Overview

overview

10

Static

static

1

URLScan

urlscan

1

https://cdn.discorda...

windows11-ltsc_2024-x64

10

Resubmissions

23/06/2026, 16:39

260623-t6cj3aev2110

23/06/2026, 16:34

260623-t244hset8w5

Analysis

  • user interaction
    yes
  • max time kernel
    1200s
  • max time network
    1201s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/06/2026, 16:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://cdn.discordapp.com/attachments/1483058203054051398/1518804628031017121/MaxeysVisuals_2.6.zip?ex=6a3be949&is=6a3a97c9&hm=c2cc2dc89a409e2534512837c7756c0399cfda4321c015828c5b67038982b442&
  • Sample260623-t6cj3aev21
Score
10/10
adwaredefense_evasiondiscoveryexecutionpersistenceransomwarespywaretrojan

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Downloads MZ/PE file 2 IoCs
  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 43 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    defense_evasiontrojan
  • Drops desktop.ini file(s) 3 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in System32 directory 10 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Launches sc.exe 6 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 39 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 17 IoCs
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 53 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    defense_evasionspywaretrojan
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 5 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 29 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3488
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1483058203054051398/1518804628031017121/MaxeysVisuals_2.6.zip?ex=6a3be949&is=6a3a97c9&hm=c2cc2dc89a409e2534512837c7756c0399cfda4321c015828c5b67038982b442&
        2⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:5004
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x27c,0x7ff92962c188,0x7ff92962c194,0x7ff92962c1a0
          3⤵
            PID:4400
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1812,i,18246438079663243487,6021251626314597244,262144 --field-trial-handle=2460,i,1793553083760120945,14272304206234789445,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
            3⤵
              PID:1736
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2044,i,4977751513225260728,7556150535863000097,524288 --field-trial-handle=2460,i,1793553083760120945,14272304206234789445,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:11
              3⤵
              • Downloads MZ/PE file
              • System Time Discovery
              PID:3560
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2328,i,1761638026939308127,1039422831900756299,524288 --field-trial-handle=2460,i,1793553083760120945,14272304206234789445,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:13
              3⤵
                PID:3496
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3612,i,16609886935850655649,1648866272832115306,2097152 --field-trial-handle=2460,i,1793553083760120945,14272304206234789445,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
                3⤵
                  PID:5748
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3616,i,7764766646979900286,11008362747788304855,2097152 --field-trial-handle=2460,i,1793553083760120945,14272304206234789445,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
                  3⤵
                    PID:2556
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4348,i,16539253112040426094,9879026548645262964,2097152 --field-trial-handle=2460,i,1793553083760120945,14272304206234789445,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
                    3⤵
                      PID:1788
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4360,i,512733404951893932,4297865362267568110,2097152 --field-trial-handle=2460,i,1793553083760120945,14272304206234789445,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:9
                      3⤵
                        PID:1912
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,2364727898978145397,14642624715205232254,524288 --field-trial-handle=2460,i,1793553083760120945,14272304206234789445,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
                        3⤵
                          PID:260
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,8873947867816564881,5191485362956020438,524288 --field-trial-handle=2460,i,1793553083760120945,14272304206234789445,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
                          3⤵
                            PID:3420
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,7110327940205079827,6841452482930395869,524288 --field-trial-handle=2460,i,1793553083760120945,14272304206234789445,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
                            3⤵
                              PID:2572
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5748,i,8222250785003522162,2593664654068146415,2097152 --field-trial-handle=2460,i,1793553083760120945,14272304206234789445,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:1
                              3⤵
                                PID:5896
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,9312379612532733613,17299913432512948102,524288 --field-trial-handle=2460,i,1793553083760120945,14272304206234789445,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
                                3⤵
                                  PID:576
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,9312379612532733613,17299913432512948102,524288 --field-trial-handle=2460,i,1793553083760120945,14272304206234789445,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
                                  3⤵
                                    PID:2068
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,14180815926339569254,14631417460547845075,524288 --field-trial-handle=2460,i,1793553083760120945,14272304206234789445,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14
                                    3⤵
                                      PID:6000
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7244,i,2094695527735292910,17720997373962523674,524288 --field-trial-handle=2460,i,1793553083760120945,14272304206234789445,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
                                      3⤵
                                        PID:5752
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4344,i,17961045828722904229,15572348602025006178,2097152 --field-trial-handle=2460,i,1793553083760120945,14272304206234789445,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:1
                                        3⤵
                                          PID:2972
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3840,i,15109205416836267280,7789840765543155797,2097152 --field-trial-handle=2460,i,1793553083760120945,14272304206234789445,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:1
                                          3⤵
                                            PID:3460
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7364,i,15279724488263040639,15147289004480125967,2097152 --field-trial-handle=2460,i,1793553083760120945,14272304206234789445,262144 --variations-seed-version --mojo-platform-channel-handle=7496 /prefetch:1
                                            3⤵
                                              PID:5768
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7564,i,7895249199145833178,607946727870157143,2097152 --field-trial-handle=2460,i,1793553083760120945,14272304206234789445,262144 --variations-seed-version --mojo-platform-channel-handle=7676 /prefetch:1
                                              3⤵
                                                PID:1596
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4532,i,6882738247710542560,13064075650763900223,2097152 --field-trial-handle=2460,i,1793553083760120945,14272304206234789445,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:1
                                                3⤵
                                                  PID:568
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7956,i,14434878631976180684,38959181048010735,524288 --field-trial-handle=2460,i,1793553083760120945,14272304206234789445,262144 --variations-seed-version --mojo-platform-channel-handle=7496 /prefetch:14
                                                  3⤵
                                                    PID:1800
                                                  • C:\Users\Admin\Downloads\Portmaster_2.1.19_x64-setup.exe
                                                    "C:\Users\Admin\Downloads\Portmaster_2.1.19_x64-setup.exe"
                                                    3⤵
                                                    • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Adds Run key to start application
                                                    • Drops file in Program Files directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:3608
                                                  • C:\Users\Admin\Downloads\Portmaster_2.1.19_x64-setup.exe
                                                    "C:\Users\Admin\Downloads\Portmaster_2.1.19_x64-setup.exe"
                                                    3⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • System Location Discovery: System Language Discovery
                                                    PID:4572
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,485441771287149408,10265529771144024214,524288 --field-trial-handle=2460,i,1793553083760120945,14272304206234789445,262144 --variations-seed-version --mojo-platform-channel-handle=7928 /prefetch:14
                                                    3⤵
                                                      PID:2188
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7868,i,3896900473319521217,2598849782684750286,524288 --field-trial-handle=2460,i,1793553083760120945,14272304206234789445,262144 --variations-seed-version --mojo-platform-channel-handle=7904 /prefetch:14
                                                      3⤵
                                                        PID:5972
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7844,i,6312828005635323583,17894165557191446303,524288 --field-trial-handle=2460,i,1793553083760120945,14272304206234789445,262144 --variations-seed-version --mojo-platform-channel-handle=8136 /prefetch:14
                                                        3⤵
                                                          PID:5528
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,6733158788185420666,2979288386074021244,524288 --field-trial-handle=2460,i,1793553083760120945,14272304206234789445,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
                                                          3⤵
                                                            PID:1100
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6968,i,274228959997745574,16166840533614285061,262144 --field-trial-handle=2460,i,1793553083760120945,14272304206234789445,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:10
                                                            3⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:6752
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7056,i,12293938800872558842,9210426848431422169,524288 --field-trial-handle=2460,i,1793553083760120945,14272304206234789445,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
                                                            3⤵
                                                              PID:1212
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7968,i,11992820735090400020,5636779708916767579,524288 --field-trial-handle=2460,i,1793553083760120945,14272304206234789445,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
                                                              3⤵
                                                                PID:4992
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,17112002942157357905,9885336425953521193,524288 --field-trial-handle=2460,i,1793553083760120945,14272304206234789445,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
                                                                3⤵
                                                                  PID:2448
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=5368,i,2257291087596847519,4625698255159521934,2097152 --field-trial-handle=2460,i,1793553083760120945,14272304206234789445,262144 --variations-seed-version --mojo-platform-channel-handle=8172 /prefetch:1
                                                                  3⤵
                                                                    PID:6756
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8036,i,8529039412114643992,8714459675289902796,524288 --field-trial-handle=2460,i,1793553083760120945,14272304206234789445,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:14
                                                                    3⤵
                                                                      PID:1296
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7608,i,15271656182664118977,2026244866045969651,524288 --field-trial-handle=2460,i,1793553083760120945,14272304206234789445,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:14
                                                                      3⤵
                                                                        PID:6224
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
                                                                        3⤵
                                                                        • Drops file in Windows directory
                                                                        • Enumerates system info in registry
                                                                        • Modifies registry class
                                                                        PID:6060
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x264,0x268,0x234,0x288,0x7ff92962c188,0x7ff92962c194,0x7ff92962c1a0
                                                                          4⤵
                                                                            PID:6928
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1640,i,1454371667765312329,4446828723093957968,524288 --field-trial-handle=2516,i,6261643236687774192,17298196789994900252,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:11
                                                                            4⤵
                                                                            • System Time Discovery
                                                                            PID:852
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2216,i,3347205848317767332,17407246568658463691,524288 --field-trial-handle=2516,i,6261643236687774192,17298196789994900252,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:13
                                                                            4⤵
                                                                              PID:5240
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1508,i,17026683000835140049,7537448296424638729,262144 --field-trial-handle=2516,i,6261643236687774192,17298196789994900252,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:2
                                                                              4⤵
                                                                                PID:4252
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4076,i,10415902868143273841,13820518172895488652,524288 --field-trial-handle=2516,i,6261643236687774192,17298196789994900252,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:14
                                                                                4⤵
                                                                                  PID:5828
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4076,i,12987646474240072276,9692455485263630707,524288 --field-trial-handle=2516,i,6261643236687774192,17298196789994900252,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:14
                                                                                  4⤵
                                                                                    PID:1244
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4076,i,12987646474240072276,9692455485263630707,524288 --field-trial-handle=2516,i,6261643236687774192,17298196789994900252,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:14
                                                                                    4⤵
                                                                                      PID:3976
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4780,i,235587987695183236,7173926706453032629,524288 --field-trial-handle=2516,i,6261643236687774192,17298196789994900252,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:14
                                                                                      4⤵
                                                                                        PID:1292
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,8977031707861700039,397226590277356354,524288 --field-trial-handle=2516,i,6261643236687774192,17298196789994900252,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
                                                                                        4⤵
                                                                                          PID:7068
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,13111924696400226267,8433849410613496929,524288 --field-trial-handle=2516,i,6261643236687774192,17298196789994900252,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
                                                                                          4⤵
                                                                                            PID:2244
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,14228355404549757977,7599512523711509543,524288 --field-trial-handle=2516,i,6261643236687774192,17298196789994900252,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
                                                                                            4⤵
                                                                                              PID:5924
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,14267600226331993571,14097940055152218869,524288 --field-trial-handle=2516,i,6261643236687774192,17298196789994900252,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
                                                                                              4⤵
                                                                                                PID:4460
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4584,i,14985067716290752881,14401494236555263083,524288 --field-trial-handle=2516,i,6261643236687774192,17298196789994900252,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:14
                                                                                                4⤵
                                                                                                  PID:5424
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,13718035287204893509,14241072960740673665,524288 --field-trial-handle=2516,i,6261643236687774192,17298196789994900252,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:14
                                                                                                  4⤵
                                                                                                    PID:4412
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,16325013840330643848,18437765035092153524,524288 --field-trial-handle=2516,i,6261643236687774192,17298196789994900252,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
                                                                                                    4⤵
                                                                                                      PID:1912
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,2609795751645844972,4245838468903209620,524288 --field-trial-handle=2516,i,6261643236687774192,17298196789994900252,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:14
                                                                                                      4⤵
                                                                                                        PID:4972
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,10658601005482767761,17032446825353346017,524288 --field-trial-handle=2516,i,6261643236687774192,17298196789994900252,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
                                                                                                        4⤵
                                                                                                          PID:4808
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=816,i,6078669379312313228,740061375571287491,524288 --field-trial-handle=2516,i,6261643236687774192,17298196789994900252,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:14
                                                                                                          4⤵
                                                                                                            PID:5168
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4912,i,14124107884009073368,12828954899486180444,262144 --field-trial-handle=2516,i,6261643236687774192,17298196789994900252,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:10
                                                                                                            4⤵
                                                                                                              PID:6848
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,11328925579904383689,7116959490694864805,524288 --field-trial-handle=2516,i,6261643236687774192,17298196789994900252,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:14
                                                                                                              4⤵
                                                                                                                PID:3116
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4612,i,631906048713047425,9407037609786713612,524288 --field-trial-handle=2516,i,6261643236687774192,17298196789994900252,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:14
                                                                                                                4⤵
                                                                                                                  PID:6852
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,2364597863589622382,17493991901330183005,524288 --field-trial-handle=2516,i,6261643236687774192,17298196789994900252,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:14
                                                                                                                  4⤵
                                                                                                                    PID:4212
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3964,i,16149670935709649367,11002361576645702468,524288 --field-trial-handle=2516,i,6261643236687774192,17298196789994900252,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
                                                                                                                    4⤵
                                                                                                                      PID:5576
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,12111885915111595349,12301916465787106475,524288 --field-trial-handle=2516,i,6261643236687774192,17298196789994900252,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:14
                                                                                                                      4⤵
                                                                                                                        PID:7340
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,13832236333711025051,3695312638170925598,524288 --field-trial-handle=2516,i,6261643236687774192,17298196789994900252,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:14
                                                                                                                        4⤵
                                                                                                                          PID:7500
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2864,i,16063923084648603269,6965025425557230159,524288 --field-trial-handle=2516,i,6261643236687774192,17298196789994900252,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:14
                                                                                                                          4⤵
                                                                                                                            PID:3412
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4644,i,14069418785282978733,16044181362628175868,524288 --field-trial-handle=2516,i,6261643236687774192,17298196789994900252,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:14
                                                                                                                            4⤵
                                                                                                                              PID:5840
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,11705326649882647435,39297635490050076,524288 --field-trial-handle=2516,i,6261643236687774192,17298196789994900252,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:14
                                                                                                                              4⤵
                                                                                                                                PID:2240
                                                                                                                          • C:\Program Files\Portmaster\portmaster.exe
                                                                                                                            "C:\Program Files\Portmaster\portmaster.exe"
                                                                                                                            2⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Loads dropped DLL
                                                                                                                            PID:796
                                                                                                                          • C:\Users\Admin\Downloads\MaxeysVisuals_2.6\mvbetatest\NewInjector.exe
                                                                                                                            "C:\Users\Admin\Downloads\MaxeysVisuals_2.6\mvbetatest\NewInjector.exe"
                                                                                                                            2⤵
                                                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                            PID:6560
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c pause
                                                                                                                              3⤵
                                                                                                                                PID:6664
                                                                                                                            • C:\Users\Admin\Downloads\MaxeysVisuals_2.6\mvbetatest\newoverlay.exe
                                                                                                                              "C:\Users\Admin\Downloads\MaxeysVisuals_2.6\mvbetatest\newoverlay.exe"
                                                                                                                              2⤵
                                                                                                                              • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                              PID:6784
                                                                                                                            • C:\Users\Admin\Downloads\Portmaster_2.1.19_x64-setup.exe
                                                                                                                              "C:\Users\Admin\Downloads\Portmaster_2.1.19_x64-setup.exe"
                                                                                                                              2⤵
                                                                                                                              • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Loads dropped DLL
                                                                                                                              • Adds Run key to start application
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:6080
                                                                                                                            • C:\Program Files\Portmaster\portmaster.exe
                                                                                                                              "C:\Program Files\Portmaster\portmaster.exe"
                                                                                                                              2⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Loads dropped DLL
                                                                                                                              • Checks whether UAC is enabled
                                                                                                                              PID:5600
                                                                                                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=portmaster.exe --webview-exe-version=2.1.19 --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz,RemoveRedirectionBitmap --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5600.1116.18229442327247043168 /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c
                                                                                                                                3⤵
                                                                                                                                • Drops file in Windows directory
                                                                                                                                • Enumerates system info in registry
                                                                                                                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                PID:3292
                                                                                                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView /prefetch:4 /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x114,0x19c,0x7ff922bb5fd8,0x7ff922bb5fe4,0x7ff922bb5ff0
                                                                                                                                  4⤵
                                                                                                                                    PID:5888
                                                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.1.19 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2212 --field-trial-handle=2216,i,10634441143871067930,7183194446749960432,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c
                                                                                                                                    4⤵
                                                                                                                                      PID:6960
                                                                                                                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.1.19 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2680 --field-trial-handle=2216,i,10634441143871067930,7183194446749960432,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c
                                                                                                                                      4⤵
                                                                                                                                        PID:5528
                                                                                                                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.1.19 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3056 --field-trial-handle=2216,i,10634441143871067930,7183194446749960432,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c
                                                                                                                                        4⤵
                                                                                                                                          PID:5060
                                                                                                                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.1.19 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3452 --field-trial-handle=2216,i,10634441143871067930,7183194446749960432,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c /prefetch:1
                                                                                                                                          4⤵
                                                                                                                                            PID:3164
                                                                                                                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.1.19 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4448 --field-trial-handle=2216,i,10634441143871067930,7183194446749960432,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c /prefetch:1
                                                                                                                                            4⤵
                                                                                                                                              PID:6756
                                                                                                                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.1.19 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3588 --field-trial-handle=2216,i,10634441143871067930,7183194446749960432,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c
                                                                                                                                              4⤵
                                                                                                                                                PID:3096
                                                                                                                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.1.19 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3540 --field-trial-handle=2216,i,10634441143871067930,7183194446749960432,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c
                                                                                                                                                4⤵
                                                                                                                                                  PID:6724
                                                                                                                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.1.19 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4748 --field-trial-handle=2216,i,10634441143871067930,7183194446749960432,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c
                                                                                                                                                  4⤵
                                                                                                                                                    PID:5088
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.1.19 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3448 --field-trial-handle=2216,i,10634441143871067930,7183194446749960432,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c
                                                                                                                                                    4⤵
                                                                                                                                                      PID:2072
                                                                                                                                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                                                                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.1.19 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3416 --field-trial-handle=2216,i,10634441143871067930,7183194446749960432,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c
                                                                                                                                                      4⤵
                                                                                                                                                        PID:1208
                                                                                                                                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                                                                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.1.19 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3596 --field-trial-handle=2216,i,10634441143871067930,7183194446749960432,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c
                                                                                                                                                        4⤵
                                                                                                                                                          PID:5508
                                                                                                                                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                                                                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.1.19 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4792 --field-trial-handle=2216,i,10634441143871067930,7183194446749960432,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c
                                                                                                                                                          4⤵
                                                                                                                                                            PID:3116
                                                                                                                                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                                                                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.1.19 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4772 --field-trial-handle=2216,i,10634441143871067930,7183194446749960432,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c
                                                                                                                                                            4⤵
                                                                                                                                                              PID:7452
                                                                                                                                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                                                                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.1.19 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3980 --field-trial-handle=2216,i,10634441143871067930,7183194446749960432,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c
                                                                                                                                                              4⤵
                                                                                                                                                                PID:7220
                                                                                                                                                            • C:\Windows\System32\sc.exe
                                                                                                                                                              "C:\Windows\System32\sc.exe" start PortmasterCore
                                                                                                                                                              3⤵
                                                                                                                                                              • Launches sc.exe
                                                                                                                                                              PID:2424
                                                                                                                                                          • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
                                                                                                                                                            "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\BackupStart.docx" /o ""
                                                                                                                                                            2⤵
                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                            • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                            PID:6384
                                                                                                                                                          • C:\Windows\system32\taskmgr.exe
                                                                                                                                                            "C:\Windows\system32\taskmgr.exe" /4
                                                                                                                                                            2⤵
                                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                            PID:2756
                                                                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                                                                            2⤵
                                                                                                                                                              PID:2704
                                                                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                                                                                3⤵
                                                                                                                                                                • Downloads MZ/PE file
                                                                                                                                                                • Drops desktop.ini file(s)
                                                                                                                                                                • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                                                                                                                                • Checks processor information in registry
                                                                                                                                                                • Modifies registry class
                                                                                                                                                                • NTFS ADS
                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                PID:3672
                                                                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1956 -prefsLen 27097 -prefMapHandle 1960 -prefMapSize 270279 -ipcHandle 2052 -initialChannelId {692081c6-f93b-4788-9dd0-5bd333d9e0b6} -parentPid 3672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3672" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:976
                                                                                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2408 -prefsLen 27133 -prefMapHandle 2412 -prefMapSize 270279 -ipcHandle 2428 -initialChannelId {162a14b2-603e-4238-98e8-d44c4015cc70} -parentPid 3672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:6720
                                                                                                                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3760 -prefsLen 27323 -prefMapHandle 3764 -prefMapSize 270279 -jsInitHandle 3768 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3776 -initialChannelId {5b962092-a58a-4b89-93f4-03edfbd3c102} -parentPid 3672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                                                                                                                                                                      4⤵
                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                      PID:1196
                                                                                                                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4012 -prefsLen 27323 -prefMapHandle 4016 -prefMapSize 270279 -ipcHandle 4040 -initialChannelId {8239e49a-e7b8-4ecb-ac44-c0a44654bba2} -parentPid 3672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3672" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:5280
                                                                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2744 -prefsLen 34822 -prefMapHandle 2748 -prefMapSize 270279 -jsInitHandle 3228 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3168 -initialChannelId {84684ca9-6ab6-4662-91a8-a0025fa07067} -parentPid 3672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                                                                                                                                                                        4⤵
                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                        PID:7004
                                                                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5360 -prefsLen 35010 -prefMapHandle 5364 -prefMapSize 270279 -ipcHandle 5368 -initialChannelId {1e17b538-1cd9-4aef-9fce-341dfd853c7d} -parentPid 3672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                                                                                                                                                                        4⤵
                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                        PID:7788
                                                                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5872 -prefsLen 32992 -prefMapHandle 5876 -prefMapSize 270279 -jsInitHandle 5880 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5916 -initialChannelId {eba0cf08-225d-46bb-af00-33379c0f71a5} -parentPid 3672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                                                                                                                                                                        4⤵
                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                        PID:7300
                                                                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4680 -prefsLen 32992 -prefMapHandle 5712 -prefMapSize 270279 -jsInitHandle 5928 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4724 -initialChannelId {5889e24e-2fd9-4b95-9cc3-f76780927fc9} -parentPid 3672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                                                                                                                                                                        4⤵
                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                        PID:7580
                                                                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6188 -prefsLen 32992 -prefMapHandle 6172 -prefMapSize 270279 -jsInitHandle 6176 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6164 -initialChannelId {eef66afe-9178-4bd2-87fa-53b49b055d9e} -parentPid 3672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                                                                                                                                                                        4⤵
                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                        PID:7588
                                                                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6480 -prefsLen 32992 -prefMapHandle 6484 -prefMapSize 270279 -jsInitHandle 6488 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6496 -initialChannelId {552424b3-77ad-4fd1-8ff1-06bf3263b145} -parentPid 3672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
                                                                                                                                                                        4⤵
                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                        PID:7600
                                                                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2748 -prefsLen 32992 -prefMapHandle 6084 -prefMapSize 270279 -jsInitHandle 6080 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5824 -initialChannelId {c269df23-8c4d-4206-8da6-74a8c8d88e0d} -parentPid 3672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
                                                                                                                                                                        4⤵
                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                        PID:5820
                                                                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 5144 -prefsLen 39993 -prefMapHandle 6240 -prefMapSize 270279 -ipcHandle 5816 -initialChannelId {dfabd6d7-7784-487a-8d36-d6099203a111} -parentPid 3672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 utility
                                                                                                                                                                        4⤵
                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                        PID:3060
                                                                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 4776 -prefsLen 39993 -prefMapHandle 5988 -prefMapSize 270279 -ipcHandle 5964 -initialChannelId {8468eec1-3549-4619-a4b5-dc837cde779a} -parentPid 3672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3672" -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 utility
                                                                                                                                                                        4⤵
                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                        PID:7740
                                                                                                                                                                      • C:\Users\Admin\Downloads\RobloxPlayerInstaller-7QFB72KB9K.exe
                                                                                                                                                                        "C:\Users\Admin\Downloads\RobloxPlayerInstaller-7QFB72KB9K.exe"
                                                                                                                                                                        4⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                        PID:6012
                                                                                                                                                                        • C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe
                                                                                                                                                                          "C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe" -personalizedToken 7QFB72KB9K --deeplink https://www.roblox.com/games/4924922222/Brookhaven-RP -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 6012
                                                                                                                                                                          5⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:7916
                                                                                                                                                                        • C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe
                                                                                                                                                                          "C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe" -personalizedToken 7QFB72KB9K --deeplink https://www.roblox.com/games/4924922222/Brookhaven-RP -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 6012
                                                                                                                                                                          5⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                          PID:6948
                                                                                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:3624
                                                                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                                                                                        3⤵
                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                        PID:6388
                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:5404
                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:1760
                                                                                                                                                                      • C:\Program Files\Portmaster\portmaster.exe
                                                                                                                                                                        "C:\Program Files\Portmaster\portmaster.exe" --with-prompts --with-notifications --background
                                                                                                                                                                        1⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                        PID:2712
                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=portmaster.exe --webview-exe-version=2.1.19 --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz,RemoveRedirectionBitmap --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2712.1376.5658973261386522741 /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c
                                                                                                                                                                          2⤵
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                          PID:1808
                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView /prefetch:4 /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x198,0x7ff922bb5fd8,0x7ff922bb5fe4,0x7ff922bb5ff0
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:4952
                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.1.19 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1760 --field-trial-handle=1768,i,17490123775674096695,12613994653346976999,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:1372
                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.1.19 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2060 --field-trial-handle=1768,i,17490123775674096695,12613994653346976999,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:6048
                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.1.19 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2292 --field-trial-handle=1768,i,17490123775674096695,12613994653346976999,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:1996
                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.1.19 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3508 --field-trial-handle=1768,i,17490123775674096695,12613994653346976999,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c /prefetch:1
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:4808
                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.1.19 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4572 --field-trial-handle=1768,i,17490123775674096695,12613994653346976999,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c /prefetch:1
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:4332
                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.1.19 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4868 --field-trial-handle=1768,i,17490123775674096695,12613994653346976999,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:5148
                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.1.19 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4680 --field-trial-handle=1768,i,17490123775674096695,12613994653346976999,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:6852
                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.1.19 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4668 --field-trial-handle=1768,i,17490123775674096695,12613994653346976999,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:6172
                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.1.19 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4020 --field-trial-handle=1768,i,17490123775674096695,12613994653346976999,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:5112
                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.1.19 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4708 --field-trial-handle=1768,i,17490123775674096695,12613994653346976999,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:5612
                                                                                                                                                                                              • C:\Windows\System32\sc.exe
                                                                                                                                                                                                "C:\Windows\System32\sc.exe" start PortmasterCore
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                                PID:2436
                                                                                                                                                                                              • C:\Windows\System32\sc.exe
                                                                                                                                                                                                "C:\Windows\System32\sc.exe" start PortmasterCore
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                                PID:6036
                                                                                                                                                                                              • C:\Windows\System32\sc.exe
                                                                                                                                                                                                "C:\Windows\System32\sc.exe" start PortmasterCore
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                                PID:1408
                                                                                                                                                                                              • C:\Windows\System32\sc.exe
                                                                                                                                                                                                "C:\Windows\System32\sc.exe" start PortmasterCore
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                                PID:5788
                                                                                                                                                                                              • C:\Windows\System32\sc.exe
                                                                                                                                                                                                "C:\Windows\System32\sc.exe" start PortmasterCore
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                                PID:4216
                                                                                                                                                                                            • C:\Program Files\Portmaster\portmaster-core.exe
                                                                                                                                                                                              "C:\Program Files\Portmaster\portmaster-core.exe" --log-dir=C:\ProgramData\Portmaster\logs
                                                                                                                                                                                              1⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                              PID:4636
                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive "[System.Console]::OutputEncoding = [System.Text.Encoding]::UTF8 Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1 | Get-NetIPConfiguration | Format-List"
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                PID:5768
                                                                                                                                                                                            • C:\Windows\System32\rundll32.exe
                                                                                                                                                                                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:3840
                                                                                                                                                                                              • C:\Windows\system32\SearchIndexer.exe
                                                                                                                                                                                                C:\Windows\system32\SearchIndexer.exe /Embedding
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                PID:6476
                                                                                                                                                                                                • C:\Windows\System32\SearchProtocolHost.exe
                                                                                                                                                                                                  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                                                  PID:6988
                                                                                                                                                                                                • C:\Windows\System32\SearchProtocolHost.exe
                                                                                                                                                                                                  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3655380807-1096177077-1670381078-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3655380807-1096177077-1670381078-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:6896
                                                                                                                                                                                                  • C:\Windows\System32\SearchFilterHost.exe
                                                                                                                                                                                                    "C:\Windows\System32\SearchFilterHost.exe" 836 2756 2244 820 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                                                    PID:3420
                                                                                                                                                                                                  • C:\Windows\System32\SearchFilterHost.exe
                                                                                                                                                                                                    "C:\Windows\System32\SearchFilterHost.exe" 836 2792 2816 820 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                                                    PID:6360
                                                                                                                                                                                                  • C:\Windows\System32\SearchProtocolHost.exe
                                                                                                                                                                                                    "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                                                    PID:6856
                                                                                                                                                                                                  • C:\Windows\System32\SearchFilterHost.exe
                                                                                                                                                                                                    "C:\Windows\System32\SearchFilterHost.exe" 836 2756 2244 820 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:3216
                                                                                                                                                                                                    • C:\Windows\System32\SearchFilterHost.exe
                                                                                                                                                                                                      "C:\Windows\System32\SearchFilterHost.exe" 836 2792 2816 820 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:800
                                                                                                                                                                                                      • C:\Windows\System32\SearchProtocolHost.exe
                                                                                                                                                                                                        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe4_ Global\UsGthrCtrlFltPipeMssGthrPipe4 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:4840
                                                                                                                                                                                                        • C:\Windows\System32\SearchProtocolHost.exe
                                                                                                                                                                                                          "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe5_ Global\UsGthrCtrlFltPipeMssGthrPipe5 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:6796
                                                                                                                                                                                                        • C:\Program Files\Portmaster\portmaster-core.exe
                                                                                                                                                                                                          "C:\Program Files\Portmaster\portmaster-core.exe" --log-dir=C:\ProgramData\Portmaster\logs
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                          PID:6688
                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                            powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive "[System.Console]::OutputEncoding = [System.Text.Encoding]::UTF8 Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1 | Get-NetIPConfiguration | Format-List"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                            PID:6376
                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                            powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive "[System.Console]::OutputEncoding = [System.Text.Encoding]::UTF8 Get-DnsClient -InterfaceIndex 4 | ConvertTo-Json -Depth 1"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                            PID:5060
                                                                                                                                                                                                        • C:\Program Files\Portmaster\portmaster-kext.sys
                                                                                                                                                                                                          "C:\Program Files\Portmaster\portmaster-kext.sys"
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:6768
                                                                                                                                                                                                        • C:\Program Files\Portmaster\portmaster-core.exe
                                                                                                                                                                                                          "C:\Program Files\Portmaster\portmaster-core.exe" --log-dir=C:\ProgramData\Portmaster\logs
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                                          • Modifies system certificate store
                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                          PID:6668
                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                            powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive "[System.Console]::OutputEncoding = [System.Text.Encoding]::UTF8 Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1 | Get-NetIPConfiguration | Format-List"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                            PID:3060
                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                            powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive "[System.Console]::OutputEncoding = [System.Text.Encoding]::UTF8 Get-DnsClient -InterfaceIndex 4 | ConvertTo-Json -Depth 1"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                            PID:6064
                                                                                                                                                                                                        • C:\Program Files\Portmaster\portmaster-core.exe
                                                                                                                                                                                                          "C:\Program Files\Portmaster\portmaster-core.exe" --log-dir=C:\ProgramData\Portmaster\logs
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                                          PID:52
                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                            powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive "[System.Console]::OutputEncoding = [System.Text.Encoding]::UTF8 Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1 | Get-NetIPConfiguration | Format-List"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                            PID:1788
                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                            powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive "[System.Console]::OutputEncoding = [System.Text.Encoding]::UTF8 Get-DnsClient -InterfaceIndex 4 | ConvertTo-Json -Depth 1"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                            PID:1564
                                                                                                                                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:2932
                                                                                                                                                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:544
                                                                                                                                                                                                            • C:\Program Files\Portmaster\portmaster-core.exe
                                                                                                                                                                                                              "C:\Program Files\Portmaster\portmaster-core.exe" --log-dir=C:\ProgramData\Portmaster\logs
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                                                                              PID:4780
                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive "[System.Console]::OutputEncoding = [System.Text.Encoding]::UTF8 Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1 | Get-NetIPConfiguration | Format-List"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                                PID:1408
                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive "[System.Console]::OutputEncoding = [System.Text.Encoding]::UTF8 Get-DnsClient -InterfaceIndex 4 | ConvertTo-Json -Depth 1"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                                PID:6596
                                                                                                                                                                                                            • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                              C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                              PID:7068
                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:712
                                                                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:1088
                                                                                                                                                                                                                • C:\Windows\System32\oobe\UserOOBEBroker.exe
                                                                                                                                                                                                                  C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                  PID:6544
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:1600
                                                                                                                                                                                                                • C:\Program Files\Portmaster\portmaster-core.exe
                                                                                                                                                                                                                  "C:\Program Files\Portmaster\portmaster-core.exe" --log-dir=C:\ProgramData\Portmaster\logs
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                                                                  PID:256
                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                    powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive "[System.Console]::OutputEncoding = [System.Text.Encoding]::UTF8 Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1 | Get-NetIPConfiguration | Format-List"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                                                                    PID:5164
                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                    powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive "[System.Console]::OutputEncoding = [System.Text.Encoding]::UTF8 Get-DnsClient -InterfaceIndex 4 | ConvertTo-Json -Depth 1"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                                                                    PID:776
                                                                                                                                                                                                                • C:\Windows\System32\SecurityHealthHost.exe
                                                                                                                                                                                                                  \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:3476

                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                        Reconnaissance

                                                                                                                                                                                                                        Resource Development

                                                                                                                                                                                                                        Initial Access

                                                                                                                                                                                                                        Execution

                                                                                                                                                                                                                        Command and Scripting Interpreter

                                                                                                                                                                                                                        1
                                                                                                                                                                                                                        T1059

                                                                                                                                                                                                                        PowerShell

                                                                                                                                                                                                                        1
                                                                                                                                                                                                                        T1059.001

                                                                                                                                                                                                                        Persistence

                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                        1
                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                        1
                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                        Privilege Escalation

                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                        1
                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                        1
                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                        Defense Evasion

                                                                                                                                                                                                                        Modify Registry

                                                                                                                                                                                                                        3
                                                                                                                                                                                                                        T1112

                                                                                                                                                                                                                        Subvert Trust Controls

                                                                                                                                                                                                                        2
                                                                                                                                                                                                                        T1553

                                                                                                                                                                                                                        Install Root Certificate

                                                                                                                                                                                                                        1
                                                                                                                                                                                                                        T1553.004

                                                                                                                                                                                                                        SIP and Trust Provider Hijacking

                                                                                                                                                                                                                        1
                                                                                                                                                                                                                        T1553.003

                                                                                                                                                                                                                        Credential Access

                                                                                                                                                                                                                        Discovery

                                                                                                                                                                                                                        Browser Information Discovery

                                                                                                                                                                                                                        1
                                                                                                                                                                                                                        T1217

                                                                                                                                                                                                                        Network Share Discovery

                                                                                                                                                                                                                        1
                                                                                                                                                                                                                        T1135

                                                                                                                                                                                                                        Peripheral Device Discovery

                                                                                                                                                                                                                        2
                                                                                                                                                                                                                        T1120

                                                                                                                                                                                                                        Query Registry

                                                                                                                                                                                                                        6
                                                                                                                                                                                                                        T1012

                                                                                                                                                                                                                        System Information Discovery

                                                                                                                                                                                                                        6
                                                                                                                                                                                                                        T1082

                                                                                                                                                                                                                        System Location Discovery

                                                                                                                                                                                                                        1
                                                                                                                                                                                                                        T1614

                                                                                                                                                                                                                        System Language Discovery

                                                                                                                                                                                                                        1
                                                                                                                                                                                                                        T1614.001

                                                                                                                                                                                                                        System Time Discovery

                                                                                                                                                                                                                        1
                                                                                                                                                                                                                        T1124

                                                                                                                                                                                                                        Lateral Movement

                                                                                                                                                                                                                        Collection

                                                                                                                                                                                                                        Command and Control

                                                                                                                                                                                                                        Exfiltration

                                                                                                                                                                                                                        Impact

                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                        RobloxStudioInstaller.exe
                                                                                                                                                                                                                        • Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
                                                                                                                                                                                                                        • Size 9.8MB
                                                                                                                                                                                                                        • SHA256 371ba35a7bdc22dc6696dc84f2d4e849393943e322c5d3aef662ec8af4bc43a1
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        WebView2Loader.dll
                                                                                                                                                                                                                        • Path C:\Program Files\Portmaster\WebView2Loader.dll
                                                                                                                                                                                                                        • Size 162KB
                                                                                                                                                                                                                        • SHA256 609c974a8cdd6a76a745b3d81b62f321d79f2dc8f4929e1eea8469d9d78baf79
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        assets.zip
                                                                                                                                                                                                                        • Path C:\Program Files\Portmaster\assets.zip
                                                                                                                                                                                                                        • Size 2.5MB
                                                                                                                                                                                                                        • SHA256 fb61a09b7223ad9dfcfafab71a25afca42fb5bb36250e5518effc7bc1fd31550
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        portmaster-core.dll
                                                                                                                                                                                                                        • Path C:\Program Files\Portmaster\portmaster-core.dll
                                                                                                                                                                                                                        • Size 23KB
                                                                                                                                                                                                                        • SHA256 a0f7d615bdd58230e20fe66df6804fffc20a38bdae8b540780236f6b15dac580
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        portmaster-core.exe
                                                                                                                                                                                                                        • Path C:\Program Files\Portmaster\portmaster-core.exe
                                                                                                                                                                                                                        • Size 41.5MB
                                                                                                                                                                                                                        • SHA256 fb2050d8d373a6d9970588de59db8abba5e00d5dd3745db34f551d2c8ed3ff8d
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        portmaster-kext.sys
                                                                                                                                                                                                                        • Path C:\Program Files\Portmaster\portmaster-kext.sys
                                                                                                                                                                                                                        • Size 283KB
                                                                                                                                                                                                                        • SHA256 a603bfeb1c71f9d94a0c66e9e239299d21dc8631fc0352e808b43f3326788186
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        portmaster.exe
                                                                                                                                                                                                                        • Path C:\Program Files\Portmaster\portmaster.exe
                                                                                                                                                                                                                        • Size 32.9MB
                                                                                                                                                                                                                        • SHA256 2da922d3eb4af4a8686b38edf924e3d722e57d0872e1251f7362c7481f68aad2
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        portmaster.zip
                                                                                                                                                                                                                        • Path C:\Program Files\Portmaster\portmaster.zip
                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                        • SHA256 174cfcaf56a5ea9a8b9db2769b6033ce630f08157fb7574e64d15365e4eacad3
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        uninstall.exe
                                                                                                                                                                                                                        • Path C:\Program Files\Portmaster\uninstall.exe
                                                                                                                                                                                                                        • Size 770KB
                                                                                                                                                                                                                        • SHA256 4994783eb1edffd046ee154b0c2c5902029a658163d305d80cc1744bc1325bef
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Windows.db
                                                                                                                                                                                                                        • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
                                                                                                                                                                                                                        • Size 1.2MB
                                                                                                                                                                                                                        • SHA256 dfb4b86c1b0d01b501e5bc25742a58f9b7ec495fd92eb23394ee38061aa49b53
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Windows.db-wal
                                                                                                                                                                                                                        • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
                                                                                                                                                                                                                        • Size 784KB
                                                                                                                                                                                                                        • SHA256 b620640d842cd1357849f295514a2862fd51a5f313bc7e9c9c703aa821c32106
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        db.sqlite
                                                                                                                                                                                                                        • Path C:\ProgramData\Portmaster\databases\cache\sqlite\db.sqlite
                                                                                                                                                                                                                        • Size 112KB
                                                                                                                                                                                                                        • SHA256 3fb49a857dfd2cc4b36842c663cfb27b296721babc41fef1f59067397834680f
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        db.sqlite
                                                                                                                                                                                                                        • Path C:\ProgramData\Portmaster\databases\core\sqlite\db.sqlite
                                                                                                                                                                                                                        • Size 56KB
                                                                                                                                                                                                                        • SHA256 f85e3cfee5e374195661f553a9e2800821694ea33f2b1f1f92b29b7cedfdd4d9
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        base.dsdl
                                                                                                                                                                                                                        • Path C:\ProgramData\Portmaster\intel\base.dsdl
                                                                                                                                                                                                                        • Size 12.6MB
                                                                                                                                                                                                                        • SHA256 e13743831d296bc64ea951f61122ea6d38b7d957aeccd2a830a9cd336305f95d
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        index.dsd
                                                                                                                                                                                                                        • Path C:\ProgramData\Portmaster\intel\index.dsd
                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                        • SHA256 026325cc7af459251fb08dce0a6166aeece4c9b5a4b7d26e15f4f7d94e0e6e0e
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        index.json
                                                                                                                                                                                                                        • Path C:\ProgramData\Portmaster\intel\index.json
                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                        • SHA256 5809ccd56bbd69897c2617fd938b10c5a5af0fa2ccbf78e8978c52040e86b628
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        intermediate.dsdl
                                                                                                                                                                                                                        • Path C:\ProgramData\Portmaster\intel\intermediate.dsdl
                                                                                                                                                                                                                        • Size 13.1MB
                                                                                                                                                                                                                        • SHA256 02c0eaa1af1874d8e1081ad41100179a93cb336352246f750eed6664d20978fb
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        main-intel.yaml
                                                                                                                                                                                                                        • Path C:\ProgramData\Portmaster\intel\main-intel.yaml
                                                                                                                                                                                                                        • Size 14KB
                                                                                                                                                                                                                        • SHA256 c73be8f0600af4500f5d3e6f8e354f5d96dba2ce37d59aa976306a8ea9e5bc6d
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        news.yaml
                                                                                                                                                                                                                        • Path C:\ProgramData\Portmaster\intel\news.yaml
                                                                                                                                                                                                                        • Size 972B
                                                                                                                                                                                                                        • SHA256 fa64e8d0f2adc61093df516d4be68ad536c4de29fd9f7c2473311dbdaaa1f9c6
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        notifications.yaml
                                                                                                                                                                                                                        • Path C:\ProgramData\Portmaster\intel\notifications.yaml
                                                                                                                                                                                                                        • Size 6KB
                                                                                                                                                                                                                        • SHA256 8168f64860717712a9d0a00da876e84f03c34834b3a8e0e1dfa783a9c29f7235
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        urgent.dsdl
                                                                                                                                                                                                                        • Path C:\ProgramData\Portmaster\intel\urgent.dsdl
                                                                                                                                                                                                                        • Size 5.3MB
                                                                                                                                                                                                                        • SHA256 8322f7a9045dd3811058a9e7a63610af21d42609f4c9458bf3e36f0f93e1c0e7
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\D3DSCache\b5a3c58d1e2d9326\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                        • SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                        • Size 280B
                                                                                                                                                                                                                        • SHA256 edffd5fa3a5d59adc4bc1f05850e88935c2643fa3cb066e39bb85adbbf0cece6
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                        • Size 280B
                                                                                                                                                                                                                        • SHA256 9cb9dadb75fdec99ef0d62a75c2c774031343d2e4d425f25431e33ef3dec6e0f
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                        • Size 280B
                                                                                                                                                                                                                        • SHA256 a73b32029b5d0c6ff7ae727c0f35079c0207fb5160bb2094317e96e23daf1cee
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                        • Size 280B
                                                                                                                                                                                                                        • SHA256 02e83107bdf4cefad04d7dffca4065fb67146265abf734fc1a0a6c97297b321d
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        LOG.old
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                                                                                                                                        • Size 331B
                                                                                                                                                                                                                        • SHA256 7bc73e112975100b6ea7514d67eecd8c2c4f13e613c94de847a89f5c8bd5d9f8
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        LOG.old
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                                                                                                                                        • Size 331B
                                                                                                                                                                                                                        • SHA256 1ada27439706c0a2ee162f74f83c3e1d97f0b16e12e295e7ca603e3c06b21ce2
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        LOG.old
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                                                                                                                                        • Size 334B
                                                                                                                                                                                                                        • SHA256 8a830975299b1760fc2d12737f1ca87dd8e08ceb1ba3ac76ed810db386b1fd22
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        BookmarkMergedSurfaceOrdering
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                                                                                                                        • Size 6B
                                                                                                                                                                                                                        • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        the-real-index
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                        • Size 5KB
                                                                                                                                                                                                                        • SHA256 a5c90eaa6e1fd6999f459a75de2cce9ce5ba38e299405d86120528d1c335a249
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        the-real-index~RFe59c087.TMP
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c087.TMP
                                                                                                                                                                                                                        • Size 3KB
                                                                                                                                                                                                                        • SHA256 8ccfa85435c19cfecec8bf082d9bf59d8b7065e588fa086e8ca0305702eeabdc
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        SiteList-Enterprise.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                                                                                                        • Size 2B
                                                                                                                                                                                                                        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Edge Profile.ico
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                                                                                                                        • Size 70KB
                                                                                                                                                                                                                        • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Network Persistent State
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                        • Size 3KB
                                                                                                                                                                                                                        • SHA256 3bd731cfc72ea3efde2df26446412c8723bf55ad7d256b794fac8bba4463f7df
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Network Persistent State
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                        • Size 3KB
                                                                                                                                                                                                                        • SHA256 8ab9024ce722a0a0bbd2d8119ce6fa6ecf366b464376b612d9ba31d57f035220
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Network Persistent State
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                        • Size 3KB
                                                                                                                                                                                                                        • SHA256 1b0240ed11d12975a673b9c94a4817b6441f324214e0402ea527946896719bc7
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        SCT Auditing Pending Reports
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                                                        • Size 2B
                                                                                                                                                                                                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Sdch Dictionaries
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                                                                                                                        • Size 211B
                                                                                                                                                                                                                        • SHA256 4b014b06230f4338175bf8d5a2bc2cc16089849ebe1884a78c7417bdefc4b127
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Sdch Dictionaries
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                                                                                                                        • Size 40B
                                                                                                                                                                                                                        • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                        • Size 16KB
                                                                                                                                                                                                                        • SHA256 afb7ffd1e88d16024b94094fbab40bc64fbdad8bfd0e150dd7843ce924d1ff30
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                        • Size 17KB
                                                                                                                                                                                                                        • SHA256 336a007f3337a6273d57b10c513b7460f93bc626d2256aee2c6fd672e77f96d7
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                        • Size 32KB
                                                                                                                                                                                                                        • SHA256 70c8b02126fb9f85a1040321a49514b0a01cc9105e9e98b6a4cc55e8c6d55a99
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                        • Size 16KB
                                                                                                                                                                                                                        • SHA256 e21d910fd908b519d7cdb7bd459c6f5445faf82c931d71363172d38cbc581e31
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                        • Size 17KB
                                                                                                                                                                                                                        • SHA256 3a9533040eb16dd043ce40947e4f97789c1ff184db010bca695130b77291777a
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                        • Size 13KB
                                                                                                                                                                                                                        • SHA256 65e667e4256bfcb0acfaf5586abc0bda10000b034b0d4bcc3baba327ca894db6
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Secure Preferences
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                                                                                        • Size 27KB
                                                                                                                                                                                                                        • SHA256 2b0a4a135b69bac633711dd200dccca9e3dcfc92e69bc757e8c0b1e7cb65299a
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        the-real-index
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\47cd30a2-9c56-4f95-b896-e1a59c6cef81\index-dir\the-real-index
                                                                                                                                                                                                                        • Size 792B
                                                                                                                                                                                                                        • SHA256 fd416a19af0a5bd1bf84c813830ae58379f5c84853f823fef3f72a601ab26946
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        the-real-index~RFe5daa7b.TMP
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\47cd30a2-9c56-4f95-b896-e1a59c6cef81\index-dir\the-real-index~RFe5daa7b.TMP
                                                                                                                                                                                                                        • Size 792B
                                                                                                                                                                                                                        • SHA256 742f0fd03d3e9d175ddd1e2a4661b5cde1934835c87117dad6357123c1bb193a
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        index.txt
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                                                                                                                                        • Size 371B
                                                                                                                                                                                                                        • SHA256 597f9525007839bfd2e98964b6527af1c6e9dedc90234b06a78adb380578e643
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        sync_diagnostic.log
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                        • SHA256 1331888db8f9c87037345f4700539d81316280c5bb6617fc37ccbd6a14460519
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        CURRENT
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
                                                                                                                                                                                                                        • Size 16B
                                                                                                                                                                                                                        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        MANIFEST-000001
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
                                                                                                                                                                                                                        • Size 41B
                                                                                                                                                                                                                        • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        c42590eb-103c-4c90-a8ac-ee9af74bddc7.tmp
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c42590eb-103c-4c90-a8ac-ee9af74bddc7.tmp
                                                                                                                                                                                                                        • Size 414B
                                                                                                                                                                                                                        • SHA256 be8539166d84fa78a16d066a3c61e969e18c42109e91f6c5f5af0cc3c0844ca7
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        c216c28f-0538-4b20-8428-fd93392de20b.tmp
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c216c28f-0538-4b20-8428-fd93392de20b.tmp
                                                                                                                                                                                                                        • Size 22KB
                                                                                                                                                                                                                        • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                        • Size 49KB
                                                                                                                                                                                                                        • SHA256 d37e79c3dc39454e346ddd9463c43bd170d86c96133613932abec2625425410c
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                        • Size 35KB
                                                                                                                                                                                                                        • SHA256 f1bcff65044d8cbbd436633979fdd0e66da9016f4effb7f13101c77b6c6dd176
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                        • Size 35KB
                                                                                                                                                                                                                        • SHA256 8d828641010ab42a5ca8cc9dca23421720bb2fa303a9355a7ce7aea7a214a802
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                        • Size 42KB
                                                                                                                                                                                                                        • SHA256 a67b1691e1df7bd3b6edb431a113512915991f6649df1f566efa494041c1e776
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                        • Size 43KB
                                                                                                                                                                                                                        • SHA256 f394ae2e627952026596d378f27ae41031551e7819ba5bf1be55cb8f255c2f5f
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                        • Size 38KB
                                                                                                                                                                                                                        • SHA256 924280b50ae2dabf2c62c1f70e88626b35c739212a4bf7e1922ed515fb93a314
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                        • Size 43KB
                                                                                                                                                                                                                        • SHA256 fd562cda20448b1e33f09e8f5c26693fcbaf852d23f758e9fe1fe634af43b78d
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                        • Size 42KB
                                                                                                                                                                                                                        • SHA256 94b80e38e17ca18ad4ffb8bb3145c83c58bb63dc14e286cf17590c5e00d0ff27
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                        • Size 42KB
                                                                                                                                                                                                                        • SHA256 e6fd64e9f6735bcc51c9fa06a567a2b1f787354e089aca880e9d30190c17b592
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                        • Size 38KB
                                                                                                                                                                                                                        • SHA256 a4899dcce3a50fbffaf653f8bf0b96f42e6bace109b6fe4afff51de7a30caee1
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                        • Size 46KB
                                                                                                                                                                                                                        • SHA256 0d347b3ea32bacc0113bfad36ba543fc71e2480d7d4663794b74de88b06f941f
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        metadata.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                        • Size 252B
                                                                                                                                                                                                                        • SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        metadata.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                        • Size 852B
                                                                                                                                                                                                                        • SHA256 142a7cc7a4933a976aae32a9d04e1758464486092207243f09edbbad51f1d934
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        metadata.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                        • SHA256 757c40068c8b44526fedddbae76f4ef49d46e6f99e9c5b6ac7daee04f31c52bc
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        metadata.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                        • Size 972B
                                                                                                                                                                                                                        • SHA256 590065152acec5cf42dffc28eb04749514feaa899eb2ae04edce7d38a148fbda
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        metadata.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                        • Size 132B
                                                                                                                                                                                                                        • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        metadata.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                        • Size 732B
                                                                                                                                                                                                                        • SHA256 a5548ca519cf47ecb420c8f1299a8a50517fa463459a704ef2ff17c4db35117a
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        metadata.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                        • Size 372B
                                                                                                                                                                                                                        • SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        metadata.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                        • Size 492B
                                                                                                                                                                                                                        • SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        metadata.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                        • Size 612B
                                                                                                                                                                                                                        • SHA256 98d9b184e4c7220b5aaf7ae412b0c1b3f32e3dc4933afcf852538b8082017b9e
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        c83f6519-f2dc-4045-8dcb-53d2e51c0c5c.tmp
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c83f6519-f2dc-4045-8dcb-53d2e51c0c5c.tmp
                                                                                                                                                                                                                        • Size 13B
                                                                                                                                                                                                                        • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        activity-stream.contile.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\activity-stream.contile.json
                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                        • SHA256 90a115eb013d166eb883bc5f81e00e795de17b3021845ae09ba8bfc8721f01b9
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        activity-stream.discovery_stream.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\activity-stream.discovery_stream.json
                                                                                                                                                                                                                        • Size 75KB
                                                                                                                                                                                                                        • SHA256 31f909bec9ab59d2c8c05cd3802c2fc6782f3afa426a8a2edf756a73207f7393
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        32358
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\cache2\doomed\32358
                                                                                                                                                                                                                        • Size 17KB
                                                                                                                                                                                                                        • SHA256 7b7c347cc2a07aa98d3486e6ce264dc884639b934aca417d2919f48168f1040c
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        02E572BE45C57ED8E1DD6D47D7A5FE4AAC7AEA7B
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\cache2\entries\02E572BE45C57ED8E1DD6D47D7A5FE4AAC7AEA7B
                                                                                                                                                                                                                        • Size 17KB
                                                                                                                                                                                                                        • SHA256 d5d108896c6da198daf7e944d43a25adfe6f6eaa03154cf58bce723d36be7d7c
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        03100235E7AEBB25C597DD91664A8F544DDFC529
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\cache2\entries\03100235E7AEBB25C597DD91664A8F544DDFC529
                                                                                                                                                                                                                        • Size 13KB
                                                                                                                                                                                                                        • SHA256 860136f4873dd0071b105af49ea9a25ed287251949fb76c5073647627c3c8b5b
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        0DDD7CA45B5C8E9F763110C22D54532F4C8FC2AE
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\cache2\entries\0DDD7CA45B5C8E9F763110C22D54532F4C8FC2AE
                                                                                                                                                                                                                        • Size 19KB
                                                                                                                                                                                                                        • SHA256 f6163333c634859ff13063caaaa73adf1b4e5cd2b81d1a453dcd48638d413d1d
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        1235F89C590647137DA13DCA5C13933DC4FDD68D
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\cache2\entries\1235F89C590647137DA13DCA5C13933DC4FDD68D
                                                                                                                                                                                                                        • Size 129KB
                                                                                                                                                                                                                        • SHA256 58278084afe3f3884002a27e027fb644a563546cad9161c317875809785ecdfc
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        2C01BCA79FBEB1C8C347A88C8A08E8DEDA78EBEA
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\cache2\entries\2C01BCA79FBEB1C8C347A88C8A08E8DEDA78EBEA
                                                                                                                                                                                                                        • Size 19KB
                                                                                                                                                                                                                        • SHA256 fd5a5d6ec87395084750b89b5105b150cc124fc96c3599c74fee01b3523dcc74
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        2D194AA9162E0A04BE779C422A355439267D09E6
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\cache2\entries\2D194AA9162E0A04BE779C422A355439267D09E6
                                                                                                                                                                                                                        • Size 88KB
                                                                                                                                                                                                                        • SHA256 cdcdc3e16520313404325901236bffde727378a1c1a0e18360e1f85ad693218d
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        3955CD93FFC8BA5F29E3D5DA6400592EB90053B7
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\cache2\entries\3955CD93FFC8BA5F29E3D5DA6400592EB90053B7
                                                                                                                                                                                                                        • Size 85KB
                                                                                                                                                                                                                        • SHA256 f42227cddd1e8e80caf41c371f1f38cf09adecada0bc3be43a9e391fcea5f8f8
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        451C9D9BE07CB43F47981FB3A8A42E2F4629E607
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\cache2\entries\451C9D9BE07CB43F47981FB3A8A42E2F4629E607
                                                                                                                                                                                                                        • Size 75KB
                                                                                                                                                                                                                        • SHA256 bcfa78968efbb50f41420f3ac6e4dd6b389de6eb07e40839aef9f77e56565f4e
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        4C11E373FD9A73A5E61FCB5291518B290C3C15DF
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\cache2\entries\4C11E373FD9A73A5E61FCB5291518B290C3C15DF
                                                                                                                                                                                                                        • Size 37KB
                                                                                                                                                                                                                        • SHA256 cb7c0d1372e5daa2ef6361fe57f752cb4ef41d3ec4305aa8e7e9e43ee2b493e2
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        4E6529BB0ABC2D7F34AAEE3837C868CD4F3D5C8A
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\cache2\entries\4E6529BB0ABC2D7F34AAEE3837C868CD4F3D5C8A
                                                                                                                                                                                                                        • Size 61KB
                                                                                                                                                                                                                        • SHA256 8a697fb97e6ad41ccf5fb4dc8c18aab29dae9cf5017c3c44582a34a669c38e80
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        50744777B50C1641FF0A3AD80DFD479F199D4EF5
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\cache2\entries\50744777B50C1641FF0A3AD80DFD479F199D4EF5
                                                                                                                                                                                                                        • Size 48KB
                                                                                                                                                                                                                        • SHA256 91d27a44a922d5d6fa1f71eda9afb3b79728cb09e83d04b3e2611190fda57923
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        51C7C17D757B9E1E0C5A371EE7D8910C6225ADF5
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\cache2\entries\51C7C17D757B9E1E0C5A371EE7D8910C6225ADF5
                                                                                                                                                                                                                        • Size 17KB
                                                                                                                                                                                                                        • SHA256 79c2b41bb960c8b2998ae2677625dd693115076befc18ce7178b7b76bfc34a8f
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        560AEC7B0DED5A74259406EC1B3EEB117FFD39FB
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\cache2\entries\560AEC7B0DED5A74259406EC1B3EEB117FFD39FB
                                                                                                                                                                                                                        • Size 230KB
                                                                                                                                                                                                                        • SHA256 aa8fb52bd1b23f1996327bafa3d3ed2ae26962fd51725f8089f8997ab2f6e786
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        644937311FD6002EF29DE1E01DEE98FC71B4DC3A
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\cache2\entries\644937311FD6002EF29DE1E01DEE98FC71B4DC3A
                                                                                                                                                                                                                        • Size 13KB
                                                                                                                                                                                                                        • SHA256 3610cf6b20ac701965aa7e18aee697611a167e45595c63f2e454352869779686
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        6905930F8805501966A20243FDC4CC27F243D8A6
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\cache2\entries\6905930F8805501966A20243FDC4CC27F243D8A6
                                                                                                                                                                                                                        • Size 85KB
                                                                                                                                                                                                                        • SHA256 39e39902e69307ac67c53fd2abd3de066cac8538cc85587fbc2557e4c5e56aac
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        694003CA11905375CD3DE530B18EFCB518F5E804
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\cache2\entries\694003CA11905375CD3DE530B18EFCB518F5E804
                                                                                                                                                                                                                        • Size 166KB
                                                                                                                                                                                                                        • SHA256 5001a6d59e60805a9c0a07dfa1652f030ae4211aae131151fa7a0bb43d0da0a9
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        6B283E009F5B1423515F5D6E62E2ED15638E2542
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\cache2\entries\6B283E009F5B1423515F5D6E62E2ED15638E2542
                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                        • SHA256 cd37137c8fa0b811fe3967bbae9545b0fffbbd9093c5dd15a9dc28e2a7ff3dae
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        6E1FC477C4B6676D8A03FC74425C75D4721DF89C
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\cache2\entries\6E1FC477C4B6676D8A03FC74425C75D4721DF89C
                                                                                                                                                                                                                        • Size 39KB
                                                                                                                                                                                                                        • SHA256 a63c4cede0204bcb16c0da85dc17d67f7d1487aa6cde155f7ef5754ff6331c0c
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        6F575468A9B975F324222E471F8F3AD0B11F7032
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\cache2\entries\6F575468A9B975F324222E471F8F3AD0B11F7032
                                                                                                                                                                                                                        • Size 14KB
                                                                                                                                                                                                                        • SHA256 595e956d109af2b970255d9cac5e1e9f0a65859dc9817d8cdafa980d2a73e133
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        7FEBBF2A7F496D01287CFCD27F45AB0B3AE9E1E4
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\cache2\entries\7FEBBF2A7F496D01287CFCD27F45AB0B3AE9E1E4
                                                                                                                                                                                                                        • Size 67KB
                                                                                                                                                                                                                        • SHA256 1bb32d4fbb7cedf77ad8f47e3b4022f21edf9c0801bf8263cb6881c27bf4be8f
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        8505CE97EC911F4BFB9B87FF453E133DF69515F9
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\cache2\entries\8505CE97EC911F4BFB9B87FF453E133DF69515F9
                                                                                                                                                                                                                        • Size 172KB
                                                                                                                                                                                                                        • SHA256 faebd504851787e151a8a1769e7049ad485a64c780437c8ad4b4684d8c5e06ba
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        88F70E3812D2717FC0A9FF9030276932A034784F
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\cache2\entries\88F70E3812D2717FC0A9FF9030276932A034784F
                                                                                                                                                                                                                        • Size 113KB
                                                                                                                                                                                                                        • SHA256 17eedb6d66437fb75379db15c9dee6bb39126dda67e03f95330ee8f91e01c7ff
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        93ED7C2BEA86CFA8B7D4FB541E0C6C843E815FA7
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\cache2\entries\93ED7C2BEA86CFA8B7D4FB541E0C6C843E815FA7
                                                                                                                                                                                                                        • Size 23KB
                                                                                                                                                                                                                        • SHA256 8a4b25bfdf5c6aac3ea68c4b6048502705b6db5fd84cf50a28b4d09bb9e555b9
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        93FF6F8358B90C69FC1FBD1064F65B979DBABC4F
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\cache2\entries\93FF6F8358B90C69FC1FBD1064F65B979DBABC4F
                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                        • SHA256 f8b0aa3b2e2749f1a436cc08cf646ed42c2a39ab6d8676b0af804f28aacc3e2f
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        98CB29D724090A759D4252C295418FF8853357C3
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\cache2\entries\98CB29D724090A759D4252C295418FF8853357C3
                                                                                                                                                                                                                        • Size 135KB
                                                                                                                                                                                                                        • SHA256 76421fe0b54ee61a7b2afa2a4379ad8a6c55f24d23b606b7f6e6d7cbdec165e7
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        A42CC84CCE2D01EE76132212E89B3401925C9ED8
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\cache2\entries\A42CC84CCE2D01EE76132212E89B3401925C9ED8
                                                                                                                                                                                                                        • Size 15KB
                                                                                                                                                                                                                        • SHA256 f2853f24e5172481414da6759583383d8713982eba1cd994a493f34a89ad9b8f
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        A62A7F331E73DC9D0055FBDA55172020F8FA618B
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\cache2\entries\A62A7F331E73DC9D0055FBDA55172020F8FA618B
                                                                                                                                                                                                                        • Size 59KB
                                                                                                                                                                                                                        • SHA256 9fc80fe63724ff6932a1afce21e803002c9abe421f6616ac5cbe5d9976d23ebc
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        B0333FD2B6143F5F124783D924DC8CC6F5C0FD08
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\cache2\entries\B0333FD2B6143F5F124783D924DC8CC6F5C0FD08
                                                                                                                                                                                                                        • Size 14KB
                                                                                                                                                                                                                        • SHA256 76e0566db1c4aacc9d15434a95fabe38d78fff2aeee5c4a2cfe0230aa16cd8c5
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        C20E036239CAF315DF30D2CDAAC4F746820BB89D
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\cache2\entries\C20E036239CAF315DF30D2CDAAC4F746820BB89D
                                                                                                                                                                                                                        • Size 96KB
                                                                                                                                                                                                                        • SHA256 8d66194785f0e3998fb51db2ff86fe2c8371512a5cf792f043fff373977472e6
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        C483221B6ED463991832331E978ADF53E0B1ACCA
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\cache2\entries\C483221B6ED463991832331E978ADF53E0B1ACCA
                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                        • SHA256 e088f3e604c72bbebfb5d9af1a24859ee62c60fe32db804b92bcde970c989ac6
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        C57D0FD5A41CE53EAB45D7225E61CEAE2B97DA0A
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\cache2\entries\C57D0FD5A41CE53EAB45D7225E61CEAE2B97DA0A
                                                                                                                                                                                                                        • Size 56KB
                                                                                                                                                                                                                        • SHA256 70672cd3fcc4217b9cc7b069ce2dc3ce35dae1b3a48b7cb0e7dbbda4b857ce18
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        DBB59812CBEF0923ADE1AE962C874BFD3FB62AED
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\cache2\entries\DBB59812CBEF0923ADE1AE962C874BFD3FB62AED
                                                                                                                                                                                                                        • Size 69KB
                                                                                                                                                                                                                        • SHA256 69b79b7f71c6b124e4fa52b2a416f908d09a54615b032e4a8aed8b57f79e4077
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        E15A429A8B820362A8B57E15C2D9284F48E43F8A
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\cache2\entries\E15A429A8B820362A8B57E15C2D9284F48E43F8A
                                                                                                                                                                                                                        • Size 50KB
                                                                                                                                                                                                                        • SHA256 cd06f3be8b4a1afb38fd21b99acc92f043e0956ed92fcef6d51b3b421294e2d3
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        E4E6EF4A8C0104A5EBA4DA2862920DB5ED8D7A09
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\cache2\entries\E4E6EF4A8C0104A5EBA4DA2862920DB5ED8D7A09
                                                                                                                                                                                                                        • Size 32KB
                                                                                                                                                                                                                        • SHA256 2753c29da48b214f2121dad28ad35637e345e09deb22a29a46b02f900d14b0eb
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        E9A3EFE3FC6FB463576CD912603080D7BB2D20B2
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\cache2\entries\E9A3EFE3FC6FB463576CD912603080D7BB2D20B2
                                                                                                                                                                                                                        • Size 67KB
                                                                                                                                                                                                                        • SHA256 e4b8d4845e6bf70152bd7381be967e3fd9d747eb04a2f2caf4dd9eae0d00b7cb
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        F4A505B75613C1851E65B0A59D4A706B41D9714D
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\cache2\entries\F4A505B75613C1851E65B0A59D4A706B41D9714D
                                                                                                                                                                                                                        • Size 32KB
                                                                                                                                                                                                                        • SHA256 7afda56bd9fa30b9b9899cbc53082cf9005336863a987fe56cde6afb1f59d02d
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        nb_model_build_attachment_arts_and_entertainment.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\personality-provider\nb_model_build_attachment_arts_and_entertainment.json
                                                                                                                                                                                                                        • Size 67KB
                                                                                                                                                                                                                        • SHA256 960065cc44a09bef89206d28048d3c23719d2f5e9b38cfc718ca864c9e0e91e9
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        nb_model_build_attachment_autos_and_vehicles.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\personality-provider\nb_model_build_attachment_autos_and_vehicles.json
                                                                                                                                                                                                                        • Size 44KB
                                                                                                                                                                                                                        • SHA256 022f9495f8867fea275ece900cfa7664c68c25073db4748343452dbc0b9eda17
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        nb_model_build_attachment_beauty_and_fitness.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\personality-provider\nb_model_build_attachment_beauty_and_fitness.json
                                                                                                                                                                                                                        • Size 33KB
                                                                                                                                                                                                                        • SHA256 eed46e8fe6ff20f89884b4fc68a81e8d521231440301a01bb89beec8ebad296b
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        nb_model_build_attachment_blogging_resources_and_services.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\personality-provider\nb_model_build_attachment_blogging_resources_and_services.json
                                                                                                                                                                                                                        • Size 33KB
                                                                                                                                                                                                                        • SHA256 c9f2a779dba0bc886cc1255816bd776bdc2e8a6a8e0f9380495a92bb66862780
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        nb_model_build_attachment_books_and_literature.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\personality-provider\nb_model_build_attachment_books_and_literature.json
                                                                                                                                                                                                                        • Size 67KB
                                                                                                                                                                                                                        • SHA256 df23a5b6f583ec3b4dce2aca8ff53cbdfadfd58c4b7aeb2e397eade5ff75c996
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        nb_model_build_attachment_business_and_industrial.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\personality-provider\nb_model_build_attachment_business_and_industrial.json
                                                                                                                                                                                                                        • Size 45KB
                                                                                                                                                                                                                        • SHA256 8410809ebac544389cf27a10e2cbd687b7a68753aa50a42f235ac3fc7b60ce2c
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        nb_model_build_attachment_computers_and_electronics.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\personality-provider\nb_model_build_attachment_computers_and_electronics.json
                                                                                                                                                                                                                        • Size 45KB
                                                                                                                                                                                                                        • SHA256 ab20b97406b0d9bf4f695e5ec7db4ebad5efb682311e74ca757d45b87ffc106b
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        nb_model_build_attachment_finance.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\personality-provider\nb_model_build_attachment_finance.json
                                                                                                                                                                                                                        • Size 33KB
                                                                                                                                                                                                                        • SHA256 384bf5fcc6928200c7ebb1f03f99bf74f6063e78d3cd044374448f879799318e
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        nb_model_build_attachment_food_and_drink.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\personality-provider\nb_model_build_attachment_food_and_drink.json
                                                                                                                                                                                                                        • Size 67KB
                                                                                                                                                                                                                        • SHA256 905357002f2eced8bba1be2285a9b83198f60d2f9bb1144b5c119994f2ec6e34
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        nb_model_build_attachment_games.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\personality-provider\nb_model_build_attachment_games.json
                                                                                                                                                                                                                        • Size 44KB
                                                                                                                                                                                                                        • SHA256 35e67835a5cf82144765dfb1095ebc84ac27d08812507ad0a2d562bf68e13e85
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        nb_model_build_attachment_health.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\personality-provider\nb_model_build_attachment_health.json
                                                                                                                                                                                                                        • Size 33KB
                                                                                                                                                                                                                        • SHA256 150f21c4f60856ab5e22891939d68d062542537b42a7ce1f8a8cec9300e7c565
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        nb_model_build_attachment_hobbies_and_leisure.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\personality-provider\nb_model_build_attachment_hobbies_and_leisure.json
                                                                                                                                                                                                                        • Size 67KB
                                                                                                                                                                                                                        • SHA256 47db7797297a2a81d28c551117e27144b58627dbac1b1d52672b630d220f025d
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        nb_model_build_attachment_home_and_garden.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\personality-provider\nb_model_build_attachment_home_and_garden.json
                                                                                                                                                                                                                        • Size 33KB
                                                                                                                                                                                                                        • SHA256 19edd15ebce419b83469d2ab783c0c1377d72a186d1ff08857a82bca842eea54
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        nb_model_build_attachment_internet_and_telecom.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\personality-provider\nb_model_build_attachment_internet_and_telecom.json
                                                                                                                                                                                                                        • Size 67KB
                                                                                                                                                                                                                        • SHA256 e646d43505c9c4e53dbaa474ef85d650a3f309ccf153d106f328d9b6aeb66d52
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        nb_model_build_attachment_jobs_and_education.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\personality-provider\nb_model_build_attachment_jobs_and_education.json
                                                                                                                                                                                                                        • Size 33KB
                                                                                                                                                                                                                        • SHA256 29080288b2130a67414ecb296a53ddd9f0a4771035e3c1b2112e0ce656a7481a
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        nb_model_build_attachment_law_and_government.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\personality-provider\nb_model_build_attachment_law_and_government.json
                                                                                                                                                                                                                        • Size 68KB
                                                                                                                                                                                                                        • SHA256 257ee9a218a1b7f9c1a6c890f38920eb7e731808e3d9b9fc956f8346c29a3e63
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        nb_model_build_attachment_online_communities.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\personality-provider\nb_model_build_attachment_online_communities.json
                                                                                                                                                                                                                        • Size 67KB
                                                                                                                                                                                                                        • SHA256 11b6084552e2979b5bc0fd6ffdc61e445d49692c0ae8dffedc07792f8062d13f
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        nb_model_build_attachment_people_and_society.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\personality-provider\nb_model_build_attachment_people_and_society.json
                                                                                                                                                                                                                        • Size 45KB
                                                                                                                                                                                                                        • SHA256 4990a5d17bea15617624c48a0c7c23d16e95f15e2ec9dd1d82ee949567bbaec0
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        nb_model_build_attachment_pets_and_animals.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\personality-provider\nb_model_build_attachment_pets_and_animals.json
                                                                                                                                                                                                                        • Size 44KB
                                                                                                                                                                                                                        • SHA256 dd537bfb1497eb9457c0c8ecbd2846f325e13ddef3988fd293a29e68ab0b2671
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        nb_model_build_attachment_real_estate.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\personality-provider\nb_model_build_attachment_real_estate.json
                                                                                                                                                                                                                        • Size 67KB
                                                                                                                                                                                                                        • SHA256 efcf6b2d09e89b8c449ffbcdb5354beaa7178673862ebcdd6593561f2aa7d99a
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        nb_model_build_attachment_reference.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\personality-provider\nb_model_build_attachment_reference.json
                                                                                                                                                                                                                        • Size 56KB
                                                                                                                                                                                                                        • SHA256 3619daa64036d1f0197cdadf7660e390d4b6e8c1b328ed3b59f828a205a6ea49
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        nb_model_build_attachment_science.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\personality-provider\nb_model_build_attachment_science.json
                                                                                                                                                                                                                        • Size 56KB
                                                                                                                                                                                                                        • SHA256 9606ce3988b2d2a4921b58ac454f54e53a9ea8f358326522a8b1dcc751b50b32
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        nb_model_build_attachment_shopping.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\personality-provider\nb_model_build_attachment_shopping.json
                                                                                                                                                                                                                        • Size 67KB
                                                                                                                                                                                                                        • SHA256 bfd7e68ddca6696c798412402965a0384df0c8c209931bbadabf88ccb45e3bb6
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        nb_model_build_attachment_sports.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\personality-provider\nb_model_build_attachment_sports.json
                                                                                                                                                                                                                        • Size 56KB
                                                                                                                                                                                                                        • SHA256 44da98b03350e91e852fe59f0fc05d752fc867a5049ab0363da8bb7b7078ad14
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        nb_model_build_attachment_travel.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\personality-provider\nb_model_build_attachment_travel.json
                                                                                                                                                                                                                        • Size 67KB
                                                                                                                                                                                                                        • SHA256 4336ac211a822b0a5c3ce5de0d4730665acc351ee1965ea8da1c72477e216dfa
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        recipe_attachment.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\personality-provider\recipe_attachment.json
                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                        • SHA256 fc07d42847eeaf69dcbf1b9a16eb48b141c11feb67aa40724be2aee83cb621b7
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        webext.sc.lz4
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\startupCache\webext.sc.lz4
                                                                                                                                                                                                                        • Size 105KB
                                                                                                                                                                                                                        • SHA256 902cf091cb693b22e1933cd4f0a47a8dfc7b8bc8810ddb1342214a4a6fd60e62
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        webext.sc.lz4
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mk4n81w.default-release\startupCache\webext.sc.lz4
                                                                                                                                                                                                                        • Size 104KB
                                                                                                                                                                                                                        • SHA256 feac59a30a718265af6e4d5c4a50cc1e0dac1d27ad15e6ac395b652cba173f38
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        7a801a2a-b4e7-4c72-9e81-a0455174e435.tmp
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\7a801a2a-b4e7-4c72-9e81-a0455174e435.tmp
                                                                                                                                                                                                                        • Size 1B
                                                                                                                                                                                                                        • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        mozilla-temp-18467
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-18467
                                                                                                                                                                                                                        • Size 1.4MB
                                                                                                                                                                                                                        • SHA256 944f8cc9c85fd373e507d912809a48147907cb9c33187ef2470fa7c325b13f8a
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        mozilla-temp-41
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41
                                                                                                                                                                                                                        • Size 1.2MB
                                                                                                                                                                                                                        • SHA256 d678a8f8c047a630b18425a8b55c5f91043fecdbc6e2e3036be38d060b58d03a
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        mozilla-temp-6334
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-6334
                                                                                                                                                                                                                        • Size 1.4MB
                                                                                                                                                                                                                        • SHA256 b4c150e9372f86f752d6a04d26a3d6742a418874341ccb4a02848fe577683ba2
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        SimpleSC.dll
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\nsb863F.tmp\SimpleSC.dll
                                                                                                                                                                                                                        • Size 1.1MB
                                                                                                                                                                                                                        • SHA256 1620cdf739f459d1d83411f93648f29dcf947a910cc761e85ac79a69639d127d
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        modern-wizard.bmp
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\nsb863F.tmp\modern-wizard.bmp
                                                                                                                                                                                                                        • Size 25KB
                                                                                                                                                                                                                        • SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        nsDialogs.dll
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\nsb863F.tmp\nsDialogs.dll
                                                                                                                                                                                                                        • Size 9KB
                                                                                                                                                                                                                        • SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        nsis_tauri_utils.dll
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\nsb863F.tmp\nsis_tauri_utils.dll
                                                                                                                                                                                                                        • Size 30KB
                                                                                                                                                                                                                        • SHA256 7317e5508923f425bced2698bb89f79b00fcddcd1028f44b598732b2e3711464
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        System.dll
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\nsg8610.tmp\System.dll
                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                        • SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        remote-settings-startup-bundle-
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
                                                                                                                                                                                                                        • Size 531KB
                                                                                                                                                                                                                        • SHA256 5ed89c57351b82fbdd8bae7b8a3156a88dfb27526896a21a05676046172aa9fb
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        content_new.js
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6060_1463824698\CRX_INSTALL\content_new.js
                                                                                                                                                                                                                        • Size 10KB
                                                                                                                                                                                                                        • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        tmpaddon
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                                                                                                                                                                        • Size 11KB
                                                                                                                                                                                                                        • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        tmpaddon-1
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                                                                                                                                                                                                                        • Size 502KB
                                                                                                                                                                                                                        • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Crashpad\settings.dat
                                                                                                                                                                                                                        • Size 280B
                                                                                                                                                                                                                        • SHA256 ca0b05abca571cf4a2f545c042861f1c2d08d9e757661bfccebf37d30f7bfb1d
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Crashpad\settings.dat
                                                                                                                                                                                                                        • Size 280B
                                                                                                                                                                                                                        • SHA256 e94c8ec24a17197ca4b4145aa6e05a91089860f194502d087c166f78edbab1a2
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Crashpad\settings.dat
                                                                                                                                                                                                                        • Size 280B
                                                                                                                                                                                                                        • SHA256 677a5b32a6c0a772a5ffffb64975bddb73fbba42e580526e606f28db950cbc76
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Crashpad\settings.dat
                                                                                                                                                                                                                        • Size 280B
                                                                                                                                                                                                                        • SHA256 0bdb466f7cf5c629ad789349eb71a18bf6456a6a9b459ab1033eb87e219b1b66
                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Crashpad\settings.dat
                                                                                                                                                                                                                        • Size 280B
                                                                                                                                                                                                                        • SHA256 67ce380aaf62627e5d363a77bc70a11ea46c63c2d5175068cc4485ac72773e5a
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        throttle_store.dat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Crashpad\throttle_store.dat
                                                                                                                                                                                                                        • Size 20B
                                                                                                                                                                                                                        • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        93a63c5e-abea-407f-ac03-1d01bb20d503.tmp
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\93a63c5e-abea-407f-ac03-1d01bb20d503.tmp
                                                                                                                                                                                                                        • Size 6KB
                                                                                                                                                                                                                        • SHA256 68ef6d268c79a35e2f73c8bc991b90e932b2cff07e54b155f41759df4a8b0fbf
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        f_00000f
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Cache\Cache_Data\f_00000f
                                                                                                                                                                                                                        • Size 525KB
                                                                                                                                                                                                                        • SHA256 c8598aca2a616f5fcdda15a95c5ee2d7c2be4ecc30edf67943c79e5ae97ee6e5
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        f_000011
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Cache\Cache_Data\f_000011
                                                                                                                                                                                                                        • Size 30KB
                                                                                                                                                                                                                        • SHA256 1e2fac9497ee2a87753b77b11e18da75aa0eb43a09aa868fae718451f510e747
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        f_000012
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Cache\Cache_Data\f_000012
                                                                                                                                                                                                                        • Size 36KB
                                                                                                                                                                                                                        • SHA256 0e0387d8872fd63edb55bc7a2681ad34ded4f828697ca129c1f55fce2576f01f
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        f_000013
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Cache\Cache_Data\f_000013
                                                                                                                                                                                                                        • Size 613KB
                                                                                                                                                                                                                        • SHA256 5bbad6fb1f731bc2eb316ccbd5c3211f6f02f963a546aa947cbd088c61abb0e8
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        f_000014
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Cache\Cache_Data\f_000014
                                                                                                                                                                                                                        • Size 521KB
                                                                                                                                                                                                                        • SHA256 ea70e69834290a7d60a5a59e6ca2833cf6a5420c95412231f57f3f8365590678
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        f_000015
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Cache\Cache_Data\f_000015
                                                                                                                                                                                                                        • Size 823KB
                                                                                                                                                                                                                        • SHA256 c9b85fdd95946b73866612b8a5f7298e13df429d54957f6e5f4bed3cd538b003
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        f_000016
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Cache\Cache_Data\f_000016
                                                                                                                                                                                                                        • Size 2.8MB
                                                                                                                                                                                                                        • SHA256 ad9a13c78366365c7e23504ee784c7b53dd3288d789d06c23a62f2c2b68412e5
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        the-real-index
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                        • Size 192B
                                                                                                                                                                                                                        • SHA256 6288decc5c4f3619bec9985f88b1f940de1a332481b8da7a93edfb066ccff4e4
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        the-real-index
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                        • Size 288B
                                                                                                                                                                                                                        • SHA256 a0828889388757aed3427a2643b4c7577f3566788dc2ec48e99fa095aec8be1e
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        the-real-index
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                        • Size 240B
                                                                                                                                                                                                                        • SHA256 16af77a91fe067541728a238311ab362bdd0d5023442d5093268c993d07f674e
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        the-real-index~RFe5a7b5b.TMP
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a7b5b.TMP
                                                                                                                                                                                                                        • Size 48B
                                                                                                                                                                                                                        • SHA256 df50307ccd885e3f46e05ff32683f59ce4f4168eff0bd615b16812cee13c3a06
                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Network Persistent State
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Network\Network Persistent State
                                                                                                                                                                                                                        • Size 111B
                                                                                                                                                                                                                        • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Network Persistent State~RFe5b6500.TMP
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Network\Network Persistent State~RFe5b6500.TMP
                                                                                                                                                                                                                        • Size 59B
                                                                                                                                                                                                                        • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        TransportSecurity
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                        • Size 188B
                                                                                                                                                                                                                        • SHA256 292361a82631d134a2ab208c498f353814253c5668125cdb4be3fb1e9ed8a476
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Preferences
                                                                                                                                                                                                                        • Size 6KB
                                                                                                                                                                                                                        • SHA256 bfac71a75f6b5bb83c811285921a405f51a3f5827661688bfe220be816818584
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Preferences
                                                                                                                                                                                                                        • Size 6KB
                                                                                                                                                                                                                        • SHA256 8d178dab34c8875b6649f2e2dfd4f990ff5b8300d24566dad2ea02160278acf9
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Preferences
                                                                                                                                                                                                                        • Size 6KB
                                                                                                                                                                                                                        • SHA256 2470cf475d46ebadcba6d3c8089edb2c73016e40d432f71fddbb45cf8b62af59
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Preferences
                                                                                                                                                                                                                        • Size 7KB
                                                                                                                                                                                                                        • SHA256 84a9117b4cebc5ef2f93ad3733738f14bc3cefb058034004abe26a4dc5886c2b
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Preferences
                                                                                                                                                                                                                        • Size 6KB
                                                                                                                                                                                                                        • SHA256 c7e2afdb827f95825e7efa23e2f74c9828429d5bafd1c9a9c700910219fc7c59
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Preferences
                                                                                                                                                                                                                        • Size 6KB
                                                                                                                                                                                                                        • SHA256 ff1cd791462dc97d8ece598d47fec941db14782ed231ca512e100a6cc4f89771
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Preferences
                                                                                                                                                                                                                        • Size 6KB
                                                                                                                                                                                                                        • SHA256 69aaa5ed8a0fd3ba23e5e511c1fa09a9b2de95fe2affc2e9bf2bd4dec1da4f11
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        data_0
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\GraphiteDawnCache\data_0
                                                                                                                                                                                                                        • Size 8KB
                                                                                                                                                                                                                        • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        data_1
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\GraphiteDawnCache\data_1
                                                                                                                                                                                                                        • Size 264KB
                                                                                                                                                                                                                        • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        data_2
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\GraphiteDawnCache\data_2
                                                                                                                                                                                                                        • Size 8KB
                                                                                                                                                                                                                        • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        data_3
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\GraphiteDawnCache\data_3
                                                                                                                                                                                                                        • Size 8KB
                                                                                                                                                                                                                        • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Local State
                                                                                                                                                                                                                        • Size 17KB
                                                                                                                                                                                                                        • SHA256 6e300faa84993c615f925f5b30e294212aad6335434cfb41d2b5679059f34259
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Local State
                                                                                                                                                                                                                        • Size 17KB
                                                                                                                                                                                                                        • SHA256 a70d4671b55f0469dd49efbce5101305cffd14dbee6b7f8ebb7f26f42412d8e3
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Local State
                                                                                                                                                                                                                        • Size 18KB
                                                                                                                                                                                                                        • SHA256 59e1d394d61331e1115c4ca9ae514cdb23b5ee09c87446b8fdc608afd677dcab
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Local State
                                                                                                                                                                                                                        • Size 17KB
                                                                                                                                                                                                                        • SHA256 fa11a9295a9450db17e96461e703ea328a3c895634977398e235aa0dba7b1135
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Local State
                                                                                                                                                                                                                        • Size 15KB
                                                                                                                                                                                                                        • SHA256 569ccbdf5ad7b0249e48802c37211afadd9cc1bb448521431f2116df65a48dce
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Local State
                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                        • SHA256 2b7df65bfdb7c72d705dc88685973853e7fb964e28ca86c9e6ccc99bfdd2c519
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Local State
                                                                                                                                                                                                                        • Size 3KB
                                                                                                                                                                                                                        • SHA256 d537260c3c5a2cd916ff666f14e7a98b4564e73ce6acd1f8137a42671b42fb11
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Local State
                                                                                                                                                                                                                        • Size 16KB
                                                                                                                                                                                                                        • SHA256 2129d3fb4c70faebfb5228b8396a1bd750c431916e985d7808977cd5c64ee038
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Local State
                                                                                                                                                                                                                        • Size 18KB
                                                                                                                                                                                                                        • SHA256 df2bb7062f77ee8afeaa90e5ac295d2c166a3b57c0a898e3a10b67a948391381
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Local State
                                                                                                                                                                                                                        • Size 15KB
                                                                                                                                                                                                                        • SHA256 108c10045adcc2e410c3ace911cbaa754bee4cee020b01ec3311fbf2a8165269
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Local State
                                                                                                                                                                                                                        • Size 17KB
                                                                                                                                                                                                                        • SHA256 91de7acacaffd091bfbb2fe08476bc3ed01ddc0b258c893a99ac4a3ef440df44
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Local State~RFe5a279e.TMP
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Local State~RFe5a279e.TMP
                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                        • SHA256 8c1ff8d04b7f2066b306f3dd2baa2d9fa9d93839b345477df59f669afee49dfe
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        index.dat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
                                                                                                                                                                                                                        • Size 362B
                                                                                                                                                                                                                        • SHA256 ba2489a26182a68d683fa1893831aa2ebb13fcd2844b2156a2a3e1cdf6df88a1
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        2a2e0412b8ad04a2.customDestinations-ms
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2a2e0412b8ad04a2.customDestinations-ms
                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                        • SHA256 4809227fc601323ed2a3cf1ef61d08ad0b1bfd27864142a7eff20ec6ced0bccd
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        2a2e0412b8ad04a2.customDestinations-ms
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2a2e0412b8ad04a2.customDestinations-ms
                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                        • SHA256 bb987396210b0d375b334784596e9f903aaa052b95566606d85f813742698dd3
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        B3XGR38P4I6QQ9H4X71B.temp
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\B3XGR38P4I6QQ9H4X71B.temp
                                                                                                                                                                                                                        • Size 19KB
                                                                                                                                                                                                                        • SHA256 549bbe22052c6a6f053b562c4771bab45936e11babd6c23bdbc9d096dd4a39ce
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        AlternateServices.bin
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\AlternateServices.bin
                                                                                                                                                                                                                        • Size 8KB
                                                                                                                                                                                                                        • SHA256 db901cb58ef193cbbf7ccb0cf7febeed9fdca0d4a20e10ab4d2fc4878b3da00d
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        AlternateServices.bin
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\AlternateServices.bin
                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                        • SHA256 395cbb62cc8af25cc382575a1aaac6aa679c69ccabe221d3877ac58c3a7cd032
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        AlternateServices.bin
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\AlternateServices.bin
                                                                                                                                                                                                                        • Size 13KB
                                                                                                                                                                                                                        • SHA256 57dcff27c19b4c9a047401de90a3405915ad587a1942664ea94d83c327bb7350
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        SiteSecurityServiceState.bin
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\SiteSecurityServiceState.bin
                                                                                                                                                                                                                        • Size 5KB
                                                                                                                                                                                                                        • SHA256 5c9484f52c2ef2e244bc98df3bc3ae2b10abf4bcc2ae3c07384a67e4c73314e5
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        addonStartup.json.lz4
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\addonStartup.json.lz4
                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                        • SHA256 36de7e553d4e3eb1c67b6166bc099bc8e0cabed98df04d574f40192aa2d9e826
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        bookmarks-2026-06-23_10_N8psKS-wvtEVJYn78GXEl_GOx1zsCPbtW2A4apQ7CF0=.jsonlz4
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\bookmarkbackups\bookmarks-2026-06-23_10_N8psKS-wvtEVJYn78GXEl_GOx1zsCPbtW2A4apQ7CF0=.jsonlz4
                                                                                                                                                                                                                        • Size 857B
                                                                                                                                                                                                                        • SHA256 c631c6b1b866064ac4a9a6a9efd63aca3f6f8894fbb6cc8132ba1c16e53af223
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        data.safe.tmp
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                                                                                                                        • Size 7KB
                                                                                                                                                                                                                        • SHA256 5bfa6aaa874d5024c9eb920d60e128de173a4469744ef5f9c7262254f0622440
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        data.safe.tmp
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                                                                                                                        • Size 132KB
                                                                                                                                                                                                                        • SHA256 4bfda3f9dd30c5f4944ea4d9a42106b41812039d288f3bded29906939472177a
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        data.safe.tmp
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                                                                                                                        • Size 139KB
                                                                                                                                                                                                                        • SHA256 316b28c03db26f40330fe04d53af0f144800ae4a0e6941818cc0cb2443febd9b
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        data.safe.tmp
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                                                                                                                        • Size 132KB
                                                                                                                                                                                                                        • SHA256 55a48575367dadf8077ebb783f25d4f6f709cc059599dfcae8398c87371a3ec9
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        data.safe.tmp
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                                                                                                                        • Size 31KB
                                                                                                                                                                                                                        • SHA256 cc56c2eebc2aee4e3c9e8423a5cfcddfa9d74a1343edca280b412dd547715427
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        data.safe.tmp
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                                                                                                                        • Size 6KB
                                                                                                                                                                                                                        • SHA256 053a350ceea4e833560c61db9e3702b05af003b89bffe6b2ddf47f36d98bc4db
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        data.safe.tmp
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                                                                                                                        • Size 31KB
                                                                                                                                                                                                                        • SHA256 53a4209658338c1ceb06a78d94e609b2159edeccda32536a4a6fd30db82f6e5b
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        events
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\datareporting\glean\events\events
                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                        • SHA256 e12b37c0c2aad8ab759d34903c4ecebb3d07b6c2e630b816b2fd2abe38399740
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        events
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\datareporting\glean\events\events
                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                        • SHA256 09b3aa84b33f111456d8a09352493e6dad5649e71f7bbecacead2ba95c7652fe
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        1fc8e75f-42b1-463f-8ab7-08a6c96ef553
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\datareporting\glean\pending_pings\1fc8e75f-42b1-463f-8ab7-08a6c96ef553
                                                                                                                                                                                                                        • Size 886B
                                                                                                                                                                                                                        • SHA256 1dde0b1aba78468307d4e6bb8c96abf07d4273a6812f1c46548ffb4f69043381
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        39d66cb8-ab6d-4c67-9cc5-b5fc76c2e871
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\datareporting\glean\pending_pings\39d66cb8-ab6d-4c67-9cc5-b5fc76c2e871
                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                        • SHA256 12b510b5f7b7224f3e6b5c000e78d08d6d7ef661e668de3fa2aaf0c66e5c5fee
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        469e2e4d-e2e7-4999-88c0-93dca1ace787
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\datareporting\glean\pending_pings\469e2e4d-e2e7-4999-88c0-93dca1ace787
                                                                                                                                                                                                                        • Size 235B
                                                                                                                                                                                                                        • SHA256 0556022e025216ef336abeaebbc49c1a2697ddb06df342814f2701276c0f0cbe
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        5105baca-ba5e-4bc9-adf3-230295e74669
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\datareporting\glean\pending_pings\5105baca-ba5e-4bc9-adf3-230295e74669
                                                                                                                                                                                                                        • Size 235B
                                                                                                                                                                                                                        • SHA256 ccad64614dc3f2b3efe0da12b6ea291e3ec7975a396f1ed7262a10a347f9ba17
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        5eed4ea7-8d71-4d88-a6ca-a907d6daf5d3
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\datareporting\glean\pending_pings\5eed4ea7-8d71-4d88-a6ca-a907d6daf5d3
                                                                                                                                                                                                                        • Size 5KB
                                                                                                                                                                                                                        • SHA256 c85753b9a6216e8d5ad10784762b0341a97b525869d8b4d84166528abc70a58b
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        7b64abc2-10e5-4db2-b7ad-ab67928e1094
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\datareporting\glean\pending_pings\7b64abc2-10e5-4db2-b7ad-ab67928e1094
                                                                                                                                                                                                                        • Size 883B
                                                                                                                                                                                                                        • SHA256 ddff4c5881bba881cb91115ed0785d85b9ec34eafe430c5dad06c52baceb2d52
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        93bc73a4-2b2e-4622-9fbe-7f63bd7b2560
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\datareporting\glean\pending_pings\93bc73a4-2b2e-4622-9fbe-7f63bd7b2560
                                                                                                                                                                                                                        • Size 962B
                                                                                                                                                                                                                        • SHA256 4944778bf1d25cf3bf313348c772c765d1261b41217712285581159ffd5f23e7
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        b5b04bf5-2275-42c9-9e76-e869d336ffa1
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\datareporting\glean\pending_pings\b5b04bf5-2275-42c9-9e76-e869d336ffa1
                                                                                                                                                                                                                        • Size 16KB
                                                                                                                                                                                                                        • SHA256 0e74821c3b224ee607f5d4682f332aae35e5f366f484e02dda2c25dddf8c9a50
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        fa8830c1-e615-4827-b645-cc17f8bfd54b
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\datareporting\glean\pending_pings\fa8830c1-e615-4827-b645-cc17f8bfd54b
                                                                                                                                                                                                                        • Size 235B
                                                                                                                                                                                                                        • SHA256 65db1c39fced6e47dc4896d7c5d7c411195063d6a031f84b510cdf3005bff485
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        extension-preferences.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\extension-preferences.json
                                                                                                                                                                                                                        • Size 942B
                                                                                                                                                                                                                        • SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        extensions.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\extensions.json
                                                                                                                                                                                                                        • Size 16KB
                                                                                                                                                                                                                        • SHA256 5f04deb553857a21416a0d89afbcb0f6b9c5cdbedc581e693e418e8f228d561e
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        gmpopenh264.dll
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                                                                                                                                                                                                                        • Size 1.1MB
                                                                                                                                                                                                                        • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        gmpopenh264.info
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                                                                                                                                                                                                                        • Size 116B
                                                                                                                                                                                                                        • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        manifest.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                                                                                                                                                                                                                        • Size 1002B
                                                                                                                                                                                                                        • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        widevinecdm.dll
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                                                                                                                                                                                                                        • Size 21.6MB
                                                                                                                                                                                                                        • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        prefs-1.js
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\prefs-1.js
                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                        • SHA256 cac849cd83a6c85f901f89acc488edd08bcda341df6e38a7b8b81dc51e4fb827
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        prefs-1.js
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\prefs-1.js
                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                        • SHA256 fa95fb1682257317cde6c2b8488d0428375183b841d9cdeece4ab769b6da8a81
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        prefs-1.js
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\prefs-1.js
                                                                                                                                                                                                                        • Size 8KB
                                                                                                                                                                                                                        • SHA256 80058051c938265a35522c7898c617625c54a0b5316ff3e94c4b82216a6ec981
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        prefs-1.js
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\prefs-1.js
                                                                                                                                                                                                                        • Size 6KB
                                                                                                                                                                                                                        • SHA256 6cf98d16cace89fad6e052c0298dd5cd23147eb2ab2be5e27a877f96330c6bf4
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        prefs-1.js
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\prefs-1.js
                                                                                                                                                                                                                        • Size 6KB
                                                                                                                                                                                                                        • SHA256 587cc8811d82eeb9dabd7b0ca54775426a46fdf32cb33c155586bf8455e92299
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        prefs-1.js
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\prefs-1.js
                                                                                                                                                                                                                        • Size 6KB
                                                                                                                                                                                                                        • SHA256 f78c81d82bf067724c0021f0ea08525824d438850632b304cb8aae6521421803
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        prefs.js
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\prefs.js
                                                                                                                                                                                                                        • Size 6KB
                                                                                                                                                                                                                        • SHA256 63c333591b0144d78da1f3ea87dedca6e089044589ed323a22697ad83c9feafc
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        prefs.js
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\prefs.js
                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                        • SHA256 88a22448fe6b61df2878901b52e776c67830e14c5702bd0efc6c108c5ad6da48
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        recovery.baklz4
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                        • SHA256 79bd20481021901fa0d6143bcbebcb8e176b6f8b5ed311d8031665ad6b03c404
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        recovery.baklz4
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                        • Size 6KB
                                                                                                                                                                                                                        • SHA256 4c4aa6efcefc485d5ae4d8946ab191d4777dac809051b87340b071de98214877
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        recovery.baklz4
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                        • Size 3KB
                                                                                                                                                                                                                        • SHA256 f675adf87ba56246778c85dc57a1e759017645338be2811b1473d3d618377389
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        recovery.baklz4
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                        • Size 11KB
                                                                                                                                                                                                                        • SHA256 44dc26539ae6baff62f62868446db7a105b4b1a6f92479f1dd46ddff0c64333a
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        recovery.baklz4
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                        • Size 6KB
                                                                                                                                                                                                                        • SHA256 f80d94d5f3935ba8415ab46c9020e5e9e5d17018deb3d0a590f97a3373cee18d
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        recovery.baklz4
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                        • Size 9KB
                                                                                                                                                                                                                        • SHA256 907bc8454cd2d077bd53ca36532ae2011a1525d2fe131091859a9e17a734be3f
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        recovery.baklz4
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                        • Size 6KB
                                                                                                                                                                                                                        • SHA256 3effca6f215cec965a87ecef4d755d76c1e5c65d54adf8916b7d0abab820d76e
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        recovery.baklz4
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                        • SHA256 13ee2ca02439f96f454e08d1698b9e7feb091a8c8fb6f23513c26fc56439c792
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        recovery.baklz4
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                        • Size 11KB
                                                                                                                                                                                                                        • SHA256 4151a1c242b8ebdee76679c97cc4ca781764eea0a3f92dde1e74681b17b62cd9
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        recovery.baklz4
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                        • SHA256 ae1c3f5aa446a8d81b0064b6bd35bd94e07ddc001e467bcbde1429b978faad89
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        recovery.jsonlz4
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                        • SHA256 e070ee266dc87ed1cf46abcb5f810e4d086e922ce947be9182ff854e183e848c
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        3140325527hBbDa.sqlite
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\storage\default\https+++www.roblox.com\idb\3140325527hBbDa.sqlite
                                                                                                                                                                                                                        • Size 48KB
                                                                                                                                                                                                                        • SHA256 0ee04c5716d29ff1d177b0645dc4882de1acb811c60bb58d976e1c978bd1b3a7
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        3140325527hBbDa.sqlite-wal
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\storage\default\https+++www.roblox.com\idb\3140325527hBbDa.sqlite-wal
                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                        • SHA256 a63a3492e9e3dc4b2d4c5c8a6ec4c340e410d6728c07cc20cb8cebe0032065a1
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        3140325527hBbDa.sqlite-wal
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\storage\default\https+++www.roblox.com\idb\3140325527hBbDa.sqlite-wal
                                                                                                                                                                                                                        • Size 88KB
                                                                                                                                                                                                                        • SHA256 f41c05a6cef71210a3aeaf4c8dd036ecd82827e7b0d5db8471f3a3eb479ff017
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        usage
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\storage\default\https+++www.roblox.com\ls\usage
                                                                                                                                                                                                                        • Size 12B
                                                                                                                                                                                                                        • SHA256 9b79901fa403c758036c5b00d7d869be780c32130955eb68934e72ff1b091dbf
                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        usage
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\storage\default\https+++www.roblox.com\ls\usage
                                                                                                                                                                                                                        • Size 12B
                                                                                                                                                                                                                        • SHA256 f0a1ee23cf5a26fb2648dc2e66485be47366f02c7955e7f1d3d3ba75f6795896
                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        3870112724rsegmnoittet-es.sqlite
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                                                                                                                                                                        • Size 7.1MB
                                                                                                                                                                                                                        • SHA256 e757cac09d758687033df3a7d77a4664c3bbf00c8b809b1dae11c40a8614b218
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        3870112724rsegmnoittet-es.sqlite
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mk4n81w.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                                                                                                                                                                        • Size 7.1MB
                                                                                                                                                                                                                        • SHA256 406e1bd74c2e1935f3ecd1cfb1382ea132a04255b15195103f191d55016e29e9
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        .window-state.json
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\io.safing.portmaster\.window-state.json
                                                                                                                                                                                                                        • Size 215B
                                                                                                                                                                                                                        • SHA256 385b8d641d23965af3b016490e0641e52ad82f02d636e17cd4c654dc01fc331a
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        MaxeysVisuals_2.6.zip.crdownload
                                                                                                                                                                                                                        • Path C:\Users\Admin\Downloads\MaxeysVisuals_2.6.zip.crdownload
                                                                                                                                                                                                                        • Size 3.5MB
                                                                                                                                                                                                                        • SHA256 5c5c5157beb1a6c25eb13bfd4f547447b13e79a2fc5e707aaf36433a27a92a7a
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        RobloxPlayerInstaller-7QFB72KB9K.exe
                                                                                                                                                                                                                        • Path C:\Users\Admin\Downloads\RobloxPlayerInstaller-7QFB72KB9K.exe
                                                                                                                                                                                                                        • Size 9.8MB
                                                                                                                                                                                                                        • SHA256 22858fa38591e6f06b10adff0a994b624c8c45b1ff8cc9f349adcdaaf2cbef7b
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        __PSScriptPolicyTest_gmi1f45q.520.ps1
                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\__PSScriptPolicyTest_gmi1f45q.520.ps1
                                                                                                                                                                                                                        • Size 60B
                                                                                                                                                                                                                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        hyph-bn.hyb
                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1808_1505229635\hyph-bn.hyb
                                                                                                                                                                                                                        • Size 703B
                                                                                                                                                                                                                        • SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        hyph-mr.hyb
                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1808_1505229635\hyph-mr.hyb
                                                                                                                                                                                                                        • Size 687B
                                                                                                                                                                                                                        • SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        hyph-nn.hyb
                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1808_1505229635\hyph-nn.hyb
                                                                                                                                                                                                                        • Size 141KB
                                                                                                                                                                                                                        • SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        manifest.json
                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3292_1661903282\manifest.json
                                                                                                                                                                                                                        • Size 43B
                                                                                                                                                                                                                        • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        manifest.json
                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3292_386093185\manifest.json
                                                                                                                                                                                                                        • Size 135B
                                                                                                                                                                                                                        • SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        protocols.json
                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3292_386093185\protocols.json
                                                                                                                                                                                                                        • Size 3KB
                                                                                                                                                                                                                        • SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Staging
                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3292_447293527\Mu\Staging
                                                                                                                                                                                                                        • Size 36B
                                                                                                                                                                                                                        • SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        verified_contents.json
                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1389316960\_metadata\verified_contents.json
                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                        • SHA256 c50e8b66b9c681cbc2fa16cb2d8fd7cc934df1a7863dcf4f0ebedf6a5b78638d
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        keys.json
                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1389316960\keys.json
                                                                                                                                                                                                                        • Size 8KB
                                                                                                                                                                                                                        • SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        manifest.json
                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1389316960\manifest.json
                                                                                                                                                                                                                        • Size 79B
                                                                                                                                                                                                                        • SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        crl-set
                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1977557427\crl-set
                                                                                                                                                                                                                        • Size 22KB
                                                                                                                                                                                                                        • SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        manifest.json
                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1977557427\manifest.json
                                                                                                                                                                                                                        • Size 113B
                                                                                                                                                                                                                        • SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        LICENSE
                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_957833800\LICENSE
                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                        • SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        memory/796-809-0x00007FF789050000-0x00007FF78A74C000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1372-654-0x00007FF949F80000-0x00007FF949F81000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1408-1262-0x000001C2D6FF0000-0x000001C2D70A2000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1788-1164-0x0000014461000000-0x00000144610B2000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2712-947-0x00007FF789050000-0x00007FF78A74C000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2712-928-0x00007FF789050000-0x00007FF78A74C000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2712-568-0x00007FF789050000-0x00007FF78A74C000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2712-817-0x00007FF789050000-0x00007FF78A74C000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2712-848-0x00007FF789050000-0x00007FF78A74C000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2712-873-0x00007FF789050000-0x00007FF78A74C000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2712-913-0x00007FF789050000-0x00007FF78A74C000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2712-922-0x00007FF789050000-0x00007FF78A74C000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2712-965-0x00007FF789050000-0x00007FF78A74C000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2712-1044-0x00007FF789050000-0x00007FF78A74C000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2712-1095-0x00007FF789050000-0x00007FF78A74C000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2712-1138-0x00007FF789050000-0x00007FF78A74C000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2712-1210-0x00007FF789050000-0x00007FF78A74C000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2712-1289-0x00007FF789050000-0x00007FF78A74C000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2712-2121-0x00007FF789050000-0x00007FF78A74C000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2712-2107-0x00007FF789050000-0x00007FF78A74C000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2712-1999-0x00007FF789050000-0x00007FF78A74C000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2712-1333-0x00007FF789050000-0x00007FF78A74C000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2712-1851-0x00007FF789050000-0x00007FF78A74C000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2712-1698-0x00007FF789050000-0x00007FF78A74C000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2712-1687-0x00007FF789050000-0x00007FF78A74C000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2712-1681-0x00007FF789050000-0x00007FF78A74C000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2712-1502-0x00007FF789050000-0x00007FF78A74C000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2712-1470-0x00007FF789050000-0x00007FF78A74C000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2712-1469-0x00007FF789050000-0x00007FF78A74C000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2712-1468-0x00007FF789050000-0x00007FF78A74C000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2712-1457-0x00007FF789050000-0x00007FF78A74C000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2712-1456-0x00007FF789050000-0x00007FF78A74C000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2712-1411-0x00007FF789050000-0x00007FF78A74C000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2712-1391-0x00007FF789050000-0x00007FF78A74C000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2712-1381-0x00007FF789050000-0x00007FF78A74C000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2712-1350-0x00007FF789050000-0x00007FF78A74C000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3608-450-0x0000000003F20000-0x000000000403C000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3608-520-0x0000000004360000-0x000000000447C000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4572-1202-0x0000000005FC0000-0x00000000060DC000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4808-703-0x00007FF949F80000-0x00007FF949F81000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5060-1085-0x0000028C73D90000-0x0000028C73F52000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5060-1086-0x0000028C74490000-0x0000028C749B8000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5148-1074-0x00007FF94A790000-0x00007FF94A791000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5148-1073-0x00007FF94B850000-0x00007FF94B851000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5164-2499-0x00000222FDF20000-0x00000222FDFD2000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5600-2541-0x00007FF6E1780000-0x00007FF6E2E7C000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5600-2586-0x00007FF6E1780000-0x00007FF6E2E7C000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5600-2617-0x00007FF6E1780000-0x00007FF6E2E7C000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5768-589-0x0000017725D60000-0x0000017725D7E000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5768-799-0x0000017725D50000-0x0000017725D7A000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5768-583-0x0000017725D30000-0x0000017725D3A000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5768-582-0x0000017725F90000-0x0000017726042000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5768-581-0x0000017725D10000-0x0000017725D2E000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5768-576-0x0000017725C50000-0x0000017725C72000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5768-800-0x0000017725D50000-0x0000017725D74000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/6064-1144-0x0000019EFAF30000-0x0000019EFAFE2000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/6080-1938-0x0000000006140000-0x000000000625C000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/6080-2228-0x0000000007BF0000-0x0000000007D0C000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/6376-1035-0x000001EFC3660000-0x000001EFC3712000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/6376-1048-0x000001EFC33C0000-0x000001EFC33D0000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/6376-1049-0x000001EFC33F0000-0x000001EFC340A000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/6384-2602-0x00007FF90BC40000-0x00007FF90BC50000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/6384-2603-0x00007FF90BC40000-0x00007FF90BC50000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/6384-2679-0x00007FF90BC40000-0x00007FF90BC50000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/6384-2606-0x00007FF909820000-0x00007FF909830000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/6384-2604-0x00007FF90BC40000-0x00007FF90BC50000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/6384-2605-0x00007FF909820000-0x00007FF909830000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/6384-2600-0x00007FF90BC40000-0x00007FF90BC50000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/6384-2601-0x00007FF90BC40000-0x00007FF90BC50000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/6560-926-0x0000000140000000-0x00000001405A7000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/6560-923-0x0000000140000000-0x00000001405A7000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/6560-924-0x00007FF94BD70000-0x00007FF94BD72000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/6560-925-0x00007FF94BD80000-0x00007FF94BD82000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/6560-929-0x0000000140000000-0x00000001405A7000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/6560-1248-0x0000000140000000-0x00000001405A7000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/6596-1297-0x000001B6728F0000-0x000001B6729A2000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/6852-1234-0x0000027C5CB50000-0x0000027C5CB51000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/6852-1236-0x0000027C5CB50000-0x0000027C5CB51000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/6852-1235-0x0000027C5CB50000-0x0000027C5CB51000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/6852-1233-0x0000027C5CB50000-0x0000027C5CB51000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/6852-1232-0x0000027C5CB50000-0x0000027C5CB51000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/6852-1231-0x0000027C5CB50000-0x0000027C5CB51000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/6852-1225-0x0000027C5CB50000-0x0000027C5CB51000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/6852-1227-0x0000027C5CB50000-0x0000027C5CB51000-memory.dmp
                                                                                                                                                                                                                        Download