a49bd7d47665bf4e
SSDEEP 768:KQWOAOuzXcKtuMefSlyp2YcwCucqEJj5afE7en+vIk:KQSOuzXKMePpGjqgjYfE8+vIk
TLSH
T176D2E075BFFD042F812C5F49492CE728F575F0AEEB496F59E761AE910D0C00229B52D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000099

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000099
Size 374KB
SHA256 aa5482a1cb0e0e9fc7a09d90ce82d48765958ef2de12bb567c9a9dda0e70fe08
MD5 573e467d73dbee9c030ab6dd911a4ba9
SHA1 a7b2b2064ed4736ef28f3cb83c8d465343516927
SHA512 bc46278aae28a4c5952e9db988efae23e53d6e1eb3edf8bb92535ac93aabbe5cd97ed43b301722c61a0d692fa1f99d356822ade6f0b769d47be741ecff5516fe
SSDEEP 6144:2FMjqfaRkLaFLdTF5AHl+qC6naJJwUISq/1uwj+mN+MBtpc3WhHfVl:JjjCOFLdTF5I+qbaLV+yA+AtqWZb
TLSH
T1C98423A376B1F0AFDEC8697F03C63363A598B531B7D019C61D48B2A6122735C9FB4264
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009b
Size 51KB
SHA256 e1e0cfcd85e0dac0ea8c0d706436b629a941e1d1bc596242b0aeb887ace3e2f3
MD5 1411091a13e26b185f9ce741f231cf1f
SHA1 c2166172fbf53020eb46f9835ac9beb91157f7b4
SHA512 ec011d07b557e26e03ffafa5aa15e6a1daa1f0ae4b0f32cd829143614ad4723098e6c816a79961bec12e99442c970b30a86c40f716cce6bfeceaef093a057e4d
SSDEEP 1536:fRgqfUiNRl7kC1/U6lLyo9JqsCOl4ajMOb8:fRgskSPlLywxMA8
TLSH
T15C3302BD8823E0BDC391343FFDE44A1CDB6819BB19F56089622A7895E33685C8C550AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 21KB
SHA256 6bd261daf33ad7fdac77d5fc2e0eeca57a3a73f07085b75d91da12ac3b8480bb
MD5 36c4fde8cb0dd3c5697c0fe1ccfb731a
SHA1 ffd98b5e02e7be13537d2f7ac7f30dd3bfba608f
SHA512 791622e8629f2b06edd2809a820a1581d8caa3bf6e34c1b7ba26db070532aa2014e6c9cd080fe7dbfdce28e4faf9e13b06244fa577dd65c2d42dfb20f0c9322b
SSDEEP 384:+/SAhJbp1hCJnsH+kBlIcDosaBjckXPOUVdNI:+/7JbpknsekBlI6GjlXPOUVs
TLSH
T196A2EC692351AC62DB7801B345F64A8DB93A55FAF5175D06230A0FFC23B338DF620E19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 94ae67b3c2b0d63fc4a2080390240d176eb2a480a4cccbca322f04b178ad2082
MD5 309cfe1462fe285737d35e638a1eb91b
SHA1 87436817df45db5115e1e69baca8fefef189d34e
SHA512 7d9ea08216163b8f25d2cb15b1217f1004de14382bfb78e69896c5d2697049fbfce1e659d986c9b9e05697d3108fa09e2ed1539c529c329443cd5d0f0d008c5b
SSDEEP 192:zlTtJBWpQZVq0FyDiOe016Hie9TLvqMxb:RPVU0sDQe6C2LiMxb
TLSH
T184E18F3687018C63EF1A003289D386D278BF84F9F8139E5A43195EF8327774DD129E25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 21KB
SHA256 2681e483bb4f5d0ef004ffec95d2ad25663138a84cbf72eb34e36dd8abd3cb1e
MD5 e5e13fc10c0972aa0e7a29a208bed225
SHA1 25ca29f464d12a4244866defa60238d60f9d54e0
SHA512 54a3885ba7820942d49e65f455c8247ce10d1046d76977fea91ce5e54e488efdfd4779277cb28f67841a09cc3e2c71107d29f0ddd29606c40082292d7a66d969
SSDEEP 384:OWfi+eMKYERFSvNMdLjnGP3R1ecXYhevDoRt:OWDexYGFSvNGn03R1ecHvMRt
TLSH
T115A2DC6A2351AC62DB78017345F64A8DB93A55FAF6175D06231A0FFC23B338DF620E19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 12KB
SHA256 a803e640c15d8878471d508501fa8935753688af7a039daa9e32d020e4d22af3
MD5 4bb3e4491a49cf0c616a3a7a4c5e4216
SHA1 4cdfbe1c4a057ea20850acd8c4ac40ae85914e24
SHA512 92fc2b0da3507ebe2545ead72279c7bf9c9b39792790f7308036d24543703957e37d0cc923137075b9c096fe78d673df917f9f5036a0ed9dba9854f863f3fbfa
SSDEEP 192:Q0VoJx9dHD22IERXWyjlNMMa1dgOeVUvh4rFrvzDcBnYbRfQgnO52Y:Q0SZpIERGQNMMadOuvuFDAYbugO5/
TLSH
T15B42B46A5750ADA3EF98023285EA49C2393F80F9F41B5E1A530E1DF8716335CF321E69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.virustotal.com_0.indexeddb.leveldb\000003.log
Size 21KB
SHA256 9cf9d0399791e91be022b383482539b8bff567a1a795669cfd6df8e5b1358bb2
MD5 5a824f0d13678738f4efeae80dad2488
SHA1 2094a8618a11822787a32d1e15b40949422a7cd6
SHA512 375ea8b06a3c32e6b7ca59ee2520efcda23ddb49883810c2ee8f23a13692c911ac2d275367b1abaa9ad3ccf4137b362888dfdb5218b1e255d8d0621853df5de9
SSDEEP 384:kBuCT6YKAoOCOuUsTR1ZzRmRSRSRIRSRzRbReRbQfgQmmYyYewkvKzWj6qx/u/i2:euC2YY1ZFcww6wFdkcfzqWmyzWAc
TLSH
T174A2023AA5A1A722E1B78D7DD8B112C3BC733AA67C40E96C5160724E0C76F139CF065B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.virustotal.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.virustotal.com_0.indexeddb.leveldb\LOG
Size 359B
SHA256 803ac05fb0ef29a8a8422f65d9eba90cf1966829916fe316b0dab46eefef05f5
MD5 55c791222769a130710153e7c90a2842
SHA1 64ccb3ca192269a5873e5e04c8da75ed64d74282
SHA512 b300c3c0fd8e78738dbaf1fe18214300975f6294e95fb948ec714b9ecb4f38003d3e732677a8dca972d7725453e3305d869f994ad681df19112b41b4c69efce6
TLSH
T1D7E02228C0CED26F221410D21178FB2DC2AB211ED78C6E418E40C81470C604C983E172
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.virustotal.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 803086ae82079810316848a53c1ae44e50cbaf3733c0ebb854addf683b58b20f
MD5 0a5c9a1b6db54d7971843ca701564ea9
SHA1 21ac977df8e5540c43bb0755a3703a22e1c23806
SHA512 1b6bb75776523055f9f798486757a1b4c6e42cf8abc33ec834222e3b339871434c4e7e920365ed98796a0edbfec37687598b5e4f248279a72c3dd453ed4c50ff
SSDEEP 192:DSqwJBSaAgseKOrJ2QZJWhcIRnr9avj6DM1OXR5pfHzm2KQuAQOOL/x5MMAfEdYh:DSqwJIaAgseKOd2QHWhcIRnJavGDM1OF
TLSH
T17C227DF3C3E8AB2D8C31AAF167152E1ECE1D0D15A7183D1A88E59F4B93E2471E14199E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 17KB
SHA256 c031e69d0675e028e9974b9531f11183026591e613c8f7723ded22fceca3a780
MD5 11e9a18f25aaab85c8e8b86a5deb0f40
SHA1 eca686a5b635fad48917a82afafac0f8058f948c
SHA512 403ee68144134323b8d8dd0be7fba82a4b589a7b50ef63772add961dc6b82441066218438c98ba86c13b7f9694c1a58fc5a86440570cad048bade13b27d4670e
SSDEEP 384:DSqwJIaAgseKOd2QHWhK9tUu0TI92FF6QOJIRnJavGDBOXRffHzmVQuAQ5L/x5M9:1jQb/n
TLSH
T1E4828EF3C3E8972DCC21A6F1AB197E1BCE1D0D1553683D1A89E49F4AA3E2471E141A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 25KB
SHA256 2cb2d4d5aa41456f1c6f76f11db30915e77d9e637b6c9c88ebd3f058a6c2e0e6
MD5 cbffc7488170b17f84bb9e6993fef3ac
SHA1 d5a97fc9c613a80598b0990a89f3fe95b6d4f928
SHA512 cd61ade2572095e3302c2507035e8831230545743f0fb477d8f77da971031b54f4deb64224372bdceaadd19e273da18e7d0f37458273a15b4acbc60954cc8cbe
SSDEEP 384:DWGzH+UQgteH1eDdR0yK9tUu0TI92FF6QOb4Ira1wXBaXRlHzYVQDAa57/x53OA+:YQMPf10C
TLSH
T177C2BBF3C3F8862DCD11A5F4AB192E1BCE1D0915536C3D5B85E49F4BA7E2871E240A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 89e2d77f6523c7e47e45a7e2ef3a6fc7cc27f7cdf59fa7bc162e21c8dc1640cf
MD5 c7b3e8afe7e27e363fdf80b6d2a541d5
SHA1 ccece3d29fe846bdef229e0d94993804b4cf3569
SHA512 70e1331f60d40aec9161773f4d41bab45a81bb1e17d55c38371bb4afec81fdd0acf4123d1808a9cc2d000846a2bb50815175cb1413fd1efe67ed4069aa28aebd
TLSH
T1CDD022732B2431B9B56CAED1A06BECCEC72A022E0CC2E9E430F058991532C6D491F642
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 d249171117782f228d707bf496e856d6bd1a7354c5c1ffc7dbf94f87a06b94bd
MD5 a1a2f59728c083a3191dd25cff3f2744
SHA1 39102fe00f5a603f7fc5d71f28514990ee250821
SHA512 a7ebb31afc4ae78331661dbc67a35f76c0a97e03d9e7906b245489f4de24bd808fc4b830b92895b9e6f4ca92b36451d4cfc8adaea01a7e54019f38af1c765174
TLSH
T18CD02223171431B6B5ACAEC2A0ABECCFC32B02291C82E9D430F498981932C6C8D0F582
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe59b29d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe59b29d.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 8KB
SHA256 d8a61f7d36641dfbc8638aa1e62d7f3f8c481581666244cb3c142e754d65d77d
MD5 343ea078ba89621431855311368d254c
SHA1 195e5b6f8924772a428ad5427f5dfaa3b2def9fc
SHA512 4a89a2d1c68ab83e233f260a62bc753557caf2b015ee984fdd7e16885cf69999e3adabea6b8b71bf2d23172d2a7f47901f3f33568bae8e7bccc0f554db966e03
SSDEEP 192:NUiUNxUgUsUmUIU0UTUmUcTUkUoUbUH8UPUNUbWURU3U6UpqUYU/USU8UkUxUmU+:NF6xtfJ9v0p1T7J8A8Y+l+eR8q7I9rx+
TLSH
T1C402DE5392BE766B307C09FF2D15BC091979A8392191B4F5EF7780AC70826F6572A833
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3b6a2e42a16f2f05bae863cec9e15738760bcad7f08f8b3583caf78f43d1a8a7
MD5 43aad343ed5db60d7e15fdb8d646e8c9
SHA1 f3de2cfe43e60c36020f72b51f7d0e12650b7655
SHA512 1a9e387eb537eb91fb14ff2ec3a1684eb8dd065440da86b73318fee984afcfa0676b94b36180fe448346164c6a06869ba5a640653c461cafded0ddd40b361c9b
SSDEEP 192:sxZrRRyM/jK1Ml8Mk7/fzshLuG8IdprFfHW6+WNWDQ/SNA29tKI9CCW/EIg4J:sxZrHM7/fzshLvr5HbZ/tBQc
TLSH
T1C552E712AA345977CCCBD21AF955BB57D6F9157392944E44AAFCCA0C00E7AEC2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 6f66604f7f5846cb0ce1b1d4f50c72342efdc5cdd0e949a92354e1df5d49547a
MD5 a4914737dde4aa89f7ca3f6135f47959
SHA1 6b8b262ff1a0940cb1bfc80274ae9a30db8d694b
SHA512 b21427f8bee0847321f3ad7b85c500526540499d1100778595ae7ffdd8e6be01b9d57df1394b26787ab89bb9f60773a35e877aa15cbc55e6e25c457957dcbf8f
SSDEEP 192:sxZrRRyM/jK1Ml8M0cB47/fzs38uGfdp9FEFd8HW6+WNhoLk9Vr/IpNA2XStVpDY:sxZrHsm47/fzs38RwEHbnz/5++eQh0q4
TLSH
T18282D853663489B7CDCBD51AF961BF5BDBF904239A911E486AFCCA0C00D76ED220281B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 a5f9774bc0be90a5448adfa37c11399d97de754f1bc0cac7863e875590139457
MD5 3e0cd04d95be6bd6e7dafbc8a44ff39d
SHA1 eeea188326416a1901fde4d52eca02f90a31d123
SHA512 ae7c77d2e1a07c8faf0db992977bc71ab35287b805368c9258b44ee67037dcb32fc399883be16af5ed12a7ae0a598346b93882f86ab4a74982539b4e53805112
SSDEEP 384:sxZnnBHsm47/fzs38iu9rq3EHbKj8cf55+rQx0q4:sPBMm47/f48isr3HbKf+xq4
TLSH
T1CEA2C753653449B78DDBD51AFC21BF1BDBB914279D914E88AAFCCA0C00E76ED2202C57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 06c9be5db8c33297caadfc5e832e046137e582e4077c0c85c1b42191fbc45d0b
MD5 5f8d391243b5ad6aea0468ad0f0359d7
SHA1 7d74a6882fc83b2e05a5a7adcba2bdb72d2ddf9c
SHA512 2362cf64544ee54a5e6760577c4779f6f4a2fdca32d514165c53ae267ecec44d0d6ff5ecf31248d628a9a343958e3358ad09751c2921d66a77b401ed8b73a7b5
SSDEEP 384:sxZfHsm47/fzs38RVEHbJjz/55+2Qx0q4:sHMm47/f48sHbJ35xq4
TLSH
T1DB92C753653489B78DDBD51AF961BF1BD7F904239A915E88AAFCCA0C00D76FD220281B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 22KB
SHA256 d100a36a4edcbb22f58eb8d524c9d08c7141cd6dfdc7398e582f7a17e3c94978
MD5 cf0fdb2daa70a4167fdfad9cecf5eba5
SHA1 bf258136a98f80297dffd03af4ce5b0b1f60fa27
SHA512 8ee274d78ef94dc824b541111f886d52bdbbc9768b0438b8a2f2ad70551c5d986360b8b08842f456d31565a5dea97ae68ca6a0e646b5f4aa9254c7596fbb300d
SSDEEP 384:sxZnnBHqim47/fzs3878L9bAmHb18c9/5Z+spQhTq4:sPBKim47/f4878B9Hb3Xpcq4
TLSH
T1DEA2D853653449B7CDD7D126F821BF5BDBB91427CD954E88AAFCCA0C00D66ED2202C57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 25KB
SHA256 8b3e07b514a1ecc9eb15396927590bb54583cd50a2c433f0eef0db990c0aee2f
MD5 ca030f46a705689dd2ee4b0f94dcb717
SHA1 29243e2f008b919b4a6ee0befdd133a96d4d68ef
SHA512 fa5bd6252d5ea43e23b0398db0bfa81f4d14558bc713867391c40bdd87f63c94fdf5e5c5500949c0c837946c1878052aa7823c25398f71be05720c10db031ed2
SSDEEP 384:sxZnnikoq6m47/fzsqWvQby08L9pAXHb/sirc9/5Z+p7KPTq4:sPikv6m47/fhYQbN8BEHbKs7gq4
TLSH
T128C2D753653049B789E7D129F921BF6ADBB91467CD914E88AAFCCF0C00DB6ED2202857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8eb4c8db628e26b36ca160147e50eda3a7f12d974ee3546f3ddff668cc26f685
MD5 39a5d903675721b3d1236b6b058a4a1c
SHA1 fb1be046a58dd6f3eae28669771e5a11ba501365
SHA512 a568aa0ef8299616e4a4dc71a08e99682a2a27cdcf4464390e28aecede651c789954d85985cdef61b1ade03b53b0684288301e363f94250d1db5d380204b6040
SSDEEP 192:sxZrRRyM/jK1Ml8M97/fzs38uG8IdprFfHW6+WNWzpZIpNA2XStVp6Q7KI9CAW/u:sxZrH17/fzs38vr5HbwZ5R+HQf
TLSH
T18162D852A63459778CDBD21AF941BB5BD6F9147396950E44AAFCCB0C00E7AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 77707bba9f5f8769603fa7c4e391b8e66942751ecf0cc2edae17fc7a686c14c7
MD5 934105df586baa0c172cc891f7598307
SHA1 9a18841578ad50bbbb66bbeb7c126ee22d90bc80
SHA512 f144972912d0c44cd87dcc2fda13fa5bfa5847cf78bf19e240c0670c366696f531c7afb8cf0d10e4bb23f1230b2dd3e3da5e4c04d03d4d6e0e9d29d417d0b32c
SSDEEP 768:Ap8bqhK7pLuLXa+WvSC368F1+UoAYDCx9Tuqh0VfUC9xbog/OVJFCZLlRTKV/roU:Ap8bqhiEXa+WvSC36u1ja0FCZLbWVsU
TLSH
T174F2FA3B2C0CCB7E4F804E9CED2A6F9A6DE8018B5698895447FA980C03C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 fa82291d25d065126c299340ccd7534c0db7aea93bd1d769d4dc2f8d2cebd070
MD5 8691fa55f076d590c046c3f0f0a8cb11
SHA1 590c9022c6975b09e4401ad57671ac19bdb8dd9e
SHA512 2b8c57344acd2b9c6041b87939cd82ebb42d14105dbb6ffd9891d1b6d10509fbb5b78f45fce3a4c7839c913ca0146f807ec584d5d434d99060bb0eb29149e5e1
SSDEEP 768:AVCbqhK7pLuLXc+WvSCb68F1+UoAYDCx9Tuqh0VfUC9xbog/OVJFIZLlRTKR/ro0:AVCbqhiEXc+WvSCb6u1ja0FIZLbWRsf8
TLSH
T1A2F2FA3B2C0CCB7E4F804E9DDD2A6F8E2DE8028B5A98C98447F9944C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\198b1dbef7ece2ad03770a72810f2b485859f245\854fe496-06f5-4bcc-a8ec-7103624ddcb5\index-dir\the-real-index
Size 864B
SHA256 489d6556c2dc73c2720db48e1f5deb6a9f362f642adceb36da4fce4723445f5d
MD5 34de9f32403cce4e3dfdf3621c0813dc
SHA1 7c2ed51f1edad8e5029d78f4cf218687be12d120
SHA512 7b51b9e1334616553a2eec54a6e1afb82793b36231c17ea4cade25aa7d23144cd0df5fb508b7a83684ae886ffbb45ee0d53ea9f0d697c239f2256e561550550d
TLSH
T1FF11E70FEC460F53D8351DB12522400932397C72FD0251925444B9F5B4999104B23A7E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a75cd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\198b1dbef7ece2ad03770a72810f2b485859f245\854fe496-06f5-4bcc-a8ec-7103624ddcb5\index-dir\the-real-index~RFe5a75cd.TMP
Size 48B
SHA256 d00200a3627144f8c728474b42edc039f3bcf60a62c9d85d4c3f74164835c4e7
MD5 8fb09615c4d020392916ef2c26c20627
SHA1 2f181bfb108c50effda3e8c29e55b6d75f257420
SHA512 c103a4797f770b5c0a3b3ec81ae27ee6e3c51c191d8760aa98091bc8b132e364c0b623a793d34b8236b5dcfcbb7e016bf7f299cd6bda8b328040d459289e9dbb
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\198b1dbef7ece2ad03770a72810f2b485859f245\index.txt
Size 147B
SHA256 3a745a9de83843fe655deae3cfd27e459562cdec4e357eb15c81590a607658ad
MD5 b268af5bb63def9e80e9c9eaf4a5256b
SHA1 9226fc5dc6f909661d30cfcb424108690afc1b85
SHA512 da392abbc8e82db3c633bb4fdd4379ced88a8b88d0356769e52d82d89ebd138688a381558cd7e5e1c8245cc40a8fe58888efd6605643f4b385cedfd52c77274f
TLSH
T1C8C04CA75868B0545F65E1C557E9D665C623106AE48965C4D18090D1108492A1961B52
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a75fc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\198b1dbef7ece2ad03770a72810f2b485859f245\index.txt~RFe5a75fc.TMP
Size 152B
SHA256 efd326296bd9d374e4d326773f16bb578409d71aceb58cae6ecc927b328d9eca
MD5 286480492646c14e1127192f63e0469a
SHA1 c0d08be367a7d08d9834d80dd100bd73a44e2017
SHA512 bc9bc12944c782c284a7df112cdf6f3b1edd680f383e46a964fd112669dcc7b5aa0fa2fa19415aa17fa5c56a1cadb7aa44f9ab74751f50c1daf92b21aaa4a2eb
TLSH
T135C08CA3002870484F20E0C282E4C655C2331C6AE88A65C4D080B0C110B052B0961B06
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\37a9c4be-b019-41bc-8801-22ac101d4241\index-dir\the-real-index
Size 72B
SHA256 396c9216de18640195eb67a062b4efcb148fe50c513218eaabe6d86ef01bc706
MD5 e6da302a628f228b6fb2d17a7bcc6e4d
SHA1 31b6669357bd5eb8521fb7c3bb59fd6cd4db72ae
SHA512 ae6860a6cb9bfb6db1d4c8f0c80e4acd277e319962c8316cf83b30fe0589b3fa710481a462e55683cb004ebcc7884a6b10a1a3077dea7c0bd6b8e27b73ed1004
TLSH
T1FDA00296A6EB08C2F04187B910431F4073504D521103160DC3ECA8B8D8B0260D507018
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a8e76.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\37a9c4be-b019-41bc-8801-22ac101d4241\index-dir\the-real-index~RFe5a8e76.TMP
Size 48B
SHA256 7dc9762b264f194af7f56e198d30cb74f829b1b0b707ee520a5f7d7d945d4acf
MD5 1d283e8a021902cd1003da395958ddbe
SHA1 8167dc28ad25171db13f0c84b0aac21597272bec
SHA512 ad03cbd9d329dc1a8cf9766ecf6b9cacaa0e5e10049fd9d89370e91fc9f2f3ab8e32bf5dac00093499deb7fe442d8cd04a1a4cb2b1367c487e977964edb0af8f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8210ceeb-345c-4f71-8a03-ccbc41551587\index-dir\the-real-index
Size 72B
SHA256 d27eb0875ed2ba5011a27270a39366ad9c87122cb1c2361892afbb100e38c682
MD5 0dce32a80f19bbd09959bf1fb688bffc
SHA1 cf1834eaab13d502742d56cfaeafb4c09b60bb99
SHA512 0f712a7f38ebcfb15103a44a9ac0a97fafa5892e7129cdb081c4672775e6ac29820f1d525747e051b35439751b5f0a95999941d2cff910c3c8e840746d7fb6ab
TLSH
T116A002E2625D0079E00946B0518351503316DD1D420E535965A08A5DE95739D4D65058
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b72c29a0-bd55-435d-8f59-04769e50d179\index-dir\the-real-index
Size 72B
SHA256 8c506bd7ef4c6c82b2cce7fa53e0784e2717d830539d5a66ac2509bb81bd4f63
MD5 3862aba099f067ab665288e57d1f2699
SHA1 6843202d399c5242b83f1efe924c9d90a9a57e47
SHA512 4f972256afe9ca386de6d7558466bc3c7a3a5b84480a432a42c9405f7120d777ff68f79e7a988f89b2d657adec383c9402ab7fc943d7363472d2aa8d794d250d
TLSH
T162A002910380400BCC1211B125D312925F04CA543140975740914894EC964D14D6110C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b72c29a0-bd55-435d-8f59-04769e50d179\index-dir\the-real-index
Size 72B
SHA256 20f6e65c708d11afc6b388b0913c8ab8ce7362e71dd3701eaaf3c0c7315324cf
MD5 a9bfefbf96e09775791c354360de2453
SHA1 b4283325bccebda58e3f35a9175001747d837a5f
SHA512 68876f48a04870adb1a93fcee9a8a5056798f9e62ea4b4f18ac98aff1f0c99fec0f5d8361ca8b140e73fd2fc22c287685d90e3ebd142913744d55d520a8e8282
TLSH
T18BA0021403807485C012A2B265DB0661362089904282672D42D1044CC8E5BB5568501D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index
Size 360B
SHA256 5b21a0349ebfab281cd0cbfa53e816c9104eecf436a1b82182275dd9f52b0df9
MD5 f3a749aeb5ebc63fbc69a32cbbf32bf0
SHA1 3ab9d36e557fb98fbce7b251dbacd5f13141c121
SHA512 5984e16e8f32e8b5718a9640a1c7d35edc600c1216d401eda4766dfdb49d9ae6e85cc85ebce8464ec8d2d3962014715ede5ac6cdd44469ac8b53fc12feba5ea0
TLSH
T166E02B114ED1082ADA200E7114B211D5B3B08CFCB651D94A243DE56B2C5634C54562DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index
Size 3KB
SHA256 d1d8b188a27181cd5d288e7b32c6e49b5781552c3e672d32d9b2efbc3a987fa2
MD5 db569d894496f7c01fd4458c16df0813
SHA1 470705647dce50bdc75eac4ecd5b366cdf611e5c
SHA512 d09fe6e1fe4ae1694dec3750b3d9fc24499179d09b2eed5395652b530a30321652ff1a14322205a388406d75781c76f7769bdc85c4a1f5afed5ace98823f209b
TLSH
T16051C70D4D5625A5DAA802B190B3184537B955DD3B428E2B48EE1038B8C76AF3C2D635
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d20c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index~RFe59d20c.TMP
Size 360B
SHA256 f51d19538fa890d832a11527c7b07cba173b33d5b85f5bc7855fd05fb3a278ce
MD5 77f13364973d38cab05ba985dee5e699
SHA1 f1aa200d560ea15cda3d79936006a8ed02e50868
SHA512 94a1d7d11597112a75477bd048ef75e6f08c1b92c82eabe5c75d10d693d14b49b627e198eebae44f0fc51ca08ec7c78c1e1cb3e88898381793ffb24ebe446500
TLSH
T160E02B4587530422D9100577146154EAF3748D607522FA86747CE82E2C65688D59218D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 bd27d58ae7a5bb408802679e123defba2e385704c58400919ae5d05aef856bd2
MD5 68f2b7b441cafe3ed9cd909c3469ec25
SHA1 c33b915389ba624902e695ced96b5e6e60335637
SHA512 25452a5ddd07ecc035985ea6de3355a7a227f8b5c70a5074fb7fabe62e921118a7f5011fd99c45fa6291ae217deac352d751647726ebf98c6fd216e50851de69
TLSH
T1E5F09EB63EF72814B8BBE3E1203408A002097C44C956EC5F0125B19790F2315248DC71
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 cc420838b300ea202715e1e791fc9c457bce4fdf70b2381f03f137be78ea3b47
MD5 b6bee60a2f92f222e3d1250d2572e881
SHA1 8a9d9a156adc08b149881a22a1000c1351da4680
SHA512 bcfec74f42ccf4fd28f62b59347f25897c76c8c6bccb0ba39e6b9377884f49ec4273bd5fe84c197c3bb0810ebb5abe1ba83146659862dca60b3c645a6fa5bfbc
TLSH
T159F02EB62EF72858BCBBE3F5247448A0020A7D44C9A5EC5F1165B19790F2355249EC71
MD5 SHA1 SHA512 TLSH

Submit Download

f1cdccba37924bda_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_0
Size 172KB
SHA256 2bf602cd29fe431184f3c47114abfde386fc901bf197f35f9636daa774553e8d
MD5 4c7c986580aad29050d6474734dca3b8
SHA1 1a57863788820adf667c5c664d2f89f65986a076
SHA512 e6be3ca6b9081656467c65b895531f5c99f50f431522f5da0d5b1fe51e5b5cb868ab7cc3aff1231c9de6f5cac981ba167ff8bade867b0fc9d05a2bb29c00de6e
SSDEEP 3072:TQe+sswSjnxPCA1jCk11Oe5NxawioOwRUK7f1KULC14sG:Tcsswa52wPOwRUjFhG
TLSH
T15D048346D1F8D863AF6B0053E8967E82F32C3147E619DAA0F587BFE1501E62A70B5C35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1cdccba37924bda_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_1
Size 246KB
SHA256 0e3ccae00012f89b2084a8af8cce00ccf7fc59694917f9db91355b34cfa46501
MD5 d4c096f41c64190f21a91b195271bc78
SHA1 a2b36c3af606ea1ad73f7b6da8626837ca2fb364
SHA512 e7dc0bdcf74719120973c471f127ca8a686e705415c1a28f7b78e227e2698d78be6ab74b36fe5f4f322e648a8df34e61f75bc4e6d268bb43c43ec319dc0a3686
SSDEEP 6144:hh7Vhld+M/ZuHGeOkmclDimpBsme2Wb/1h2sC9ZUq:nWpWfb/g
TLSH
T174342C9A632613BFDF3943B95007BE1163210140AED3C1D6334A5796282EAD776BEE3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 6f861d9d6f27cde22e7e2168091310fa734e15e637fb90c70673a78efd9d29e7
MD5 5ec9f40d1011183538e56cf4a983db6b
SHA1 7b8660863368dad06ecd325af3daf7ad57857ffb
SHA512 be1af215fb5ebc2e3594be21d670b2ea7e5fd00d823743f8f73a1d50f9922ab95c7892cc2d3abc03101ab587c9898e1925e22919749da06d160af88b956523ee
TLSH
T135B02220020E38C3C8380BF8A2823288323C0CA0230F802000A8F2FEECAA3303082002
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 d093ae47562a66dadf69bab5bd75701a3b9915a1df39610808b708a2ba1bb73c
MD5 1c968ffda5e1ab4bb5370dac4e321dc1
SHA1 1a967690cc2850c51ff2e2275fb3f60733823e55
SHA512 a05b470530a3d5297dbc18f6ab06fa37a7b3313d01fcd7ffcd1c8ce27feadc0fabdf8855394891f22a36cc2855728be67bd9a4be159e38721c3e2f5b8a2e4a70
TLSH
T17EA00215236BA091D50106B81197124963914851150A52534690F5B8AC911616742105
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 9390623df6367a1d6c2f33244cfd689e3bbb7c38364dcac3fa5db8bd4f8e7526
MD5 b14f1ad002ac9d78fbd04f5cf83b845d
SHA1 6f0d51691d010cba6a9922b3944d93ed7a9ad06b
SHA512 f1948636f6bfc36fe29f68cbdca5fdb286e59d3b26be0777bfba85eed8c2b7e931513392851d1cbcc6222fd03aafe11f695c2dde524651a1768571cadaad9295
TLSH
T18BC012838E4970EAD6385275E02B158937344490170D126458B4F6B9FC9D761534F297
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d018.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59d018.TMP
Size 48B
SHA256 9e78cec9fc10ffe49154d7c16371d6a14c32af18597921f972c3d3ab77981d1b
MD5 6230c09427f667eac11074639962dd57
SHA1 25a7ecc249158f92c1a88854226c7b8f7edc9b28
SHA512 0f362a446ee06eab04402e5ed30bd13a4935555e1dbbb0a5d006eb9dca2a8fdf409dd5f833dcf456cb9da3e93d503a3231c812e9a1dcae36f0bc2b001e7bba3d
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6ccd80e7380f2f3f20fb92e3593797acb37e44771d7d7bbba8db08bafa2fddb0
MD5 45e2fbb50b7da31cb489a8f5dcec0ebf
SHA1 c815e8f8ff7da626a28b9832dcf9fad28f708422
SHA512 3fce694858888ab19520dfd182c195b23c0b1bf2222cd782d1e44de60ad662080db547aeb993be8881037fdf122ea34ad210180758fcecabfc6764e1af65fcfc
SSDEEP 24:KdCAfCnCUCFaCqdCSCSCu4CCCe+C1IjCICuKiC9haCWCu1ECAC+SmC0MCd8CYCvq:KcaIvK3qwbyVFIdK2gAGFIJKGkUby5
TLSH
T11F91AA0634BB8A21387D644DA7A185375F4231533049A96F3FB893670EBAE110CFE9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d6db1092-90e1-429a-9094-95317e1e2cd5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d6db1092-90e1-429a-9094-95317e1e2cd5.tmp
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe595385.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe595385.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
Size 3KB
SHA256 8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
MD5 94406cdd51b55c0f006cfea05745effb
SHA1 a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9
SHA512 d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3
TLSH
T1F681BE27C5B58E2796F060119750E654F53D43AFA600C6AFB5FC825C2F373ECE88A4A8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 0124dc63c2b60cf3ea480ec8b12e8227d1c64c7a80171e12f74ad837fe11ca6f
MD5 e3ca4e09f91634a1f2cf837c7b9225a3
SHA1 867a7a900115645278a19755827056ec3d9f162e
SHA512 388f0801c3b5a87c5233f2db4228a8d57452ec9c66c086edb648b778aeb2187c610d36b5d66891e7dd312b3014f333919e2db10c8c459c90b051d81008e60ef8
SSDEEP 384:zytNnNnb9+sNvkSNhXuEa+Rdrg+2zpgBSTK3RlUVgeA:ejZbEu9asdglzpgBST+R2VA
TLSH
T191928E3558385D779AB25E55F44B3B17AFF8116B48C62E91EAED4F0E00D729C230BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 8c4a94c61c94ae2e5f9ffe27b5bde9f2b9c2313387456ed64be02617dd519609
MD5 b3904ce6f0c8b8f9d51cdd2df143f9f0
SHA1 93dde09a520912bb13bd05e7e26c3ae573b3ffff
SHA512 0115a762ec0f69d30f6ebfeb05a13067dc9820dbd24955377972ed5f288fd78ce058cbd2f280ecc807e3f843a9b58b154d31799732efa95ee5b6177c0c87099b
SSDEEP 384:z7iF1tNnNnb9izsNR8TUNTUlIltSbLXP2aDf4xa+Rdrg+2zSgBSTK3RlUVgeA:SF1jZbMAwgM/2xasdglzSgBST+R2VA
TLSH
T1C6D2A4F598E78936E9AE4787A73E2E469EBCC15774891490BBC84E0DCC831BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 b0efb935176fee8e64e7a8d995fee1ad1978aaa618d14af74d41f2df6d8d562a
MD5 8011645a13e8c9b84f898cfe058c0c2f
SHA1 ce6edbd96cb9942c001910d26421081f29509d30
SHA512 332481977836e2b0bc88d2505fe30f7937606a4e7f19479b6b7cc35e9115b7fec9d7f103c58daf3013344f417ba7191ea2c28c59c1bceb0c594ffa98bc2990aa
SSDEEP 384:z7iFgtNnNnb9iLsNR8TUNTUlIlhSb4XP2aDfhxa+Rdrg+2zbgBSTK3RlUVgeA:SFgjZbYAwgP/fxasdglzbgBST+R2VA
TLSH
T158D2A4F598E78936E9AE4787A73E2E469EBCC15774891980B7C84E0DCC831BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 6801d47fc2a763bb5b040863c43dbc5de0f4d7b4c0a8a155a83aafca74017404
MD5 d7d9895ff948c8044f069019ac0c03e8
SHA1 d76279eddde8a2af3e3799d5bd52ef95764936bd
SHA512 0493198ae915949bd743b4030591a62cf157e122eba0db4e467bb3ac62e23c28da28b294a63f4feeadc10794b75f1c5d256123094a04d9e6c5ed1c94f0a7a5a2
SSDEEP 384:z7iFKtNnNnb9iLsNW8TUNTUlIlhTVFfXP2aifhxa+Rdrg+2zzgBSTK3RlUVgeA:SFKjZbYpwgb/axasdglzzgBST+R2VA
TLSH
T103D2A4F598E78536E9AE4B87A73E2E469EBCC15774891980B7C84E0DCC831BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 cd06f80b04a887f8972dd7461cfeaa9a7a4eb0e8432d1101ba983b73f25fa215
MD5 ce545e3da86dc8af3cf52604d495851b
SHA1 c1ba584a62467e11695c1744b1e1e30644093737
SHA512 fdb029c830477f3a022c8fd27918b35781321e4b8015465bceb320768aedc0817b076a370cbf1ed9824be475ae5583972e1611da28b33d86de3134c048684015
SSDEEP 384:zotNnNnb9+sNvtSNhXuEa+Rdrg+2zpgBSTK3RlUVgeA:MjZbE79asdglzpgBST+R2VA
TLSH
T188928E3558385D779AB25E55F44B3B17AFF8116B49C62E90EAED4F0E00D729C230BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 7ba063c9fc43ebe2d4aa90980029508281b177a236c009d0adac587b7c46cf04
MD5 0588c6446623605f5db9e909eda3ede1
SHA1 04b5e700831d7ae3116cfe657cf87bf78adf7938
SHA512 cdc6ec850a66fe235c631c291db106453a159ddccd2fdab8d3d3ddcaf40b11cec3563999514a169084bd0068efd811fc787824e45708029ed8dd22c09fe0ecbb
SSDEEP 384:z7iFktNnNnb9idsNW8TUNTUlIl5TVMDXiaxfhxa+Rdrg+2ztgBSTK3RlUVgeA:SFkjZbypwgyZxasdglztgBST+R2VA
TLSH
T14CD2A4F598E78936E9AE4B87A73E2D469EBCC15774891980B7C84E0DCC831BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b53c80ed891eba9bfcecd588c46dd3629831919206c9419be2ad7f3bf7e23d17
MD5 6735d32b2fd1eb33c25b08181ceb65a2
SHA1 e3680c8507f490e638c501fbd27863d0ecf833b8
SHA512 5b36df0b772c922d3753572fcf168cd4c51efeb36cd975140080f48c7497c843c2ab9574fac0724e5c59a7bd636a6fb2821572c40559284b2a22bdea76646ec4
SSDEEP 768:SF2jZbyqwgM/xasdglzvBJSN6KsCr2BST+R2VA:F28Qgu6Kpr2BSNA
TLSH
T1610380F184E38DB6D49D87C7572EAD0669BCC137B4884848B7E56A2DEC8B0BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 98b806e970ea26768731d134a8111e45278fbfd26b1f37d150b11f2f373af5fe
MD5 462ef8cbf417c1b20d461ca6c28ec6a0
SHA1 8c20101e92cb77a203a9e83537e7394e1bc02cb4
SHA512 8543b95b772321b9df44445c252c3bf258ac7759fc7fa1c38e8e39aa2cdb510caacf4a932805ef2e28c5d78fa28abfcae4aa5e4e7dd1e94fd3d90f05fb7697ae
SSDEEP 384:zsiFKtNnNnb9imsNY8TUNTUlIRjT8u1PXiaxf3xa+Rdrg+2ze3LEBSTK3RlUVgfx:zFKjZbFZwgT/xasdglzeQBST+R2nY
TLSH
T17FE2C6F598E78936D89E4787A77E2E46AEFCC15378881590B7D84E0DCC821BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 a17db631c533389a916288770173d0fe42fd3c91164d4b0ac3520f1feae33ca1
MD5 aeb3f4c9745e7eb8817fa8dd1f5cf691
SHA1 ee2d32ed8ad1544318f5ef6bbe39b82dd5181474
SHA512 8b8601db01c1f20536610c0bf8b4e45e064028cf07198129623392f505fb1280b96d19d2f6802f1458aad0a3b5e1c40d649ea925000a5b92086d79cf4c44474e
SSDEEP 768:zFGjZbO3Zwg3/xasdglzeRS2lKvxXBST+R2nY:sa3MQgqlKvxXBS/Y
TLSH
T16A0380F194D38DB6D89D87C7533DAD066ABCC123B5885488B7E86A1DEC9B0BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9e7dc634da8390537c8fa9fe148c11981801c4ac69a944b12f67046042f92066
MD5 299de769bfcdb490f47eb8e6f9c45f0e
SHA1 2a81f3dc6208ff16c6a5455c2b5f49261f091e87
SHA512 3e7c84a25dd1b049e39d9ea8735bab6277b8257f1f99f5b4dae3e54d81d5966036c7d7482687fa217fbafbc8e485054d0f0b9c5c675549a949edc7ac5736ae31
SSDEEP 192:vON46Db6QmiUyrTHBa+j36+FdCuRg2vU6:vON46u2HBa+Rdm4U6
TLSH
T1AE02E83968782CB79EE26E49F48737275FE4103B999A2B94DAEC5F0C00D764C2307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e62ed060cc3b9659ea457e74bd7afecbc1e1043a325d2a28190878ae03e60b88
MD5 f498b74607f1f00264bdf133e613e321
SHA1 65beeed65c14b234b1fd318633e4b8f13df64ff3
SHA512 d1013d833778f1a858c158192d80653a2177a3b24e97e12da71a74899bc93bf1eb0cdbe5af839037eada7452177b7910cc908875ef14dd5718d9e046bdcdc32f
SSDEEP 192:vONC6DbpQmiUy/TaBa+j36+FdCkQ60+2zA5NzL/UU6:vONC6fAaBa+Rdrg+2zGgU6
TLSH
T1C6120935687C6CB79AE26D55F48736179FE4212B998B2B91DAD84F0C00D769C230B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ee3c5f436db4a8d0c37b12694859ed3c4d9ceb87850949ac7f11fa0c57df068d
MD5 ad0e92e62be5c7de2065b209a6754e71
SHA1 20b9c62a9e01df82e01f8129f2e7ff260ed7b97c
SHA512 df4f6e3314a4517c17c898b5ec53f2381a1cacc7c21ef48aab94aa855657a89fc247cb7f7de83409ca5c8c504af56e2fcd236639bee4afdb3ac912af5a54ebbd
TLSH
T118E00192930045BFC07C1730108B1B302FF2802402F6024A1A1401689C237103F30ED1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 274cb55f8d9dcb08bf12b11998613bfdda2d92004dc4c8d0ce6006ac034d2b3a
MD5 64c9e3f3bb2fc94b4e4081da2033d9ed
SHA1 cdb1328194155693544812cb2b043a03bf8abf74
SHA512 1cb498cb9e9baca19eb24e24270023ce875e6966e16248f12bed00eb5bfedf5e77edec7bb39374687e75f5c1585e3f16c579bd74ebd1fc1b458a7f1838a51a08
TLSH
T11AE009A2930045BFC07C173110CB1B313EF6842402B7025A1A250268AC227903B30FD1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d5ede6a97a75cfe8263dfec8aeb8df5e505daa87d7a0e41abc2ec1fdcd9cac45
MD5 08413a8fd970251cd356f551a53b647c
SHA1 208ccba139ec3e1b49da06f8d01a6f6f10f21ecc
SHA512 3e099560ecb9d009909366cca09f7b45ae714d4903c5b08e753a8611cb4c47686fc556ace2af28775ceb013e49da9cddb3896f8a698970957af93d00052a03fa
TLSH
T148E00162830080FFC03C2730009B0B313AE6802002E206464A2106386C63B403E31EC2
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e000e6eb706ae6c4ed296a54e6127ae43c5c7de8ff9dce5f5eb3f862961613d8
MD5 884c4579754b38b76ab8f590184233df
SHA1 456aeb264836905f7b3a84a99132fc83c889d300
SHA512 85896457d72d72dad5a8816a68518df93432e1704eace3b82552c7dd233f45ee9263c6ab805c64d676f2d05ff045886370f88feecd43087be80a15cde9b73ea2
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7690aadba678ebd77af83554c683f586ee68d878e360778f402cb591337e9cf8
MD5 3cbe43ab932a4fa23f86b4b192a45182
SHA1 3f5b4d3b3c63737df3f99bd0972a324cb3d32690
SHA512 2a61bcefb4328d9e205ea77cc2cf6ddb5c4758f9404f76510a581b047559505782e78e6043fd763b5b48acc48f6126e7c69b7dc289107fb6a61c1b932e279246
TLSH
T1E1E00862930085FFC07C177114D75B353EE6847402F702565A2545786C237503F31FD1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 3105ac2301866ee4f85ccb4f37023b1903379b4ad311c629a20b2b31288033cc
MD5 aca9c7b31a6885944bd24bf9861ba340
SHA1 cc81ba54607303f5e90f4240112031d3d1939199
SHA512 2bda2eb453b55eb00b1de8cca18c97809e7792a031bcb355563aa19314b05d3b9db104b21f00e15dea20a1cf1cf495e9ca0dbe43d23da661787e0eb676a03640
TLSH
T171E004A2D30045FFC06C173114CB5B323EEA843402F7025A9A26067CAC22B903F31F91
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58e4ec.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58e4ec.TMP
Size 392B
SHA256 c892c37e0a0451eee2c78c68883b754a5eb7725ebda2ba5d93541c8cbd944f7b
MD5 ba0b30f419e31f916165267b052e8839
SHA1 36439406c2eee2b0af386772e907dc8cf2fe017c
SHA512 dfce3e93c908fc18f2d115aa7aa44895ed3449e95cdac29560c199398bb1d7c60a2d5d464a65a79fc6b32f3141831ad1b43ee1e2cc14b10436996176409b25dc
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 5fac1f86ea0ab49ec6cdce5d0ee879e693c30593630261b279b9e61b910b3b68
MD5 24e6468e4665678163b40d2e8a818136
SHA1 d73dc28eb749fcd9d6b9732e7cf9233642d4c841
SHA512 bba02443d42e50d0d8bd8e61918d28c31ea3c2b380affe78e6e45007bda06532ee5910f487e823d27c9d4de261f84221c037ff0c41318307a375cbbedc466bb9
SSDEEP 3:MsEllllkEthXllkl2zECllo6SB:/M/xT02zh+6S
TLSH
T1FA44040C7FC40507C50011304011C3740370FD305D15574737D114135FC75505C0311D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 0c1b4dc8f72139abc5b2e25e5d0097c1d3529ae18001b1a64ff535e345378b32
MD5 0ad641099b286eebf58a290b5bde86c0
SHA1 922d3e17ccc238f1bf276051af3ad5cdffb20397
SHA512 8661612608382058967a1f2ef25c7fbee41a3c2c748838346c044a48058ba081e84750e4a0de424903813499876fa7f69beba345d8ebc396340d830f1a7c81e0
TLSH
T1220110D29D7E26C2C1AA0F6ED08B26EC40C8D106F19CB07A0C8CF9D4823880E188283F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 30e8b5d48a130d6bf81847b89c208c7a087525e9b7d9a0a97bcf21598332b63b
MD5 bf165c172af1f75083dd4c7e8915ad0e
SHA1 2eb27e18672fd0a1816ab00d00078a570eb62711
SHA512 a58ad7ee2e18750242b9c5d53224218bef54ecd50e067170da12510559c455979fb0523044d4c23d5d5a523562165e471f95d939376df623bfdea9228ca25256
TLSH
T181F09ED29D7E36C0D6E50F6ED44B64FC40D89506F05CB579484CEAD8913950B254287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 ce7879978d6dc1ebc353b93e509ab0dcd980bc78615af00080f3db1cb23e79d4
MD5 a15cd0a1e68c6b9c3945d3192091dc4a
SHA1 5162188f19a245162594501e5febb31a7626aeb4
SHA512 a7ec103cf7c6fa801e1850205c4c06cadf96c21b1fd56db058a2980c472b1ff2f25c69a73f943de8dff815d69217995ad880e85ca7b8ced8cfa1c506315f7368
TLSH
T18DF0ACD29D7E35C2D5AA0F2ED44B25EC54D89606F49CB57A484CEAD4913940F248287E
MD5 SHA1 SHA512 TLSH

Submit Download

cd9d1f62-b249-46de-97ff-3518e32b9772.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\cd9d1f62-b249-46de-97ff-3518e32b9772.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 541492a884430a0e6941b7c4d6e89451240feed3d9e65920055566e53055e5c2
MD5 82e980c1fd3da9d3402c52688214260e
SHA1 18313c088ef2a4c6d76bed3279c50e34c5129d60
SHA512 622a01ed13232a73562c7b69789c38672ed691f08a36db37bd676fee499ce9cdb3e28bca96b0e2e88f9ddb5ba065ffb456a4fd3c101e89df615cb2f1b3ea3208
TLSH
T1C741F85C66ED1148B3B76E1AABF6686E487FB9372E06815D00110E4E0A72B40D971B37
MD5 SHA1 SHA512 TLSH

Submit Download

d7112cf7-aacb-425a-86fd-64fc89b321c8.tmp

Path C:\Users\Admin\AppData\Local\Temp\d7112cf7-aacb-425a-86fd-64fc89b321c8.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ea4b4d52-f24f-47e5-8c6d-9d899303c746.tmp

Path C:\Users\Admin\AppData\Local\Temp\ea4b4d52-f24f-47e5-8c6d-9d899303c746.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

people-playground.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-6IDGA.tmp\people-playground.tmp
Size 3.0MB
SHA256 626aaccf86aa47c6d3d752e0e55b2324bf8b005009ebe94936c848e739ca6d59
MD5 e3136589d840d8e8b9c52fa6d35194af
SHA1 81c36517f0e066caff88fd625dca1fa8941faf08
SHA512 8e801aebc65703261b60b3398493f4e50d11537c57d2c0a6d4e15e1939a09a7074572a955cefb365edcd7e7e4faea5dc0292c61a3729a6cef5df421ea9e6f4d8
SSDEEP 49152:5EA9P+bz2cHPcUb6HSb4SOEMkBeH7nQckO6bAGx7jXTVs3338x:N92bz2Eb6pd7B6bAGx7e333K
TLSH
T11AE54A17F688B23ED06B5A32473386D89837B66169128C5797FC380C8F356942E3E676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3a394474-3687-4ff0-8ceb-29fb675daa79.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2744_67743748\3a394474-3687-4ff0-8ceb-29fb675daa79.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2744_841437381\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

people-playground (1).exe.crdownload

Path C:\Users\Admin\Downloads\people-playground (1).exe.crdownload
Size 638KB
SHA256 93d8dfb94ade06c2d7d4ca47add7d6881ff70453016cc8d1cd14537cc86c06a8
MD5 5534465062a9089840568af130b7d0f3
SHA1 47b1b9670c57e945a630787b661ebc57fa6da787
SHA512 634e9c71f4ab5ee6d3c70abaecb0020d3fddc9eabcc03a7a0346b95d9c4c00db3fe30370670094ec7fd457d6d8d1491a7db19f70e1a2b49cd7068ebc9a5d3f7b
SSDEEP 1536:cC79gXAX271lcBzqEY2lkCswVxYDXosWkd09dluaUGX/9fpDBGQ6J5CYExyHQYY:pgXpJozm2lkCsuYDbMkZkBfx9
TLSH
T19FD407BD078B8445E59BCF748D6A7DA3D0D061C91273C5EEE9327CB28C28E60591BF92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2856-3295-0x0000000000400000-0x00000000004CF000-memory.dmp

Download

memory/2856-6722-0x0000000000400000-0x00000000004CF000-memory.dmp

Download

memory/2856-3235-0x0000000000400000-0x00000000004CF000-memory.dmp

Download

memory/5804-5570-0x0000000000400000-0x0000000000709000-memory.dmp

Download

memory/5804-4289-0x0000000000400000-0x0000000000709000-memory.dmp

Download

memory/5804-6721-0x0000000000400000-0x0000000000709000-memory.dmp

Download

memory/5804-3401-0x0000000000400000-0x0000000000709000-memory.dmp

Download

memory/5804-6519-0x0000000000400000-0x0000000000709000-memory.dmp

Download

memory/5804-4669-0x0000000000400000-0x0000000000709000-memory.dmp

Download

memory/5804-3296-0x0000000000400000-0x0000000000709000-memory.dmp

Download

memory/5804-4561-0x0000000000400000-0x0000000000709000-memory.dmp

Download