Overview

overview

10

Static

static

1

ByteBreake...00.exe

windows10-2004-x64

6

ByteBreake...00.exe

windows11-21h2-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    786s
  • max time network
    759s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    10/06/2026, 22:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ByteBreaker V1_12967300.exe
  • Size 583KB
  • Sample260610-157gdaf14x
  • SHA256 ddbd930cf742882ea6cc10ea5495f8aec24003664b81257c1b3900f3627b6684
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoverydownloadercustomerloaderloaderpersistenceprivilege_escalationransomwarespywarestealerthemidatrojan

Malware Config

Signatures

  • Family: Customer Loader

    Customer Loader is a downloader written in C#.

    downloaderloadercustomerloader
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    defense_evasion
  • Manipulates Digital Signatures 2 IoCs

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 16 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies Windows Firewall 2 TTPs 1 IoCs
    defense_evasion
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Password Policy Discovery 1 TTPs

    Attempt to access detailed information about the password policy used within an enterprise network.

    discovery
  • Drops file in System32 directory 64 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 42 IoCs
  • Loads dropped DLL 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Modifies trusted root certificate store through registry 1 TTPs 7 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Program crash 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 60 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
    defense_evasionspywaretrojan
  • NTFS ADS 1 IoCs
  • Opens file in notepad (likely ransom note) 10 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 21 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
    1⤵
    • Executes dropped EXE
    PID:1260
  • C:\Users\Admin\AppData\Local\Temp\ByteBreaker V1_12967300.exe
    "C:\Users\Admin\AppData\Local\Temp\ByteBreaker V1_12967300.exe"
    1⤵
    • Loads dropped DLL
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1936
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
      2⤵
      • Loads dropped DLL
      • Opens file in notepad (likely ransom note)
      PID:848
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
      2⤵
      • System Location Discovery: System Language Discovery
      • Opens file in notepad (likely ransom note)
      PID:4696
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
      2⤵
      • System Location Discovery: System Language Discovery
      • Opens file in notepad (likely ransom note)
      PID:3384
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
      2⤵
      • System Location Discovery: System Language Discovery
      • Opens file in notepad (likely ransom note)
      PID:1396
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
      2⤵
      • Opens file in notepad (likely ransom note)
      PID:2176
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
      2⤵
      • System Location Discovery: System Language Discovery
      • Opens file in notepad (likely ransom note)
      PID:896
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
      2⤵
      • Opens file in notepad (likely ransom note)
      PID:1680
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
      2⤵
      • System Location Discovery: System Language Discovery
      • Opens file in notepad (likely ransom note)
      PID:3004
    • C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe
      "C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe" -c:1538 -t:InstallUnion
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3184
      • C:\Program Files (x86)\PremierOpinion\pmropn.exe
        C:\Program Files (x86)\PremierOpinion\pmropn.exe -install -uninst:PremierOpinion -t:InstallUnion -bid:5CQ1RKCl4F4r51VhAfPOPN -o:0
        3⤵
        • Executes dropped EXE
        • Modifies trusted root certificate store through registry
        • System Location Discovery: System Language Discovery
        • Modifies system certificate store
        PID:4892
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
      2⤵
      • Opens file in notepad (likely ransom note)
      PID:1048
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
      2⤵
      • System Location Discovery: System Language Discovery
      • Opens file in notepad (likely ransom note)
      PID:6504
  • C:\Program Files (x86)\PremierOpinion\pmservice.exe
    "C:\Program Files (x86)\PremierOpinion\pmservice.exe" /service
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Modifies trusted root certificate store through registry
    • Modifies data under HKEY_USERS
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:324
    • C:\Windows\system32\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Windows\system32\pmls64.dll,UpdateProcess 1260
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4640
    • C:\Windows\SysWOW64\reg.exe
      reg.exe EXPORT "HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{eeb86aef-4a5d-4b75-9d74-f16d438fc286}" C:\PROGRA~2\PREMIE~1\RData.reg /y
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3440
    • \??\c:\program files (x86)\premieropinion\pmropn.exe
      "c:\program files (x86)\premieropinion\pmropn.exe" -boot
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3256
      • C:\Windows\SysWOW64\CheckNetIsolation.exe
        CheckNetIsolation.exe LoopbackExempt -s
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3660
      • C:\Windows\SysWOW64\CheckNetIsolation.exe
        CheckNetIsolation.exe LoopbackExempt -s
        3⤵
          PID:3308
      • C:\Windows\SysWOW64\cmd.exe
        /C C:\PROGRA~2\PREMIE~1\pmropn32.exe 3256
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1888
        • C:\PROGRA~2\PREMIE~1\pmropn32.exe
          C:\PROGRA~2\PREMIE~1\pmropn32.exe 3256
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:804
      • C:\Windows\SysWOW64\cmd.exe
        /C C:\PROGRA~2\PREMIE~1\pmropn64.exe 3256
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:956
        • C:\PROGRA~2\PREMIE~1\pmropn64.exe
          C:\PROGRA~2\PREMIE~1\pmropn64.exe 3256
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:1064
      • \??\c:\program files (x86)\premieropinion\pmropn.exe
        "c:\program files (x86)\premieropinion\pmropn.exe" -updateapps
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3248
        • C:\Windows\SysWOW64\CheckNetIsolation.exe
          CheckNetIsolation.exe LoopbackExempt -a -n=1527c705-839a-4832-9118-54d4bd6a0c89_cw5n1h2txyewy
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1100
        • C:\Windows\SysWOW64\CheckNetIsolation.exe
          CheckNetIsolation.exe LoopbackExempt -a -n=c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3188
        • C:\Windows\SysWOW64\CheckNetIsolation.exe
          CheckNetIsolation.exe LoopbackExempt -a -n=e2a4f912-2574-4a75-9bb0-0d023378592b_cw5n1h2txyewy
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2260
        • C:\Windows\SysWOW64\CheckNetIsolation.exe
          CheckNetIsolation.exe LoopbackExempt -a -n=f46d4000-fd22-4db4-ac8e-4e1ddde828fe_cw5n1h2txyewy
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3884
        • C:\Windows\SysWOW64\CheckNetIsolation.exe
          CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.aad.brokerplugin_cw5n1h2txyewy
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4976
        • C:\Windows\SysWOW64\CheckNetIsolation.exe
          CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.accountscontrol_cw5n1h2txyewy
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3048
        • C:\Windows\SysWOW64\CheckNetIsolation.exe
          CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.asynctextservice_8wekyb3d8bbwe
          3⤵
            PID:3588
          • C:\Windows\SysWOW64\CheckNetIsolation.exe
            CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.bingnews_8wekyb3d8bbwe
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2920
          • C:\Windows\SysWOW64\CheckNetIsolation.exe
            CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.bingweather_8wekyb3d8bbwe
            3⤵
            • System Location Discovery: System Language Discovery
            PID:4520
          • C:\Windows\SysWOW64\CheckNetIsolation.exe
            CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.bioenrollment_cw5n1h2txyewy
            3⤵
              PID:2228
            • C:\Windows\SysWOW64\CheckNetIsolation.exe
              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.creddialoghost_cw5n1h2txyewy
              3⤵
              • System Location Discovery: System Language Discovery
              PID:3464
            • C:\Windows\SysWOW64\CheckNetIsolation.exe
              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.desktopappinstaller_8wekyb3d8bbwe
              3⤵
              • System Location Discovery: System Language Discovery
              PID:3476
            • C:\Windows\SysWOW64\CheckNetIsolation.exe
              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.ecapp_8wekyb3d8bbwe
              3⤵
              • System Location Discovery: System Language Discovery
              PID:3776
            • C:\Windows\SysWOW64\CheckNetIsolation.exe
              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.gamingapp_8wekyb3d8bbwe
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2792
            • C:\Windows\SysWOW64\CheckNetIsolation.exe
              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.gethelp_8wekyb3d8bbwe
              3⤵
              • System Location Discovery: System Language Discovery
              PID:1524
            • C:\Windows\SysWOW64\CheckNetIsolation.exe
              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.heifimageextension_8wekyb3d8bbwe
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2212
            • C:\Windows\SysWOW64\CheckNetIsolation.exe
              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.lockapp_cw5n1h2txyewy
              3⤵
              • System Location Discovery: System Language Discovery
              PID:1044
            • C:\Windows\SysWOW64\CheckNetIsolation.exe
              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.microsoftedge.stable_8wekyb3d8bbwe
              3⤵
                PID:4508
              • C:\Windows\SysWOW64\CheckNetIsolation.exe
                CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.microsoftedge_8wekyb3d8bbwe
                3⤵
                  PID:4364
                • C:\Windows\SysWOW64\CheckNetIsolation.exe
                  CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.microsoftedgedevtoolsclient_8wekyb3d8bbwe
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:4412
                • C:\Windows\SysWOW64\CheckNetIsolation.exe
                  CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.microsoftofficehub_8wekyb3d8bbwe
                  3⤵
                    PID:4740
                  • C:\Windows\SysWOW64\CheckNetIsolation.exe
                    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.microsoftsolitairecollection_8wekyb3d8bbwe
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:4728
                  • C:\Windows\SysWOW64\CheckNetIsolation.exe
                    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.microsoftstickynotes_8wekyb3d8bbwe
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:4788
                  • C:\Windows\SysWOW64\CheckNetIsolation.exe
                    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.net.native.framework.2.2_8wekyb3d8bbwe
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:768
                  • C:\Windows\SysWOW64\CheckNetIsolation.exe
                    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.net.native.runtime.2.2_8wekyb3d8bbwe
                    3⤵
                    • System Time Discovery
                    PID:4028
                  • C:\Windows\SysWOW64\CheckNetIsolation.exe
                    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.onedrivesync_8wekyb3d8bbwe
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:4996
                  • C:\Windows\SysWOW64\CheckNetIsolation.exe
                    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.people_8wekyb3d8bbwe
                    3⤵
                      PID:4432
                    • C:\Windows\SysWOW64\CheckNetIsolation.exe
                      CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.powerautomatedesktop_8wekyb3d8bbwe
                      3⤵
                        PID:1212
                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                        CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.storepurchaseapp_8wekyb3d8bbwe
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:4296
                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                        CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.todos_8wekyb3d8bbwe
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:3660
                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                        CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.ui.xaml.2.4_8wekyb3d8bbwe
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:5112
                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                        CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.ui.xaml.cbs_8wekyb3d8bbwe
                        3⤵
                          PID:2836
                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                          CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.vclibs.140.00.uwpdesktop_8wekyb3d8bbwe
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:3628
                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                          CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.vclibs.140.00_8wekyb3d8bbwe
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:2476
                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                          CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.vp9videoextensions_8wekyb3d8bbwe
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:1832
                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                          CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.webmediaextensions_8wekyb3d8bbwe
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:4440
                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                          CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.webpimageextension_8wekyb3d8bbwe
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:2508
                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                          CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.win32webviewhost_cw5n1h2txyewy
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:3956
                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                          CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.apprep.chxapp_cw5n1h2txyewy
                          3⤵
                            PID:796
                          • C:\Windows\SysWOW64\CheckNetIsolation.exe
                            CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:4516
                          • C:\Windows\SysWOW64\CheckNetIsolation.exe
                            CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.callingshellapp_cw5n1h2txyewy
                            3⤵
                              PID:3484
                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.capturepicker_cw5n1h2txyewy
                              3⤵
                                PID:2816
                              • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.cloudexperiencehost_cw5n1h2txyewy
                                3⤵
                                • System Location Discovery: System Language Discovery
                                PID:3984
                              • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.contentdeliverymanager_cw5n1h2txyewy
                                3⤵
                                • System Location Discovery: System Language Discovery
                                PID:3352
                              • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.narratorquickstart_8wekyb3d8bbwe
                                3⤵
                                  PID:2788
                                • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                  CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:3864
                                • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                  CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.oobenetworkconnectionflow_cw5n1h2txyewy
                                  3⤵
                                    PID:4592
                                  • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.parentalcontrols_cw5n1h2txyewy
                                    3⤵
                                      PID:4712
                                    • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                      CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.peopleexperiencehost_cw5n1h2txyewy
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:4832
                                    • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                      CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.pinningconfirmationdialog_cw5n1h2txyewy
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:3472
                                    • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                      CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.search_cw5n1h2txyewy
                                      3⤵
                                        PID:4740
                                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                        CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.secureassessmentbrowser_cw5n1h2txyewy
                                        3⤵
                                          PID:232
                                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                          CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.shellexperiencehost_cw5n1h2txyewy
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:1336
                                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                          CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:1116
                                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                          CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.xgpuejectdialog_cw5n1h2txyewy
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:1032
                                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                          CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windowsalarms_8wekyb3d8bbwe
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:5012
                                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                          CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windowscalculator_8wekyb3d8bbwe
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:1100
                                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                          CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windowsfeedbackhub_8wekyb3d8bbwe
                                          3⤵
                                            PID:2428
                                          • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                            CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windowsmaps_8wekyb3d8bbwe
                                            3⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:3532
                                          • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                            CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windowssoundrecorder_8wekyb3d8bbwe
                                            3⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:4440
                                          • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                            CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windowsterminal_8wekyb3d8bbwe
                                            3⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:4484
                                          • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                            CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.xbox.tcui_8wekyb3d8bbwe
                                            3⤵
                                              PID:2128
                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.xboxgamecallableui_cw5n1h2txyewy
                                              3⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:2804
                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                              CheckNetIsolation.exe LoopbackExempt -a -n=microsoftwindows.client.cbs_cw5n1h2txyewy
                                              3⤵
                                                PID:4760
                                              • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                CheckNetIsolation.exe LoopbackExempt -a -n=microsoftwindows.undockeddevkit_cw5n1h2txyewy
                                                3⤵
                                                  PID:3492
                                                  • C:\Windows\System32\Conhost.exe
                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                    4⤵
                                                      PID:1832
                                                  • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                    CheckNetIsolation.exe LoopbackExempt -a -n=ncsiuwpapp_8wekyb3d8bbwe
                                                    3⤵
                                                      PID:580
                                                    • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                      CheckNetIsolation.exe LoopbackExempt -a -n=windows.cbspreview_cw5n1h2txyewy
                                                      3⤵
                                                        PID:5104
                                                        • C:\Windows\System32\Conhost.exe
                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                          4⤵
                                                            PID:4484
                                                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                          CheckNetIsolation.exe LoopbackExempt -a -n=windows.printdialog_cw5n1h2txyewy
                                                          3⤵
                                                            PID:2052
                                                          • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                            CheckNetIsolation.exe LoopbackExempt -a -n=windows_ie_ac_001
                                                            3⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:3856
                                                        • C:\Users\Admin\AppData\Local\Temp\~os1323.tmp\pmropn.exe
                                                          C:\Users\Admin\AppData\Local\Temp\~os1323.tmp\pmropn.exe -nupgr:"c:\program files (x86)\premieropinion\pmropn.exe" -cmdok -pid:3256 -q -v:NONE -thisver:1.3.340.314 -src:C:\Users\Admin\AppData\Local\Temp\~os1323.tmp -upng -highint
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies data under HKEY_USERS
                                                          PID:5464
                                                          • C:\Windows\SysWOW64\netsh.exe
                                                            netsh firewall delete allowedprogram program = "c:\program files (x86)\premieropinion\pmropn.exe"
                                                            3⤵
                                                            • Modifies Windows Firewall
                                                            • Event Triggered Execution: Netsh Helper DLL
                                                            • System Location Discovery: System Language Discovery
                                                            PID:5292
                                                        • \??\c:\program files (x86)\premieropinion\pmropn.exe
                                                          "c:\program files (x86)\premieropinion\pmropn.exe" -boot
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          PID:6040
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 324 -s 612
                                                          2⤵
                                                          • Program crash
                                                          PID:5372
                                                      • C:\Windows\system32\wbem\unsecapp.exe
                                                        C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                        1⤵
                                                        • Loads dropped DLL
                                                        PID:4784
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                        1⤵
                                                        • Loads dropped DLL
                                                        • Enumerates system info in registry
                                                        • Modifies data under HKEY_USERS
                                                        • Modifies registry class
                                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                        • Suspicious use of FindShellTrayWindow
                                                        PID:2372
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x398,0x39c,0x3a0,0x394,0x3d4,0x7fff3800c188,0x7fff3800c194,0x7fff3800c1a0
                                                          2⤵
                                                          • Loads dropped DLL
                                                          PID:1856
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,13060999068579673424,662972175667704224,524288 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:11
                                                          2⤵
                                                          • Loads dropped DLL
                                                          • System Time Discovery
                                                          PID:2028
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,13484341012175354487,10538612663538177522,262144 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
                                                          2⤵
                                                            PID:4500
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2676,i,14980442415170099315,14636969245466544070,524288 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:13
                                                            2⤵
                                                              PID:2416
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,17903789230309276746,12873305870293766595,2097152 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
                                                              2⤵
                                                                PID:800
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,8619864638033532901,3319349128719978357,2097152 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
                                                                2⤵
                                                                  PID:3864
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,10205452693950139263,7349364108822930129,2097152 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:1
                                                                  2⤵
                                                                    PID:4200
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,9925785076686095739,2207877114787511070,2097152 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:9
                                                                    2⤵
                                                                      PID:3268
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4328,i,11253872582346557056,12316196931285947235,2097152 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:1
                                                                      2⤵
                                                                        PID:3004
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4340,i,5890929563148197280,4635331054453912662,2097152 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=1664 /prefetch:9
                                                                        2⤵
                                                                          PID:2088
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,10189753922476091305,517187772885439959,524288 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
                                                                          2⤵
                                                                            PID:1168
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,17510358011050690581,1572736008545030624,524288 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:14
                                                                            2⤵
                                                                              PID:844
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,17288231093993452783,1967872417311897588,524288 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:14
                                                                              2⤵
                                                                                PID:4416
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,13595885498445538124,18414710905043364992,524288 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
                                                                                2⤵
                                                                                  PID:3492
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,10035230744274491008,3797408484703449465,524288 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
                                                                                  2⤵
                                                                                    PID:3312
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,10035230744274491008,3797408484703449465,524288 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
                                                                                    2⤵
                                                                                    • Loads dropped DLL
                                                                                    PID:4300
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,6992311029739019432,17918209431293281442,524288 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:14
                                                                                    2⤵
                                                                                    • Loads dropped DLL
                                                                                    PID:5192
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                                                                      cookie_exporter.exe --cookie-json=1324
                                                                                      3⤵
                                                                                        PID:5264
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6568,i,11583907819829548087,9598382436307214088,2097152 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:1
                                                                                      2⤵
                                                                                        PID:5424
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7096,i,15686035955864308591,9501808263171726820,2097152 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:1
                                                                                        2⤵
                                                                                          PID:2792
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7064,i,17029726033695227716,9917805351149536562,524288 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:14
                                                                                          2⤵
                                                                                            PID:936
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7668,i,15397072321198583917,4932311856640497390,524288 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=7640 /prefetch:14
                                                                                            2⤵
                                                                                              PID:5728
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7724,i,15987143092829588866,2681205076452193305,524288 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=7660 /prefetch:14
                                                                                              2⤵
                                                                                                PID:5804
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6976,i,2599560956009647329,11825257505029151800,524288 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:14
                                                                                                2⤵
                                                                                                  PID:5104
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,13446639665774190955,5683992012671516230,524288 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:14
                                                                                                  2⤵
                                                                                                    PID:5128
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7648,i,3920616538139663284,15197635534930506237,524288 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:14
                                                                                                    2⤵
                                                                                                      PID:5508
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,3720380152709834971,2014395674217484993,524288 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:14
                                                                                                      2⤵
                                                                                                      • Loads dropped DLL
                                                                                                      PID:1528
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,14843805242065904064,8758815148112273670,524288 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
                                                                                                      2⤵
                                                                                                      • Loads dropped DLL
                                                                                                      PID:5712
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,10892375733793478185,2658378123693040904,524288 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:14
                                                                                                      2⤵
                                                                                                      • Loads dropped DLL
                                                                                                      PID:2484
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,167138255100709840,15808032573521963352,524288 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:14
                                                                                                      2⤵
                                                                                                      • Loads dropped DLL
                                                                                                      • NTFS ADS
                                                                                                      PID:5212
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7488,i,8476232416646387549,15746968919269506477,2097152 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:1
                                                                                                      2⤵
                                                                                                        PID:4548
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,2507555874821403451,8719233475428367381,524288 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:14
                                                                                                        2⤵
                                                                                                          PID:5328
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=2732,i,12224184326077998421,1462318108840715432,2097152 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:1
                                                                                                          2⤵
                                                                                                            PID:6108
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7924,i,14533587744588443634,18086952734549238077,524288 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=7888 /prefetch:14
                                                                                                            2⤵
                                                                                                              PID:6124
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7256,i,15826352425957649823,8795359834542592265,2097152 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:1
                                                                                                              2⤵
                                                                                                                PID:5196
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=6744,i,3313141263367087691,11197184948893516491,2097152 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:1
                                                                                                                2⤵
                                                                                                                  PID:3748
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7592,i,14469568307256620056,3376307029517774368,524288 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
                                                                                                                  2⤵
                                                                                                                  • Modifies registry class
                                                                                                                  PID:5476
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,13251181002666528968,16025882895914243325,524288 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:12
                                                                                                                  2⤵
                                                                                                                    PID:8
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1080,i,12588395326182093983,3380464787258685771,524288 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
                                                                                                                    2⤵
                                                                                                                      PID:4728
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7944,i,10921691907066482319,17057559038756158665,262144 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:10
                                                                                                                      2⤵
                                                                                                                      • Loads dropped DLL
                                                                                                                      PID:2900
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2096,i,998048114939332481,4340691336581905308,524288 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:14
                                                                                                                      2⤵
                                                                                                                        PID:2940
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,7303769537193485879,15555802702267852118,524288 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
                                                                                                                        2⤵
                                                                                                                          PID:6020
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7772,i,18149818280267240819,4320399160002313545,524288 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:14
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Loads dropped DLL
                                                                                                                          PID:5172
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7836,i,3765391846335926839,12623631669376686015,524288 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=7628 /prefetch:14
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Loads dropped DLL
                                                                                                                          PID:5760
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,6354306323478236255,3840189908190136004,524288 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:14
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Loads dropped DLL
                                                                                                                          PID:6404
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6800,i,5211762584479869405,2300300130197500980,524288 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:14
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Loads dropped DLL
                                                                                                                          PID:6752
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,7865064978555355448,2308516911169948104,524288 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Loads dropped DLL
                                                                                                                          PID:5620
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6884,i,9891143914929678990,6649731140945716128,524288 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:14
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:6224
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,15962995195720733419,2826304927025056706,524288 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:5760
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,13145371274783529481,14786049526669171638,524288 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:3016
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2112,i,16295147306745132888,1512066626273098688,524288 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:3572
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2112,i,5115251857141942158,16765442797865812384,524288 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:14
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:6956
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,12536716750443288775,10317519063490631590,524288 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:5644
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,14697089691246895857,5598422904140780202,524288 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:14
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:4708
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,16734526459419727558,11437315739267431162,524288 --field-trial-handle=2312,i,11767851039841000194,10166113689074007222,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:6904
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                        1⤵
                                                                                                                          PID:1744
                                                                                                                        • C:\Windows\System32\rundll32.exe
                                                                                                                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                          1⤵
                                                                                                                          • Loads dropped DLL
                                                                                                                          PID:5688
                                                                                                                        • C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe
                                                                                                                          "C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe"
                                                                                                                          1⤵
                                                                                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                          • Checks BIOS information in registry
                                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                          • Loads dropped DLL
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:4300
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/invite/qfyfqMnBYK
                                                                                                                            2⤵
                                                                                                                              PID:6024
                                                                                                                            • C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\decompiler.exe
                                                                                                                              "C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\decompiler.exe" serve
                                                                                                                              2⤵
                                                                                                                                PID:5688
                                                                                                                              • C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\decompiler.exe
                                                                                                                                "C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\decompiler.exe" serve
                                                                                                                                2⤵
                                                                                                                                  PID:6120
                                                                                                                                • C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\decompiler.exe
                                                                                                                                  "C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\decompiler.exe" serve
                                                                                                                                  2⤵
                                                                                                                                    PID:5448
                                                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=bytebreakerV1.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=4300.5684.921947920828229026
                                                                                                                                    2⤵
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    • Loads dropped DLL
                                                                                                                                    • Enumerates system info in registry
                                                                                                                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                    PID:5652
                                                                                                                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7fff1860b078,0x7fff1860b084,0x7fff1860b090
                                                                                                                                      3⤵
                                                                                                                                        PID:2344
                                                                                                                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView" --webview-exe-name=bytebreakerV1.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1688,i,5336942884360172407,9657539631556078491,262144 --variations-seed-version --mojo-platform-channel-handle=1684 /prefetch:2
                                                                                                                                        3⤵
                                                                                                                                          PID:6076
                                                                                                                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView" --webview-exe-name=bytebreakerV1.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=1360,i,5336942884360172407,9657539631556078491,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:11
                                                                                                                                          3⤵
                                                                                                                                            PID:860
                                                                                                                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView" --webview-exe-name=bytebreakerV1.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=1692,i,5336942884360172407,9657539631556078491,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:13
                                                                                                                                            3⤵
                                                                                                                                              PID:5992
                                                                                                                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView" --webview-exe-name=bytebreakerV1.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3536,i,5336942884360172407,9657539631556078491,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
                                                                                                                                              3⤵
                                                                                                                                                PID:2772
                                                                                                                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView" --webview-exe-name=bytebreakerV1.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2168,i,5336942884360172407,9657539631556078491,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:14
                                                                                                                                                3⤵
                                                                                                                                                  PID:6296
                                                                                                                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView" --webview-exe-name=bytebreakerV1.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4580,i,5336942884360172407,9657539631556078491,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:14
                                                                                                                                                  3⤵
                                                                                                                                                    PID:6764
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView" --webview-exe-name=bytebreakerV1.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2188,i,5336942884360172407,9657539631556078491,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:14
                                                                                                                                                    3⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    PID:5356
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView" --webview-exe-name=bytebreakerV1.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4656,i,5336942884360172407,9657539631556078491,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:14
                                                                                                                                                    3⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    PID:6984
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView" --webview-exe-name=bytebreakerV1.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4316,i,5336942884360172407,9657539631556078491,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:10
                                                                                                                                                    3⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    PID:5376
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView" --webview-exe-name=bytebreakerV1.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4704,i,5336942884360172407,9657539631556078491,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:14
                                                                                                                                                    3⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    PID:6040
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView" --webview-exe-name=bytebreakerV1.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4076,i,5336942884360172407,9657539631556078491,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:14
                                                                                                                                                    3⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:6860
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView" --webview-exe-name=bytebreakerV1.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=3820,i,5336942884360172407,9657539631556078491,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:14
                                                                                                                                                    3⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:6508
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView" --webview-exe-name=bytebreakerV1.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4576,i,5336942884360172407,9657539631556078491,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:14
                                                                                                                                                    3⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:4320
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView" --webview-exe-name=bytebreakerV1.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4664,i,5336942884360172407,9657539631556078491,262144 --variations-seed-version --mojo-platform-channel-handle=4060 /prefetch:14
                                                                                                                                                    3⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:5348
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView" --webview-exe-name=bytebreakerV1.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4892,i,5336942884360172407,9657539631556078491,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:14
                                                                                                                                                    3⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:3376
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView" --webview-exe-name=bytebreakerV1.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=3856,i,5336942884360172407,9657539631556078491,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:14
                                                                                                                                                    3⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:1708
                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 324 -ip 324
                                                                                                                                                1⤵
                                                                                                                                                  PID:5156
                                                                                                                                                • C:\Program Files (x86)\PremierOpinion\pmservice.exe
                                                                                                                                                  "C:\Program Files (x86)\PremierOpinion\pmservice.exe" /service
                                                                                                                                                  1⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                  PID:804
                                                                                                                                                  • C:\Windows\system32\rundll32.exe
                                                                                                                                                    C:\Windows\system32\rundll32.exe C:\Windows\system32\pmls64.dll,UpdateProcess 1260
                                                                                                                                                    2⤵
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                    PID:5280
                                                                                                                                                  • C:\Program Files (x86)\PremierOpinion\pmropn.exe
                                                                                                                                                    "C:\Program Files (x86)\PremierOpinion\pmropn.exe" -boot
                                                                                                                                                    2⤵
                                                                                                                                                    • Manipulates Digital Signatures
                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    • Checks SCSI registry key(s)
                                                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                                                                    PID:2908
                                                                                                                                                    • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                                                      CheckNetIsolation.exe LoopbackExempt -s
                                                                                                                                                      3⤵
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:5660
                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                      powershell Get-AppxPackage
                                                                                                                                                      3⤵
                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                      PID:2352
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    /C C:\PROGRA~2\PREMIE~1\pmropn32.exe 2908
                                                                                                                                                    2⤵
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:1724
                                                                                                                                                    • C:\PROGRA~2\PREMIE~1\pmropn32.exe
                                                                                                                                                      C:\PROGRA~2\PREMIE~1\pmropn32.exe 2908
                                                                                                                                                      3⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                      PID:5264
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    /C C:\PROGRA~2\PREMIE~1\pmropn64.exe 2908
                                                                                                                                                    2⤵
                                                                                                                                                      PID:3596
                                                                                                                                                      • C:\PROGRA~2\PREMIE~1\pmropn64.exe
                                                                                                                                                        C:\PROGRA~2\PREMIE~1\pmropn64.exe 2908
                                                                                                                                                        3⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                        PID:5932
                                                                                                                                                    • \??\c:\program files (x86)\premieropinion\pmropn.exe
                                                                                                                                                      "c:\program files (x86)\premieropinion\pmropn.exe" -installmenu:PremierOpinion -v:NONE
                                                                                                                                                      2⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                      PID:6348
                                                                                                                                                  • C:\Windows\system32\wbem\unsecapp.exe
                                                                                                                                                    C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                                                                                                    1⤵
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    PID:5016
                                                                                                                                                  • C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\decompiler.exe
                                                                                                                                                    "C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\decompiler.exe"
                                                                                                                                                    1⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:6796
                                                                                                                                                  • C:\Windows\system32\sihost.exe
                                                                                                                                                    sihost.exe
                                                                                                                                                    1⤵
                                                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                                                    PID:6800
                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                      explorer.exe /LOADSAVEDWINDOWS
                                                                                                                                                      2⤵
                                                                                                                                                      • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                      • Checks SCSI registry key(s)
                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                      • Modifies registry class
                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                      • Suspicious use of SendNotifyMessage
                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                      PID:6436
                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                    1⤵
                                                                                                                                                    • Modifies registry class
                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                    PID:1280
                                                                                                                                                  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                                                    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                                                    1⤵
                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                    • Modifies registry class
                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                    PID:4524

                                                                                                                                                  Network

                                                                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                                                                        Reconnaissance

                                                                                                                                                        Resource Development

                                                                                                                                                        Initial Access

                                                                                                                                                        Execution

                                                                                                                                                        Persistence

                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                        1
                                                                                                                                                        T1547

                                                                                                                                                        Active Setup

                                                                                                                                                        1
                                                                                                                                                        T1547.014

                                                                                                                                                        Create or Modify System Process

                                                                                                                                                        1
                                                                                                                                                        T1543

                                                                                                                                                        Windows Service

                                                                                                                                                        1
                                                                                                                                                        T1543.003

                                                                                                                                                        Event Triggered Execution

                                                                                                                                                        1
                                                                                                                                                        T1546

                                                                                                                                                        Netsh Helper DLL

                                                                                                                                                        1
                                                                                                                                                        T1546.007

                                                                                                                                                        Privilege Escalation

                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                        1
                                                                                                                                                        T1547

                                                                                                                                                        Active Setup

                                                                                                                                                        1
                                                                                                                                                        T1547.014

                                                                                                                                                        Create or Modify System Process

                                                                                                                                                        1
                                                                                                                                                        T1543

                                                                                                                                                        Windows Service

                                                                                                                                                        1
                                                                                                                                                        T1543.003

                                                                                                                                                        Event Triggered Execution

                                                                                                                                                        1
                                                                                                                                                        T1546

                                                                                                                                                        Netsh Helper DLL

                                                                                                                                                        1
                                                                                                                                                        T1546.007

                                                                                                                                                        Defense Evasion

                                                                                                                                                        Impair Defenses

                                                                                                                                                        1
                                                                                                                                                        T1562

                                                                                                                                                        Disable or Modify System Firewall

                                                                                                                                                        1
                                                                                                                                                        T1562.004

                                                                                                                                                        Modify Registry

                                                                                                                                                        3
                                                                                                                                                        T1112

                                                                                                                                                        Subvert Trust Controls

                                                                                                                                                        2
                                                                                                                                                        T1553

                                                                                                                                                        Install Root Certificate

                                                                                                                                                        2
                                                                                                                                                        T1553.004

                                                                                                                                                        Virtualization/Sandbox Evasion

                                                                                                                                                        1
                                                                                                                                                        T1497

                                                                                                                                                        Credential Access

                                                                                                                                                        Credentials from Password Stores

                                                                                                                                                        1
                                                                                                                                                        T1555

                                                                                                                                                        Credentials from Web Browsers

                                                                                                                                                        1
                                                                                                                                                        T1555.003

                                                                                                                                                        Unsecured Credentials

                                                                                                                                                        1
                                                                                                                                                        T1552

                                                                                                                                                        Credentials In Files

                                                                                                                                                        1
                                                                                                                                                        T1552.001

                                                                                                                                                        Discovery

                                                                                                                                                        Browser Information Discovery

                                                                                                                                                        1
                                                                                                                                                        T1217

                                                                                                                                                        Network Share Discovery

                                                                                                                                                        1
                                                                                                                                                        T1135

                                                                                                                                                        Password Policy Discovery

                                                                                                                                                        1
                                                                                                                                                        T1201

                                                                                                                                                        Peripheral Device Discovery

                                                                                                                                                        2
                                                                                                                                                        T1120

                                                                                                                                                        Query Registry

                                                                                                                                                        7
                                                                                                                                                        T1012

                                                                                                                                                        System Information Discovery

                                                                                                                                                        5
                                                                                                                                                        T1082

                                                                                                                                                        System Location Discovery

                                                                                                                                                        1
                                                                                                                                                        T1614

                                                                                                                                                        System Language Discovery

                                                                                                                                                        1
                                                                                                                                                        T1614.001

                                                                                                                                                        System Time Discovery

                                                                                                                                                        1
                                                                                                                                                        T1124

                                                                                                                                                        Virtualization/Sandbox Evasion

                                                                                                                                                        1
                                                                                                                                                        T1497

                                                                                                                                                        Lateral Movement

                                                                                                                                                        Collection

                                                                                                                                                        Data from Local System

                                                                                                                                                        1
                                                                                                                                                        T1005

                                                                                                                                                        Command and Control

                                                                                                                                                        Web Service

                                                                                                                                                        1
                                                                                                                                                        T1102

                                                                                                                                                        Exfiltration

                                                                                                                                                        Impact

                                                                                                                                                        Replay Monitor

                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                        Downloads

                                                                                                                                                        RData.reg
                                                                                                                                                        • Path C:\PROGRA~2\PREMIE~1\RData.reg
                                                                                                                                                        • Size 3KB
                                                                                                                                                        • SHA256 58921d2b8d2350127d989013cd96f1679a9d6844b333684b455a7e7995a13613
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        snt.dat
                                                                                                                                                        • Path C:\PROGRA~2\PREMIE~1\snt.dat
                                                                                                                                                        • Size 3.4MB
                                                                                                                                                        • SHA256 1e3e80d69a5d684066bde8f1b6c1633ba9bd762fec64e1eeebea4da789a55e59
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        cacert.pem
                                                                                                                                                        • Path C:\Program Files (x86)\PremierOpinion\cacert.pem
                                                                                                                                                        • Size 3KB
                                                                                                                                                        • SHA256 9f19e7a7139cca8373b516ab1ae49c644aa1c8048e8c7aa5784774a081dcbb87
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        pmls.dll
                                                                                                                                                        • Path C:\Program Files (x86)\PremierOpinion\pmls.dll
                                                                                                                                                        • Size 884KB
                                                                                                                                                        • SHA256 e471da417462c9f60181c27efe2355db4f0b3b4df6bd0d4097864a72677d8e5d
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        pmls.dll
                                                                                                                                                        • Path C:\Program Files (x86)\PremierOpinion\pmls.dll
                                                                                                                                                        • Size 890KB
                                                                                                                                                        • SHA256 dbd9cca144ede923ce51a8441b97763c56b32dd16eaf6e57f24ffb3ee9c96b46
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        pmls64.dll
                                                                                                                                                        • Path C:\Program Files (x86)\PremierOpinion\pmls64.dll
                                                                                                                                                        • Size 1.1MB
                                                                                                                                                        • SHA256 877c2894f42bf078dfa36f06b543490d800a32c4f5245464bfec300b56867661
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        pmls64.dll
                                                                                                                                                        • Path C:\Program Files (x86)\PremierOpinion\pmls64.dll
                                                                                                                                                        • Size 1.1MB
                                                                                                                                                        • SHA256 cde8be58181e256e6855335d741316c665972807ea2c49701e740b25c3573554
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        pmph.dll
                                                                                                                                                        • Path C:\Program Files (x86)\PremierOpinion\pmph.dll
                                                                                                                                                        • Size 806KB
                                                                                                                                                        • SHA256 7cdd0b4b6492483d07ddd1869ea4c213d8d5043aec14117b1a5926093bedc7e1
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        pmropn.exe
                                                                                                                                                        • Path C:\Program Files (x86)\PremierOpinion\pmropn.exe
                                                                                                                                                        • Size 7.4MB
                                                                                                                                                        • SHA256 b8e134c1518903be8b260f821d1896b521f7f70956090562b3cc71b71bf8cb1b
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        pmropn32.exe
                                                                                                                                                        • Path C:\Program Files (x86)\PremierOpinion\pmropn32.exe
                                                                                                                                                        • Size 244KB
                                                                                                                                                        • SHA256 b56a74fbe9b0a0c027f230a412dd69afbb697c41f31635352b37fe74d334fc15
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        pmropn32.exe
                                                                                                                                                        • Path C:\Program Files (x86)\PremierOpinion\pmropn32.exe
                                                                                                                                                        • Size 244KB
                                                                                                                                                        • SHA256 3d76d4bf4a39a77a3bf877f10aea836a8dccbb634376ee96e8120b0ae0f07d1c
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        pmropn64.exe
                                                                                                                                                        • Path C:\Program Files (x86)\PremierOpinion\pmropn64.exe
                                                                                                                                                        • Size 303KB
                                                                                                                                                        • SHA256 f6de7618e24c0731e5ff77aa56f200d3c0e30e672a63c7d11b9717ece29e6814
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        pmropn64.exe
                                                                                                                                                        • Path C:\Program Files (x86)\PremierOpinion\pmropn64.exe
                                                                                                                                                        • Size 303KB
                                                                                                                                                        • SHA256 27383a35a7cd68b477cf578a995bdd9416470620163fbd049e7312c1538b2579
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        pmservice.ex_
                                                                                                                                                        • Path C:\Program Files (x86)\PremierOpinion\pmservice.ex_
                                                                                                                                                        • Size 4.6MB
                                                                                                                                                        • SHA256 ea9e23495c05c6183cacd8f5b5811c3d2a34ded293b0cb370276d5b654bcd425
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        snt.dat.bac
                                                                                                                                                        • Path C:\Program Files (x86)\PremierOpinion\snt.dat.bac
                                                                                                                                                        • Size 3.4MB
                                                                                                                                                        • SHA256 682c0d2a0cc8671bd1e90d75333da435ca35be671afd8c695a9a162350d6b442
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        tms.bin
                                                                                                                                                        • Path C:\Program Files (x86)\PremierOpinion\tms.bin
                                                                                                                                                        • Size 8B
                                                                                                                                                        • SHA256 930a02d2c75beea734371bc243221efda3db59568879edc793e7e9905cf88fb2
                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                        Submit Download

                                                                                                                                                        24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                                                                                                                                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                                                                                                                                                        • Size 1KB
                                                                                                                                                        • SHA256 a27d247d17f54f57af8ee56bfb9feca06a46a4808d6d3b7dfc05aade687aa399
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                                                                                                                                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                                                                                                                                                        • Size 1KB
                                                                                                                                                        • SHA256 d7509212b220527a51fbc317cf18e2e8fba43617caa6bcb5f4dba30c8e53487a
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                                                                                                                                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                                                                                                                                                        • Size 410B
                                                                                                                                                        • SHA256 4f55466fce9efccf6881543aff0e3dac59bc10f89c98443054ee45350b2e52ad
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        3538626A1FCCCA43C7E18F220BDD9B02
                                                                                                                                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3538626A1FCCCA43C7E18F220BDD9B02
                                                                                                                                                        • Size 330B
                                                                                                                                                        • SHA256 91544aa88fc24d7e495c35cadd0e3ed20e4b2ccd78aee4452554def355a4970a
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                                                                                                                                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                                                                                                                                                        • Size 482B
                                                                                                                                                        • SHA256 9afceeb5b30d4ef1c2aea4c71026c9723d4987ac31c60fd99b0d8952775ad714
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        blocklist
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                                                                                                        • Size 105KB
                                                                                                                                                        • SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        protocols.json
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
                                                                                                                                                        • Size 3KB
                                                                                                                                                        • SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        autofill_bypass_cache_forms.json
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
                                                                                                                                                        • Size 161B
                                                                                                                                                        • SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        edge_autofill_global_block_list.json
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
                                                                                                                                                        • Size 6KB
                                                                                                                                                        • SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        v1FieldTypes.json
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
                                                                                                                                                        • Size 509KB
                                                                                                                                                        • SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        settings.dat
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                        • Size 280B
                                                                                                                                                        • SHA256 5116dd98c2b23ba5b09db7653ab553aa29b175fa64b8b9ed64ecd21beb5831c6
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        settings.dat
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                        • Size 280B
                                                                                                                                                        • SHA256 e8c11bffd04a845e6747271563ae4a847b510ffe734f41902fbd4b2f062eee45
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        LOG.old
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                                                                        • Size 352B
                                                                                                                                                        • SHA256 816aa98c55b4939265e603af9bb3890010f75dc66fb68f1327d6d433b4fffc08
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        MANIFEST-000001
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
                                                                                                                                                        • Size 158B
                                                                                                                                                        • SHA256 f803625f7089762ff6faeb3ece82729aca5f5a8ea6348ac385095f4ef1109a96
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        BookmarkMergedSurfaceOrdering
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                                                        • Size 6B
                                                                                                                                                        • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                        Submit Download

                                                                                                                                                        the-real-index
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                        • Size 5KB
                                                                                                                                                        • SHA256 4de6f65ddfe79e362dc0b85c1983f87ba36ead73d8a5e2aa14ca07e01118bab9
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        the-real-index
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                        • Size 11KB
                                                                                                                                                        • SHA256 fe3a69aafaf435beb13ff11142c489c774ea0f5b40ac2fba48f1bb9cdae6e5ba
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        the-real-index~RFe5b9aa6.TMP
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5b9aa6.TMP
                                                                                                                                                        • Size 3KB
                                                                                                                                                        • SHA256 d35afe2e90c86b45e2af7030f0a92d0efa5b30a7930d46abb9ea5a6c6cb4918f
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        SiteList-Enterprise.json
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                                        • Size 2B
                                                                                                                                                        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                        Submit Download

                                                                                                                                                        Edge Profile.ico
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                                                        • Size 70KB
                                                                                                                                                        • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        HubApps
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                                                                                                        • Size 106KB
                                                                                                                                                        • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Network Persistent State
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                        • Size 3KB
                                                                                                                                                        • SHA256 3438cce32c6559ca51d985501a6f382392340bd1abda1d89c4a489125bca931f
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Network Persistent State
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                        • Size 2KB
                                                                                                                                                        • SHA256 e104942606582aa5636d39d454f881d0f945b36cc1b638d29f740201aed0c2be
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Network Persistent State
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                        • Size 2KB
                                                                                                                                                        • SHA256 beb75041f21b4d78b7d8672ff93beb09dd30c6315d6ce6a4cbfe3a975045996f
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Network Persistent State
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                        • Size 111B
                                                                                                                                                        • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        SCT Auditing Pending Reports
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                        • Size 2B
                                                                                                                                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                        Submit Download

                                                                                                                                                        Preferences
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                        • Size 14KB
                                                                                                                                                        • SHA256 3950c74c47ddeba2124c5a87bf64a59cae4aa72efdcd2eef28f678f831132b97
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Preferences
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                        • Size 15KB
                                                                                                                                                        • SHA256 e901e08eec64b482b179f53a67cf23a1e1d075c38b4a12efd970546acaaa42e1
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Preferences
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                        • Size 15KB
                                                                                                                                                        • SHA256 ffaf0e76939c3330f8bb156a0cca13ca0f3cabf6bba8ff7b712cea1e48034111
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Preferences
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                        • Size 16KB
                                                                                                                                                        • SHA256 0a7e7c7b301c1c3aaf97f3e3b0918b18e4e18c155833ba066cf99df22d5b8279
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Preferences
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                        • Size 16KB
                                                                                                                                                        • SHA256 8f673ed83384ff480bc11b69c00a6fe2af56dc5683614f640ed081b28160b6f9
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Preferences
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                        • Size 16KB
                                                                                                                                                        • SHA256 9b85b5fb9404c49a55a7bb1d93e77753382835719679246c3128bfa761190eec
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Secure Preferences
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                        • Size 31KB
                                                                                                                                                        • SHA256 ab1bdf19ff30adbd1a2a30baa5f1f16731bc75de94be8e05a7ac0b7b5662bf4f
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        the-real-index
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1927bbd8-f4f8-4811-b807-9378a5e80acf\index-dir\the-real-index
                                                                                                                                                        • Size 3KB
                                                                                                                                                        • SHA256 cbc3eaca2c17841fa203332cde4d4d3e7e6360826c7c1ae3da99caf040adcc06
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        the-real-index
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1927bbd8-f4f8-4811-b807-9378a5e80acf\index-dir\the-real-index
                                                                                                                                                        • Size 1KB
                                                                                                                                                        • SHA256 ff5738ecce225b858581bb8255009738bd97b4ad2e493f5f5e0f12049a375aa7
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        the-real-index~RFe5b21fc.TMP
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1927bbd8-f4f8-4811-b807-9378a5e80acf\index-dir\the-real-index~RFe5b21fc.TMP
                                                                                                                                                        • Size 1KB
                                                                                                                                                        • SHA256 5de07b28b2fb17e7d17f9a6bda6a15de36c55dcd717f3abe00d30a9febfaf482
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        the-real-index
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\35e883e0-6cb0-4875-9f9c-0a8beb1a83a9\index-dir\the-real-index
                                                                                                                                                        • Size 72B
                                                                                                                                                        • SHA256 e63181a7e85758d3a5e6a090717c32179baf86d93c59eafebb90a6ba484e94de
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        the-real-index
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\35e883e0-6cb0-4875-9f9c-0a8beb1a83a9\index-dir\the-real-index
                                                                                                                                                        • Size 72B
                                                                                                                                                        • SHA256 1a33b62ef5ff0ced51acf32197ceb208f795dd643a23a87a2eba15c5877b3cd9
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        index.txt
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                                                                        • Size 371B
                                                                                                                                                        • SHA256 22e4c3c37f4dbb01b79648f4766785ad825e8ef89ac75ef9d48d661e721c6e51
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        index.txt
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
                                                                                                                                                        • Size 226B
                                                                                                                                                        • SHA256 3a0b0800bce20145876c3ad4bb2a23abd49faeab97bf147d3a67df1d8d128b1e
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        index.txt
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
                                                                                                                                                        • Size 233B
                                                                                                                                                        • SHA256 0269e6c53529aac5e6e53d549a237b87ea67e5580067eafd01af2999b0cc9b5d
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        index.txt~RFe5c6d38.TMP
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5c6d38.TMP
                                                                                                                                                        • Size 138B
                                                                                                                                                        • SHA256 520e5eb80f05069ecad4e8f9cf6262ef7ec25af8351a64c1d2adad4c942bc51e
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        the-real-index
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                                        • Size 72B
                                                                                                                                                        • SHA256 696481d5d8262a1f71f2c172f3c6f1106f6dbd4b62a3c380d15275056624d231
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        the-real-index~RFe5b78a7.TMP
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5b78a7.TMP
                                                                                                                                                        • Size 48B
                                                                                                                                                        • SHA256 fc7e9aa091bf4ce7f896e238cc1b3d8f0d27e82b138ad35be33fd6a04e8641f0
                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                        Submit Download

                                                                                                                                                        sync_diagnostic.log
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                                        • Size 4KB
                                                                                                                                                        • SHA256 fab4b12f64ddc797254f173519db8a78e968da186e90366047858e924dad42ba
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        domain_actions.dll
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions.dll
                                                                                                                                                        • Size 83KB
                                                                                                                                                        • SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        office_endpoints_list.json
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
                                                                                                                                                        • Size 9KB
                                                                                                                                                        • SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Local State
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                        • Size 16KB
                                                                                                                                                        • SHA256 f919ecfb246c3b3e1c0f8ae6ea9fc961cfdb1f9d7b5010a6fa452697dd00f063
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Local State
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                        • Size 25KB
                                                                                                                                                        • SHA256 ea03c366e707a925d5bf224bb639d769257a396741df971e11c5891a06f60561
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Local State
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                        • Size 22KB
                                                                                                                                                        • SHA256 10f50035edb263f4733e61080d1664f891335582b17d75523a73b48599829e76
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Local State
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                        • Size 21KB
                                                                                                                                                        • SHA256 f7010e367ee3d9314b9a0bb4f049adbf951e4ebfc04d94db862053baf60f150c
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Local State
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                        • Size 21KB
                                                                                                                                                        • SHA256 2a38d7e59fd00fb6d640f4d0c2ed25934008d1ac1a5105f2febc1e21f3083a62
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Local State
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                        • Size 21KB
                                                                                                                                                        • SHA256 7b6f421070cfc4885b7a46838017525a34e342c53961d7870315a58abcc02437
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Local State
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                        • Size 25KB
                                                                                                                                                        • SHA256 e0f5c9da2d97575f4b51f118ab5b0180c0c83f8b0ddc5b26139cb9337e113bfd
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Local State
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                        • Size 8KB
                                                                                                                                                        • SHA256 b18dd13d4c3da8ec00b85312f31c65c446a33167a5c4f4b3e330d738c202919d
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Local State
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                        • Size 16KB
                                                                                                                                                        • SHA256 66c16f61c4279dcd3ef42c92f32ca0cc33d13d31d44ddc3d40e55b8fe106dafb
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Local State
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                        • Size 8KB
                                                                                                                                                        • SHA256 5de5f907945c2b152374911b90eefbe131d857e0ffbf6e915d2429e8ae8078cb
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Local State
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                        • Size 12KB
                                                                                                                                                        • SHA256 a3201df52e1a2b92813e601a8f3ca06813401efceac2a1215ddfbc2e9edbabbc
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        nav_config.json
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
                                                                                                                                                        • Size 2KB
                                                                                                                                                        • SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        metadata.json
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                        • Size 1KB
                                                                                                                                                        • SHA256 7ae3abeff1a7ac2b396b3e38dc9d2900c37a4fa3623cd6a74cdc34b502978149
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        metadata.json
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                        • Size 1KB
                                                                                                                                                        • SHA256 21075672ed04fcc0ad86c96036a015a0479bc539f9eb22ed2ee07d5f51ed51d5
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        metadata.json
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                        • Size 1KB
                                                                                                                                                        • SHA256 757c40068c8b44526fedddbae76f4ef49d46e6f99e9c5b6ac7daee04f31c52bc
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        metadata.json
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                        • Size 972B
                                                                                                                                                        • SHA256 590065152acec5cf42dffc28eb04749514feaa899eb2ae04edce7d38a148fbda
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        metadata.json
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                        • Size 372B
                                                                                                                                                        • SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        metadata.json
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                        • Size 492B
                                                                                                                                                        • SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        metadata.json
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                        • Size 852B
                                                                                                                                                        • SHA256 142a7cc7a4933a976aae32a9d04e1758464486092207243f09edbbad51f1d934
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        metadata.json
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                        • Size 132B
                                                                                                                                                        • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        metadata.json
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                        • Size 252B
                                                                                                                                                        • SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        metadata.json
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                        • Size 612B
                                                                                                                                                        • SHA256 98d9b184e4c7220b5aaf7ae412b0c1b3f32e3dc4933afcf852538b8082017b9e
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        metadata.json
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                        • Size 1KB
                                                                                                                                                        • SHA256 2b7c607fd6a639934c6f7311f36aa760dd4a600f84b9f8e2d066832856488091
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        metadata.json
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                        • Size 732B
                                                                                                                                                        • SHA256 a5548ca519cf47ecb420c8f1299a8a50517fa463459a704ef2ff17c4db35117a
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        af788fc6-980f-4e33-a5f0-c9e916c27740.tmp
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\af788fc6-980f-4e33-a5f0-c9e916c27740.tmp
                                                                                                                                                        • Size 13B
                                                                                                                                                        • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                        Submit Download

                                                                                                                                                        POicon[1].bin
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O53PBNRW\POicon[1].bin
                                                                                                                                                        • Size 4KB
                                                                                                                                                        • SHA256 20b0f94844860501e115fccd5c1462b2e2c932041d7989dc51c6d885b3429d8a
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        rule18[1].xml
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WZCPA0V7\rule18[1].xml
                                                                                                                                                        • Size 128B
                                                                                                                                                        • SHA256 9dfedfc7fa656ed83c4c5d9c517a694f59d6c1a40af31082d3ce011d28467591
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        AppCache134256038204616429.txt
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134256038204616429.txt
                                                                                                                                                        • Size 83KB
                                                                                                                                                        • SHA256 d649b5df3ace2458087fb9d132842331ad7c2719a5c76056545e0b755e696f35
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        73d71777-a7c9-42a7-a4a3-82aaec1f424d.tmp
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\73d71777-a7c9-42a7-a4a3-82aaec1f424d.tmp
                                                                                                                                                        • Size 1B
                                                                                                                                                        • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                        Submit Download

                                                                                                                                                        ContentI3.exe
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe
                                                                                                                                                        • Size 3.8MB
                                                                                                                                                        • SHA256 ef2734657b11113a433abb7ebac962e2bf6bf685f05c5f672997f01875430168
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        __PSScriptPolicyTest_oykx043c.2od.ps1
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oykx043c.2od.ps1
                                                                                                                                                        • Size 60B
                                                                                                                                                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        af049c7c-c0c6-44df-88e0-1323fb8b5514.tmp
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\af049c7c-c0c6-44df-88e0-1323fb8b5514.tmp
                                                                                                                                                        • Size 10KB
                                                                                                                                                        • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        50f2d75e-ed50-4ee3-9f21-b8b6e91b12c9.tmp
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2372_183877169\50f2d75e-ed50-4ee3-9f21-b8b6e91b12c9.tmp
                                                                                                                                                        • Size 147KB
                                                                                                                                                        • SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        content_new.js
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2372_1839697165\CRX_INSTALL\content_new.js
                                                                                                                                                        • Size 10KB
                                                                                                                                                        • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        pmropn.exe
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\~os1323.tmp\pmropn.exe
                                                                                                                                                        • Size 7.4MB
                                                                                                                                                        • SHA256 3351673422686d67ab91bc1301b894d26e7b105579dfaa1b6f32933516afbb52
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        pmservice.exe
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\~os4410.tmp\pmservice.exe
                                                                                                                                                        • Size 4.6MB
                                                                                                                                                        • SHA256 f76c45ac8440c5a36096d7956bdf933bfff268469d1a73573c7f001f790dafa1
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        file.txt
                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\file.txt
                                                                                                                                                        • Size 58B
                                                                                                                                                        • SHA256 a027a2109f20b951bbfec6d466d0fde6d85698b8ca5622a5c264adff3c46cdb2
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        prefs.js
                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\prefs.js
                                                                                                                                                        • Size 6KB
                                                                                                                                                        • SHA256 f32e1f36e2151b4f500531650895392f2e60a3cdcc2b90fbbac924aa41d80220
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        crl-set
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
                                                                                                                                                        • Size 22KB
                                                                                                                                                        • SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        settings.dat
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Crashpad\settings.dat
                                                                                                                                                        • Size 280B
                                                                                                                                                        • SHA256 62ed3dea56d142bf3bd5351e3adcc22d9217a4f79d5043400958388f8e9c387e
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        data_0
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_0
                                                                                                                                                        • Size 8KB
                                                                                                                                                        • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                        Submit Download

                                                                                                                                                        data_1
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_1
                                                                                                                                                        • Size 264KB
                                                                                                                                                        • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                        Submit Download

                                                                                                                                                        data_2
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_2
                                                                                                                                                        • Size 8KB
                                                                                                                                                        • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                        Submit Download

                                                                                                                                                        data_3
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_3
                                                                                                                                                        • Size 8KB
                                                                                                                                                        • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                        Submit Download

                                                                                                                                                        MANIFEST-000001
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
                                                                                                                                                        • Size 41B
                                                                                                                                                        • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                        Submit Download

                                                                                                                                                        Network Persistent State~RFe5da645.TMP
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Default\Network\Network Persistent State~RFe5da645.TMP
                                                                                                                                                        • Size 59B
                                                                                                                                                        • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Preferences
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Default\Preferences
                                                                                                                                                        • Size 6KB
                                                                                                                                                        • SHA256 fd3aaac4119622eddbcc3d105bee5f9687dd668ca322258718fd2e0f8f9e66ba
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Preferences~RFe5d1ca3.TMP
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Default\Preferences~RFe5d1ca3.TMP
                                                                                                                                                        • Size 6KB
                                                                                                                                                        • SHA256 2ae256f38d3e5fb493abbc15791ac739522a009beaa518032b846e5d816a7a19
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        index
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Default\Shared Dictionary\cache\index
                                                                                                                                                        • Size 24B
                                                                                                                                                        • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                        Submit Download

                                                                                                                                                        CURRENT
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
                                                                                                                                                        • Size 16B
                                                                                                                                                        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                        Submit Download

                                                                                                                                                        Local State
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Local State
                                                                                                                                                        • Size 18KB
                                                                                                                                                        • SHA256 c663ee8274fa6ac30dec726adb758c45cb12e4d1c65080399d4a5bdf13b67126
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Local State
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Local State
                                                                                                                                                        • Size 18KB
                                                                                                                                                        • SHA256 1ddb2722999b69bbb717cfa5a6d07eaedd2531ebd04e43e4f9568ca3211f3ae9
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Local State
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Local State
                                                                                                                                                        • Size 16KB
                                                                                                                                                        • SHA256 7e7e23222e6ef1feb5951b3a7140cdc5d93cf9e262b184f5e907f50742c7fb25
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Local State
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Local State
                                                                                                                                                        • Size 1KB
                                                                                                                                                        • SHA256 0e000a7117afd82d251b9b03be3b5e21e4d4df4bbae9e1bfac51dcf641e530c6
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Local State
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Local State
                                                                                                                                                        • Size 2KB
                                                                                                                                                        • SHA256 a70693e48ca160af098b7ebb4495b70768382aa47d5ced7b45f19b31b9284a4c
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Local State
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Local State
                                                                                                                                                        • Size 3KB
                                                                                                                                                        • SHA256 87a620a58dcb0efad55aaffb8582637d2d6bbe09298cae7b49f627c343724c49
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Local State~RFe5c7de2.TMP
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Local State~RFe5c7de2.TMP
                                                                                                                                                        • Size 1KB
                                                                                                                                                        • SHA256 c3b2494c7b03440ffbbed179821fa473d3660bd0c8ebe41a9a1db7cee48d32ea
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        crs.pb
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\PKIMetadata\46.0.0.0\crs.pb
                                                                                                                                                        • Size 233KB
                                                                                                                                                        • SHA256 c132e2ba94619caf6143b3bbdd9c32944e80cbf3bff87364175c42801afe2584
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        ct_config.pb
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\PKIMetadata\46.0.0.0\ct_config.pb
                                                                                                                                                        • Size 16KB
                                                                                                                                                        • SHA256 aaeeb46cd91a4a392223cf2885f449bf532f0878c087d50bb0cb3fc7fa873a60
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        kp_pinslist.pb
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\PKIMetadata\46.0.0.0\kp_pinslist.pb
                                                                                                                                                        • Size 10KB
                                                                                                                                                        • SHA256 b5b2a45a5b25becb901916b13752e3477d4126a42d088f29863bd8672320ecf6
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Filtering Rules
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
                                                                                                                                                        • Size 2.1MB
                                                                                                                                                        • SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        LICENSE
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.84\LICENSE
                                                                                                                                                        • Size 24KB
                                                                                                                                                        • SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Advertising
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Advertising
                                                                                                                                                        • Size 19KB
                                                                                                                                                        • SHA256 5989ccf9a58e4ffd47c2422bd8dfcb3ea4e1d412fbdec2291385a9955af9eace
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Analytics
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Analytics
                                                                                                                                                        • Size 4KB
                                                                                                                                                        • SHA256 163a5318312b814104d244a4b37b676a02f827068820aa60fc069e6346cb2b75
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        CompatExceptions
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\Mu\CompatExceptions
                                                                                                                                                        • Size 689B
                                                                                                                                                        • SHA256 5b462316a51c918d0bae95959bf827cb9c72bbd84ffb0e43b750aa91fbf3ba53
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Content
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Content
                                                                                                                                                        • Size 4KB
                                                                                                                                                        • SHA256 7869993fcb93b302598643be96c6ab94c4f3be47c9fc344959773c754291376e
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Cryptomining
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Cryptomining
                                                                                                                                                        • Size 668B
                                                                                                                                                        • SHA256 1e92781e88ee786bf6d1d5cb71d467a92fe7f281f2d1e548524bf119d7ddc700
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Entities
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Entities
                                                                                                                                                        • Size 68KB
                                                                                                                                                        • SHA256 f6e93c83d9e3cfdff064535647cee76fc85aa1c86fd22a93dcf3d2c377346d94
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Fingerprinting
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Fingerprinting
                                                                                                                                                        • Size 1KB
                                                                                                                                                        • SHA256 c7d2b05ff6e790af78b0f1f341219fdb554dc5e14fbf3e3981819fccdd1ddfed
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        LICENSE
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\Mu\LICENSE
                                                                                                                                                        • Size 34KB
                                                                                                                                                        • SHA256 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Other
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Other
                                                                                                                                                        • Size 34B
                                                                                                                                                        • SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                        Submit Download

                                                                                                                                                        Social
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Social
                                                                                                                                                        • Size 754B
                                                                                                                                                        • SHA256 4955c3e7f56641a4ae0ce9c79b4ceee4b21733b0f6dedc980bf8d822a792eba2
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        TransparentAdvertisers
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\Mu\TransparentAdvertisers
                                                                                                                                                        • Size 105B
                                                                                                                                                        • SHA256 d2cd0bef5f45daf490c53e705d6f67dfe12390c72a00efa6f5117432bd8edb8c
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Advertising
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Advertising
                                                                                                                                                        • Size 20KB
                                                                                                                                                        • SHA256 868f3ed3f86f1e82a5041f0a7b382bdd720e411531df2dc680da34eb60580b75
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Analytics
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Analytics
                                                                                                                                                        • Size 3KB
                                                                                                                                                        • SHA256 33d2b069ea874c12ec96242ca7eb539c1086d38ac6c2e4858c0efcd74fc632e5
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Content
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Content
                                                                                                                                                        • Size 5KB
                                                                                                                                                        • SHA256 d99df5936c57a50aebb7f0a3ca65fcc682f523ace93641fbcfb9b09cfb71c739
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Cryptomining
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Cryptomining
                                                                                                                                                        • Size 32B
                                                                                                                                                        • SHA256 696e930706b5d391eb8778f73b0627ffc2be7f6c9a3e7659170d9d37fc4a97b5
                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                        Submit Download

                                                                                                                                                        Entities
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Entities
                                                                                                                                                        • Size 106KB
                                                                                                                                                        • SHA256 0f305323c627cf0c790831c7e0bc38455b7a99983c4ab5bd9d2d9567766c3499
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Fingerprinting
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Fingerprinting
                                                                                                                                                        • Size 2KB
                                                                                                                                                        • SHA256 ec0fcbf71d58e707aaf6ba8d3c0719972f26727febe03f8efbf570b9635faddf
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        LICENSE
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\LICENSE
                                                                                                                                                        • Size 66B
                                                                                                                                                        • SHA256 44071e0fcffb9a9a32e8fa7010bb18dbc41afd0b176f81bf700b15b638a88a51
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Other
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Other
                                                                                                                                                        • Size 198B
                                                                                                                                                        • SHA256 c9ab8dbc87043c71dd649fc06bb006e7f62e81c973c37b125afb88e654e436f8
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Social
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Social
                                                                                                                                                        • Size 3KB
                                                                                                                                                        • SHA256 e520603e6fb543cd078b2a7dbd8ccfc175e9aecf71654fc19785927a014d3435
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        manifest.fingerprint
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\manifest.fingerprint
                                                                                                                                                        • Size 66B
                                                                                                                                                        • SHA256 f96cf59ef5cdf10cdebb367e16c6736d188af934062a8721eb9d60539556a2a9
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        keys.json
                                                                                                                                                        • Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\TrustTokenKeyCommitments\2026.3.23.1\keys.json
                                                                                                                                                        • Size 8KB
                                                                                                                                                        • SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        manifest.json
                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_1339575830\manifest.json
                                                                                                                                                        • Size 165B
                                                                                                                                                        • SHA256 daf50c160ae8f5935baa4a7207e9d04afbbc81a6dd9ed02d99de12056743eeb6
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        manifest.json
                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_1435111008\manifest.json
                                                                                                                                                        • Size 43B
                                                                                                                                                        • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                        Submit Download

                                                                                                                                                        manifest.json
                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_1479873287\manifest.json
                                                                                                                                                        • Size 85B
                                                                                                                                                        • SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        verified_contents.json
                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_1560392439\_metadata\verified_contents.json
                                                                                                                                                        • Size 1KB
                                                                                                                                                        • SHA256 c50e8b66b9c681cbc2fa16cb2d8fd7cc934df1a7863dcf4f0ebedf6a5b78638d
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        manifest.json
                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_1829827540\manifest.json
                                                                                                                                                        • Size 135B
                                                                                                                                                        • SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        manifest.json
                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_1871380213\manifest.json
                                                                                                                                                        • Size 177B
                                                                                                                                                        • SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        manifest.json
                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_2047107328\manifest.json
                                                                                                                                                        • Size 135B
                                                                                                                                                        • SHA256 cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        manifest.json
                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_567754631\manifest.json
                                                                                                                                                        • Size 238B
                                                                                                                                                        • SHA256 1bdda4a8fc3e2b965fbb52c9b23a9a34871bc345abfb332a87ea878f4472efbd
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        manifest.json
                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_758367696\manifest.json
                                                                                                                                                        • Size 119B
                                                                                                                                                        • SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        manifest.json
                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_835422375\manifest.json
                                                                                                                                                        • Size 160B
                                                                                                                                                        • SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        manifest.json
                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_902479015\manifest.json
                                                                                                                                                        • Size 165B
                                                                                                                                                        • SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        manifest.json
                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_1100918624\manifest.json
                                                                                                                                                        • Size 102B
                                                                                                                                                        • SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        LICENSE
                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_1250978879\LICENSE
                                                                                                                                                        • Size 1KB
                                                                                                                                                        • SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        manifest.json
                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_1250978879\manifest.json
                                                                                                                                                        • Size 79B
                                                                                                                                                        • SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        hyph-as.hyb
                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_1504634670\hyph-as.hyb
                                                                                                                                                        • Size 703B
                                                                                                                                                        • SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        hyph-hi.hyb
                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_1504634670\hyph-hi.hyb
                                                                                                                                                        • Size 687B
                                                                                                                                                        • SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        hyph-nb.hyb
                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_1504634670\hyph-nb.hyb
                                                                                                                                                        • Size 141KB
                                                                                                                                                        • SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        manifest.json
                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_1504634670\manifest.json
                                                                                                                                                        • Size 82B
                                                                                                                                                        • SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        manifest.json
                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_2040962919\manifest.json
                                                                                                                                                        • Size 69B
                                                                                                                                                        • SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        manifest.json
                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_2071420356\manifest.json
                                                                                                                                                        • Size 116B
                                                                                                                                                        • SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        manifest.json
                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_358359148\manifest.json
                                                                                                                                                        • Size 113B
                                                                                                                                                        • SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        manifest.json
                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_506400798\manifest.json
                                                                                                                                                        • Size 76B
                                                                                                                                                        • SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        Staging
                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_811963427\Sigma\Staging
                                                                                                                                                        • Size 36B
                                                                                                                                                        • SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                        Submit Download

                                                                                                                                                        manifest.json
                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_811963427\manifest.json
                                                                                                                                                        • Size 132B
                                                                                                                                                        • SHA256 68683970ce6d7de9a2043c34129106ae68af21a3b0a3c53cb59695640a7c1cbc
                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                        Submit Download

                                                                                                                                                        memory/848-246-0x0000000076CD0000-0x0000000076F22000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/848-248-0x0000000077050000-0x00000000770B4000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/848-249-0x0000000074900000-0x0000000074D85000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/848-247-0x0000000075380000-0x0000000075982000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/848-250-0x0000000073CB0000-0x0000000073D00000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/848-251-0x0000000073D00000-0x0000000073DD5000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/848-252-0x00000000745E0000-0x0000000074605000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/1936-238-0x0000000076CD0000-0x0000000076F22000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/1936-1596-0x0000000074900000-0x0000000074D85000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/1936-2680-0x0000000075380000-0x0000000075982000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/1936-239-0x0000000075380000-0x0000000075982000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/1936-244-0x0000000073CB0000-0x0000000073D00000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/1936-243-0x0000000073D00000-0x0000000073DD5000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/1936-240-0x0000000074900000-0x0000000074D85000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/1936-242-0x0000000077050000-0x00000000770B4000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/1936-241-0x00000000745E0000-0x0000000074605000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/1936-1715-0x0000000073D00000-0x0000000073DD5000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/1936-1525-0x0000000074900000-0x0000000074D85000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/2352-3395-0x0000000006C40000-0x0000000006C8C000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/2352-3397-0x000000006DD00000-0x000000006DD4C000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/2352-3404-0x0000000007D80000-0x0000000007D9E000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/2352-3405-0x0000000007DF0000-0x0000000007E94000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/2352-3406-0x00000000085C0000-0x0000000008C3A000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/2352-3407-0x0000000007F70000-0x0000000007F8A000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/2352-3411-0x0000000007FF0000-0x000000000800C000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/2352-3417-0x0000000007D90000-0x0000000007D9A000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/2352-3418-0x00000000081E0000-0x0000000008206000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/2352-3396-0x0000000007DA0000-0x0000000007DD4000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/2352-3394-0x0000000006C10000-0x0000000006C2E000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/2352-3377-0x0000000006780000-0x0000000006AD7000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/2352-3375-0x0000000005E10000-0x0000000005E76000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/2352-3376-0x0000000005F30000-0x0000000005F96000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/2352-3374-0x0000000005D70000-0x0000000005D92000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/2352-3365-0x0000000005FD0000-0x00000000065FA000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/2352-3364-0x0000000005890000-0x00000000058C6000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/2772-2161-0x00007FFF47070000-0x00007FFF47071000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/4300-1519-0x00007FFF3F250000-0x00007FFF3F35C000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/4300-1918-0x000001EDEA900000-0x000001EDEA938000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/4300-1845-0x000001EDE9680000-0x000001EDE972C000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/4300-1843-0x0000000000280000-0x0000000000F5E000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/4300-1846-0x000001EDD0AB0000-0x000001EDD0ACA000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/4300-1839-0x0000000000280000-0x0000000000F5E000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/4300-1847-0x000001EDD0FD0000-0x000001EDD0FE8000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/4300-1848-0x000001EDE97F0000-0x000001EDE98A4000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/4300-2036-0x000001EDEAAC0000-0x000001EDEAAC8000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/4300-1965-0x0000000000280000-0x0000000000F5E000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/4300-2997-0x00007FFF46FB0000-0x00007FFF4706D000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/4300-1844-0x0000000000280000-0x0000000000F5E000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/4300-1921-0x000001EDEAB30000-0x000001EDEACB8000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/4300-1521-0x0000020444500000-0x00000204445AF000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/4300-1920-0x000001EDEA970000-0x000001EDEA992000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/4300-1919-0x000001EDEA8D0000-0x000001EDEA8DE000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/4300-1917-0x000001EDE9C60000-0x000001EDE9C68000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/4300-1915-0x000001EDE9CA0000-0x000001EDE9D38000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/4300-1557-0x00007FFF45790000-0x00007FFF45B04000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/4300-1513-0x00007FFF45790000-0x00007FFF45B04000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/4300-1512-0x00007FFF46FB0000-0x00007FFF4706D000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/4300-1516-0x00007FFF46D10000-0x00007FFF46D7F000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/4300-1514-0x00007FFF47530000-0x00007FFF47CDE000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/4300-1515-0x000002043F050000-0x000002043F271000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/4300-1517-0x00007FFF32F70000-0x00007FFF3346A000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/4300-1518-0x00007FFF449C0000-0x00007FFF44A27000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/4300-1520-0x00007FFF447B0000-0x00007FFF447F2000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/4640-158-0x00007FFF47530000-0x00007FFF47CDE000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/4640-151-0x00007FFF46D10000-0x00007FFF46D7F000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/4640-144-0x00007FFF46FB0000-0x00007FFF4706D000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/4640-157-0x00007FFF447B0000-0x00007FFF447F2000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/4640-154-0x00007FFF3F250000-0x00007FFF3F35C000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/4640-153-0x00007FFF449C0000-0x00007FFF44A27000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/4640-152-0x00007FFF32F70000-0x00007FFF3346A000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/4640-150-0x00007FFF45790000-0x00007FFF45B04000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/5280-1898-0x00007FFF46D10000-0x00007FFF46D7F000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/5280-1902-0x00007FFF447B0000-0x00007FFF447F2000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/5280-1896-0x00007FFF46FB0000-0x00007FFF4706D000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/5280-1897-0x00007FFF45790000-0x00007FFF45B04000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/5280-1901-0x00007FFF3F250000-0x00007FFF3F35C000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/5280-1900-0x00007FFF449C0000-0x00007FFF44A27000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/5280-1903-0x00007FFF47530000-0x00007FFF47CDE000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/5280-1899-0x00007FFF32F70000-0x00007FFF3346A000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/5652-2470-0x00007FFF46FB0000-0x00007FFF4706D000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/5652-2471-0x00007FFF45790000-0x00007FFF45B04000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/5652-2472-0x00007FFF46D10000-0x00007FFF46D7F000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/5652-2473-0x00007FFF47530000-0x00007FFF47CDE000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/5652-2474-0x00007FFF3F250000-0x00007FFF3F35C000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/5652-2475-0x00007FFF32F70000-0x00007FFF3346A000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/5652-2476-0x00007FFF449C0000-0x00007FFF44A27000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/5652-2477-0x00007FFF447B0000-0x00007FFF447F2000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/5688-1673-0x00007FFF32F70000-0x00007FFF3346A000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/5688-1676-0x00007FFF447B0000-0x00007FFF447F2000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/5688-1675-0x00007FFF3F250000-0x00007FFF3F35C000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/5688-1674-0x00007FFF449C0000-0x00007FFF44A27000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/5688-1671-0x00007FFF47530000-0x00007FFF47CDE000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/5688-1672-0x00007FFF46D10000-0x00007FFF46D7F000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/5688-1670-0x00007FFF45790000-0x00007FFF45B04000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/5688-1669-0x00007FFF46FB0000-0x00007FFF4706D000-memory.dmp
                                                                                                                                                        Download

                                                                                                                                                        memory/6076-2060-0x00007FFF47070000-0x00007FFF47071000-memory.dmp
                                                                                                                                                        Download