6c74fe71010461c403417d3c08f9633da75024b6af628a6a70bb742aa50520d9

Resubmissions

25/06/2026, 00:44

260625-a3klqagy8j6

25/06/2026, 00:22

260625-an6weagy6q6

Analysis

user interaction
yes
max time kernel
474s
max time network
473s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/06/2026, 00:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PARTYNEXTDOOR - RESENTMENT (Official Visualizer) 0-vocals-C major-94bpm-451hz - Part_1.wav
Size 220KB
Sample260625-a3klqagy8j
SHA256 6c74fe71010461c403417d3c08f9633da75024b6af628a6a70bb742aa50520d9
MD5 92187bae258c9ed7b5a8084b4ac419bc
SHA1 c64b58539b21475bea2a3df250e1ba84f0b2a31b
SHA512 de98340344b7011a43405287303b5899357f6acad5337731a24e6852c529ec101eb674d14dbcee5d85724909d3fea5f42ff95cd3997b96551d931c0dbca8d1af
SSDEEP 6144:E1UIGibRso5oW/VtCr5oGIjeHTTh6+wipLOgTCOpnGf:m1dKo5oW/nCSNCP0+wiVf6
TLSH
T136240262E5737E045BA3C7224EC29C140A99F14D9CF61E7FAE06CE64B0667007BB635E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe

Drops file in Program Files directory 27 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1884_1613433107\classification.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1884_1613433107\extraction.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1884_1613433107\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1884_1136762560\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1884_1338475867\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1884_1613433107\automation.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1884_1613433107\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1884_1136762560\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1884_1315012198\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1884_1315012198\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1884_1315012198\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1884_1382145069\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1884_1338475867\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1884_856050404\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1884_1613433107\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1884_1136762560\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1884_1315012198\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1884_1415746709\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1884_1382145069\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1884_2006127108\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1884_1338475867\smart_switch_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1884_856050404\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1884_1136762560\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1884_2006127108\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1884_1338475867\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1884_856050404\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1884_856050404\sets.json	msedge.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2904	780	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3504	chrome.exe
1336	msedge.exe
1200	chrome.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134268218953099011"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{245B97D6-B5CD-4531-89E3-ACF961925474}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1060	msedge.exe
1060	msedge.exe
2604	chrome.exe
2604	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	780	wmplayer.exe
Token: SeCreatePagefilePrivilege	780	wmplayer.exe
Token: SeShutdownPrivilege	3456	unregmp2.exe
Token: SeCreatePagefilePrivilege	3456	unregmp2.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
780	wmplayer.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 4588	780	wmplayer.exe	88
PID 4588 wrote to memory of 3456	4588	unregmp2.exe	89
PID 1676 wrote to memory of 1992	1676	chrome.exe	108
PID 1676 wrote to memory of 2320	1676	chrome.exe	109
PID 1676 wrote to memory of 2320	1676	chrome.exe	109
PID 1676 wrote to memory of 3504	1676	chrome.exe	110
PID 1676 wrote to memory of 4528	1676	chrome.exe	111
PID 1676 wrote to memory of 4528	1676	chrome.exe	111
PID 1676 wrote to memory of 3580	1676	chrome.exe	113
PID 1676 wrote to memory of 3580	1676	chrome.exe	113
PID 1676 wrote to memory of 920	1676	chrome.exe	114
PID 1676 wrote to memory of 920	1676	chrome.exe	114
PID 1676 wrote to memory of 5116	1676	chrome.exe	115
PID 1676 wrote to memory of 5116	1676	chrome.exe	115
PID 1676 wrote to memory of 4832	1676	chrome.exe	117
PID 1676 wrote to memory of 4832	1676	chrome.exe	117
PID 1676 wrote to memory of 4356	1676	chrome.exe	118
PID 1676 wrote to memory of 3860	1676	chrome.exe	123
PID 1676 wrote to memory of 1572	1676	chrome.exe	124
PID 1676 wrote to memory of 3308	1676	chrome.exe	125
PID 2328 wrote to memory of 1884	2328	msedge.exe	127
PID 1884 wrote to memory of 3500	1884	msedge.exe	128
PID 1884 wrote to memory of 1336	1884	msedge.exe	129
PID 1884 wrote to memory of 1900	1884	msedge.exe	130
PID 1884 wrote to memory of 1900	1884	msedge.exe	130
PID 1884 wrote to memory of 1900	1884	msedge.exe	130
PID 1884 wrote to memory of 4136	1884	msedge.exe	131
PID 1884 wrote to memory of 4136	1884	msedge.exe	131
PID 1884 wrote to memory of 896	1884	msedge.exe	132
PID 1884 wrote to memory of 4356	1884	msedge.exe	133
PID 1884 wrote to memory of 896	1884	msedge.exe	132
PID 1884 wrote to memory of 896	1884	msedge.exe	132
PID 1884 wrote to memory of 4356	1884	msedge.exe	133
PID 1884 wrote to memory of 4356	1884	msedge.exe	133
PID 1884 wrote to memory of 4280	1884	msedge.exe	135
PID 1884 wrote to memory of 4280	1884	msedge.exe	135
PID 1884 wrote to memory of 4280	1884	msedge.exe	135
PID 1884 wrote to memory of 1996	1884	msedge.exe	136
PID 1884 wrote to memory of 1996	1884	msedge.exe	136
PID 1884 wrote to memory of 1996	1884	msedge.exe	136
PID 1884 wrote to memory of 4596	1884	msedge.exe	141
PID 1884 wrote to memory of 4596	1884	msedge.exe	141
PID 1884 wrote to memory of 2036	1884	msedge.exe	142
PID 1884 wrote to memory of 2036	1884	msedge.exe	142
PID 1884 wrote to memory of 1216	1884	msedge.exe	144
PID 1884 wrote to memory of 1216	1884	msedge.exe	144
PID 1884 wrote to memory of 380	1884	msedge.exe	143
PID 1884 wrote to memory of 380	1884	msedge.exe	143
PID 1884 wrote to memory of 4432	1884	msedge.exe	146
PID 1884 wrote to memory of 2244	1884	msedge.exe	147
PID 1884 wrote to memory of 2244	1884	msedge.exe	147
PID 1884 wrote to memory of 2068	1884	msedge.exe	148
PID 1884 wrote to memory of 2068	1884	msedge.exe	148
PID 1884 wrote to memory of 4116	1884	msedge.exe	149
PID 1884 wrote to memory of 4116	1884	msedge.exe	149
PID 1884 wrote to memory of 1252	1884	msedge.exe	150
PID 1884 wrote to memory of 1252	1884	msedge.exe	150
PID 1884 wrote to memory of 3508	1884	msedge.exe	151
PID 1884 wrote to memory of 3508	1884	msedge.exe	151
PID 1884 wrote to memory of 4056	1884	msedge.exe	154
PID 1884 wrote to memory of 4056	1884	msedge.exe	154
PID 1884 wrote to memory of 4056	1884	msedge.exe	154
PID 1884 wrote to memory of 4436	1884	msedge.exe	153
PID 1884 wrote to memory of 4436	1884	msedge.exe	153

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\PARTYNEXTDOOR - RESENTMENT (Official Visualizer) 0-vocals-C major-94bpm-451hz - Part_1.wav"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:780
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:3456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 2296
  2⤵
  - Program crash
  PID:2904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 780 -ip 780
1⤵
PID:4356

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff81971c728,0x7ff81971c734,0x7ff81971c740
  2⤵
  PID:1992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,17549693407267870826,18267659886768772483,262144 --field-trial-handle=1968,i,3199145817451698668,9226373674874930206,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1964 /prefetch:2
  2⤵
  PID:2320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,12449172781123181225,12383022619595637904,524288 --field-trial-handle=1968,i,3199145817451698668,9226373674874930206,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,17530823317906021006,13015506961068005379,524288 --field-trial-handle=1968,i,3199145817451698668,9226373674874930206,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2320 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,1065776773525381147,12741540365159409298,2097152 --field-trial-handle=1968,i,3199145817451698668,9226373674874930206,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3420,i,9165250943506119290,10615757063696911528,2097152 --field-trial-handle=1968,i,3199145817451698668,9226373674874930206,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4524,i,11170877730865054688,2299976043022596312,2097152 --field-trial-handle=1968,i,3199145817451698668,9226373674874930206,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4544 /prefetch:2
  2⤵
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4704,i,6979960667836597240,16581717825080128355,2097152 --field-trial-handle=1968,i,3199145817451698668,9226373674874930206,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4028 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5476,i,10766398241961201991,13763267779204770417,524288 --field-trial-handle=1968,i,3199145817451698668,9226373674874930206,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5820,i,9237139370305158072,12266850763717285693,524288 --field-trial-handle=1968,i,3199145817451698668,9226373674874930206,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:3860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5472,i,10695148456392617633,15169392961782569963,524288 --field-trial-handle=1968,i,3199145817451698668,9226373674874930206,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:1572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,3665153241908992586,8002028704466054873,524288 --field-trial-handle=1968,i,3199145817451698668,9226373674874930206,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:3308

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ff81a5fc188,0x7ff81a5fc194,0x7ff81a5fc1a0
    3⤵
    PID:3500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,10133572341721165269,11642932141195016820,524288 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1720,i,12392533372837439450,4841277682002431189,262144 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
    3⤵
    PID:1900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,15606711198893731554,15854822767745659345,524288 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
    3⤵
    PID:4136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,6557348508424838853,11377272423138313406,2097152 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,9100031655141657220,3320986640864938787,2097152 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
    3⤵
    PID:4356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,4953971186340872099,13199318679573441481,2097152 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
    3⤵
    PID:4280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,18371257640446923965,16676092922620785167,2097152 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
    3⤵
    PID:1996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,7652254471819888058,6601295510333732826,524288 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
    3⤵
    PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,1267274120738659876,13122287336719604076,524288 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
    3⤵
    PID:2036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,14836678690903111373,12254070610896290969,524288 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:8
    3⤵
    PID:380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,16078047380564682090,7312143278323045885,524288 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
    3⤵
    PID:1216
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,14403899369520303104,12231625083207438622,524288 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
    3⤵
    PID:2588
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,14403899369520303104,12231625083207438622,524288 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
    3⤵
    PID:4432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,6130504583051506799,14581938162867708226,524288 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
    3⤵
    PID:2244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,4755708232850048838,7537523270910651082,524288 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:8
    3⤵
    PID:2068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,1055036887706935911,8308636119699758183,524288 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
    3⤵
    PID:4116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,16736723045557276089,4843989089373033240,524288 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:8
    3⤵
    PID:1252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,13337054450053989184,313293714534899467,524288 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:8
    3⤵
    PID:3508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3692,i,7077390089239235060,13670563419081592934,2097152 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:1
    3⤵
    PID:4436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6680,i,10208757871648316409,18312978489837461187,2097152 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:1
    3⤵
    PID:4056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4916,i,2490935155455181521,18170523124235108845,2097152 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
    3⤵
    PID:2124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6040,i,1481343965023646554,439377556039513988,2097152 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:1
    3⤵
    PID:4408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4408,i,2554845202070615004,4076730281363715635,2097152 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
    3⤵
    PID:3792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6468,i,5616168658790411249,2267512629829035887,2097152 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
    3⤵
    PID:4692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,14066598001910147885,15907160576815033658,524288 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
    3⤵
    PID:4948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,1475994321646606842,17421515044964037765,524288 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:8
    3⤵
    PID:436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,4321714923238507141,16370844220175620051,524288 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:8
    3⤵
    PID:3048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=2776,i,10319850837283982968,4746874734026004648,2097152 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:1
    3⤵
    PID:3024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,9682180642381951333,15470494955807367974,524288 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
    3⤵
    PID:2320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,12232238169281798191,10575330951344243818,524288 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:8
    3⤵
    PID:4308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6804,i,5674648846709841379,1761377282281523932,524288 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:8
    3⤵
    PID:1036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,15823822398555518876,9917278205726877323,524288 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:8
    3⤵
    PID:2288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6456,i,12750389963662505192,14159147774865305438,262144 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,3540154614731135784,7445402204316386793,524288 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
    3⤵
    PID:1636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,5383510293450324052,3123158262674281907,524288 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:8
    3⤵
    PID:3928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,13588203437061767963,2671365791659941716,524288 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:8
    3⤵
    PID:4424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7164,i,10043836426261658197,14114669383001372204,524288 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
    3⤵
    PID:2052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,9298111684795518227,16241400745867614734,524288 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:8
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,7360792460487705056,15715855735109140787,524288 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
    3⤵
    PID:3852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,4864753462296200207,256597666637915700,524288 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:8
    3⤵
    PID:5108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,36148177993950109,10310480094821638825,524288 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:8
    3⤵
    PID:2324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,4250447858841245192,4653122440971402156,524288 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:8
    3⤵
    PID:4292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=4524,i,14608082453763500082,10523542796371670958,2097152 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
    3⤵
    PID:5032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=6212,i,7016339326957649406,2662895971038500706,2097152 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:1
    3⤵
    PID:920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=6712,i,2624928310619631769,250892592542896695,2097152 --field-trial-handle=2312,i,13030141573348372221,1037932597355179825,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:1
    3⤵
    PID:1532

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4432

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff81971c728,0x7ff81971c734,0x7ff81971c740
  2⤵
  PID:1432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1924,i,5827114202487526637,17245578711292120945,524288 --field-trial-handle=2060,i,10522074159564456229,11054208962853872446,262144 --variations-seed-version=20260624-090053.323000-production --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1644,i,538215026282175434,18305778364437682673,262144 --field-trial-handle=2060,i,10522074159564456229,11054208962853872446,262144 --variations-seed-version=20260624-090053.323000-production --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:2764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,1947065316300483701,574751499639524894,524288 --field-trial-handle=2060,i,10522074159564456229,11054208962853872446,262144 --variations-seed-version=20260624-090053.323000-production --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:1880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3152,i,746099788992013455,16460026569138649258,2097152 --field-trial-handle=2060,i,10522074159564456229,11054208962853872446,262144 --variations-seed-version=20260624-090053.323000-production --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3156,i,13615111594355359397,17796332696321895944,2097152 --field-trial-handle=2060,i,10522074159564456229,11054208962853872446,262144 --variations-seed-version=20260624-090053.323000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4540,i,3795035452639789984,13847351237894025967,2097152 --field-trial-handle=2060,i,10522074159564456229,11054208962853872446,262144 --variations-seed-version=20260624-090053.323000-production --mojo-platform-channel-handle=4492 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4648,i,5928268125123265746,5020605390358296886,524288 --field-trial-handle=2060,i,10522074159564456229,11054208962853872446,262144 --variations-seed-version=20260624-090053.323000-production --mojo-platform-channel-handle=4704 /prefetch:8
  2⤵
  PID:2128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4848,i,1700093372490974386,3072758932951837763,524288 --field-trial-handle=2060,i,10522074159564456229,11054208962853872446,262144 --variations-seed-version=20260624-090053.323000-production --mojo-platform-channel-handle=4676 /prefetch:8
  2⤵
  PID:4040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5296,i,6104774004541607783,5017135665115633050,524288 --field-trial-handle=2060,i,10522074159564456229,11054208962853872446,262144 --variations-seed-version=20260624-090053.323000-production --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5532,i,17613178755383407342,9229234986613813409,2097152 --field-trial-handle=2060,i,10522074159564456229,11054208962853872446,262144 --variations-seed-version=20260624-090053.323000-production --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4644,i,11430609535096297034,1724457869923166763,2097152 --field-trial-handle=2060,i,10522074159564456229,11054208962853872446,262144 --variations-seed-version=20260624-090053.323000-production --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5648,i,11274706045305789972,3197258188653337341,524288 --field-trial-handle=2060,i,10522074159564456229,11054208962853872446,262144 --variations-seed-version=20260624-090053.323000-production --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  PID:2244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3284,i,16430865224808567701,16421281829687491504,524288 --field-trial-handle=2060,i,10522074159564456229,11054208962853872446,262144 --variations-seed-version=20260624-090053.323000-production --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:2472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3184,i,9393301790557620958,2273963594820875153,524288 --field-trial-handle=2060,i,10522074159564456229,11054208962853872446,262144 --variations-seed-version=20260624-090053.323000-production --mojo-platform-channel-handle=3416 /prefetch:8
  2⤵
  PID:4856

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LICENSE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1884_1136762560\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1884_1136762560\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1884_1315012198\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1884_1338475867\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1884_1382145069\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1884_1415746709\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1884_1613433107\manifest.json
Size 135B
SHA256 cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5
MD5 4055ba4ebd5546fb6306d6a3151a236a
SHA1 609a989f14f8ee9ed9bffbd6ddba3214fd0d0109
SHA512 58d39f7ae0dafd067c6dba34c686506c1718112ad5af8a255eb9a7d6ec0edca318b557565f5914c5140eb9d1b6e2ffbb08c9d596f43e7a79fdb4ef95457bf29a
TLSH
T1CEC09223CC019CB119743B642AB2AB82F7B41B0B6869705A3AB3148C1F7E1B48082680
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1884_2006127108\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1884_856050404\manifest.json
Size 85B
SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
MD5 8ce95626b39ebc2401eee0b34c24fc7c
SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
TLSH
T106A0121018015DE318880320213143D2D3A51C05247437001106108019B8636027A22E
MD5 SHA1 SHA512 TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 ae1bddb9e2cc97b0c9cd78ef3cd17553be6e5204677bd67e0b8f7fa27007f189
MD5 b0366599d64b0fc1adb2a712dcd02ee1
SHA1 b7a1c09ccd2846664cab5f76bd80b8e9f107acb0
SHA512 d7de6d48285018f8b709c81ca01688126db7893ce9f48829524ee3122aa6f2200c7f78186b5a558d0b1ecf8157ee78a20064b63b45ab89f7aa0835b8409435d0
SSDEEP 12:bHCsEXhVMMBKEKSCemJKlkQyYVhYJ0I+pPK6BsyW1inP6:biPROMMBS+MkIYWIE1BtXP
TLSH
T117252786A30815EFC54288B589AE03602374F9E55F52079B2E2DAA1F2E271D80F45164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 a9bc91a3244e7d72467b656c5486d15c0ed9f92add88f691c3853e2b856cbd81
MD5 b1e1deec2c4182d0013a230b355f4c7d
SHA1 126437183b8f548051a3f561eea1eb0ee68fc9cc
SHA512 e718639402727b342725497f1be1fb31c240520b2883d9791df2e05dd851d0e309e06e9942c2a24d6090668922ba1d9f9a1ebf9b87311e7d55ee2d605549ce06
MD5 SHA1 SHA512

Submit Download

7fea7b69-866f-471d-b936-22fd33f79c00.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7fea7b69-866f-471d-b936-22fd33f79c00.tmp
Size 12KB
SHA256 984cb05328862c92f159cd3dc412284db4e64bd63045e8da089479758ed95d40
MD5 aa0f5cac76c0423dbce28fc54ff479c6
SHA1 bd1da06047ce6804b3554b72fc0b6b4f56a3e1ce
SHA512 3c40c6785fc9d6585002be123cc1d345bbcec60071d9fbe3056e218bfe209b26ef4d880310db37c3a194bb39a8af79afadb3df049180cc3e8b4480569c9f959c
SSDEEP 192:WRcgy/I5Rj2ACv7MF+pAPRp2S9HHsb+WNnWy40ckP7D8kwEaKVyIsnAUgtaJ:WRcbERfOgoUX91wn401PskaK8
TLSH
T1A642C76EED21697B6CCAC219FD527B13D7F5102131D41E44EAFD8A2C18E76CC621741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ca0f4e6afd97cfd1f8c10009be469c1f5e50a08d7a00c495b99d8d8037b70803
MD5 b128f62e26560ca234a0a5c8db76cfaf
SHA1 01bab3b4c026de7f5665f7f443a25cdf5b4ccf96
SHA512 599ca8b63b00feef8174e2de956c4771717144b836ea403b76f3ce7b0da803e3f3202a0ebccd26a04d193f0a1f5b89d2dede59401548d30cc66ced5ff32b2202
TLSH
T139E02BA5C932DC3718FC171878654705EA41235B2740994F373D410C4FB977A458685C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f67ed522df1e084c1db59419fa32fb9398526fd5076acea1fa74255fe74789ef
MD5 7f9116d141d674dcd82bc58c72cbb5d4
SHA1 d03157e8e1b7ed73c8b903a4ef096f56ee406241
SHA512 a5d9808c983aec0dc3c787bb75d7e82cfc6f9b51a7b75bcf93053e954282ccfd932706330043bc916d7c5b26568698e1f1e450c791a6d738a74c2803ee285eb6
TLSH
T105519AF7C3E4866D891192F4AA217E1FCD3D0A24531C3C6688D4AF1B43E28B2E20178E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 88df843c2029f91ec40d4931d82853c83aa207d44b1920973a6ae238454f1ac6
MD5 cae15934040fe9effdb7e4d3c79b5300
SHA1 549334920a4eabc282add3b868089b7dd69ff738
SHA512 93e428fe984ac15206d8a5ab5eb182a90849b5007d6b0c90063e644c97e12ca47a737bebd886cd2993599a1c6fa0614d6808f70efdc96d11be8b54bc133b80c4
TLSH
T197518BF7C3E48A6D891196F4AB256E2FCD6D0A24432C3C66C8D4AF5B53F2872D24174E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 779f4a737986a7980219bf2067c25a2cd89f3a28dc494af6300baf17cd817e76
MD5 17e2cf74678371f8bbe8d8a82d60bb84
SHA1 82e8820d90cab2b912f3f75faed04f52469db3d1
SHA512 ef471d403807fdef3adc7a2793db15bf04ec52cba03b93a734c19f9728f59ba5e995689862e291e745011d9884fd0c5f2bf3bae247d766121551446230c55ae3
TLSH
T136518CF7C3E48A6D891196F4AB256E2FCD6D0A24432C3C66C8D4AF5B53F2872D24174E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 4e668da26607177043ce35bd403d8cc95dff893664cbe46ba2e348c6da8dacb1
MD5 63f5f854b16ca3d048707b9d3efdffaa
SHA1 cfb316ffeff52cd7e99dccbb26f246f860452a9a
SHA512 ac2810b2e9ca582cb56b75a4017c3a68801111102d7d260c56417f6b01fb7e5eb15c4f22f399b53c22d7b0ab5d31355f9610c5a40dd216e18fbf1deb59d72b18
TLSH
T1A4F059A7A76AB42760BE06BB1D14BC49A5BDB43403805CE8DE9A823CE0814F35F26407
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 eda7bf2e95758f65adf4e6f0fa4c680addb7c65f582e3df745862e94d3dd0190
MD5 f807e5351985159114412e344a86b71f
SHA1 d72d8e52e81f850380ed7f532a7f2f4f52058818
SHA512 e9b86bf2a90c1685fcb8d91c6466e0073c240da5a4b1308abb17d270f7271fbe1f55d75a272a4bd6e24e81ae6c5b412379368f333e802a417f518d7a7e1abc1a
SSDEEP 192:WRcgy/I5Rj2AAv7MF+pAPRp2S9HHsb+WNnWy40YkP7D8kwEagVyIsnAUgraJ:WRcbERfcgoUX91wn40BPskake
TLSH
T13E42C66EED11697B6CCAC229FD527B13E7F6202121C41E44EBFD8A2C19EB6CC6217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 11dd88932af305f267a2aa0f9e08e4ae6ccd8d3a11ac620696701df435010ed5
MD5 c3ef05b6b945a645682c5dd44cbadb68
SHA1 749ac133ea33af094d337db699e8b7e7711f6ad7
SHA512 6af22013533f7829af289e63d8795aa4ddffe73886d9946b246350a95b1235e53358d53cb083d2c2945efbbfdb2b718c5f283662d679e4cc7cb948faab78c160
SSDEEP 192:9RcgyGbHzw2Oiwv7MF+pVPRpRs99HHsb+WNn3UQx224kP7D8kwEaEVyIsnAUgraJ:9RcbYVsgoPXy1wkP2hPskaAe
TLSH
T1B752D76EED21697B6DCAC219FD667B13D3F5103222D41E44EAFC8A2C19EB6CC6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 dd5b715125e4cc0b60adf63cb46158280be3e4945e8057f5fcd64d0f2b03931a
MD5 9ac463cd88937a5bc01250d796c94926
SHA1 6eeea1b4aaac9c73964dad4d792f058348e2923b
SHA512 2274d271606133feec4a2d832c28c7f6a540205f66f8a32c7663e98f8640003b9ab760a75ebbae89bef003ae9d99162ea806fb587d1e7671feef5f6f078fa8e8
TLSH
T17FB0124080015101C01602F411425488B118AF11B60A270193F1AE638875190C024154
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58cee4.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58cee4.TMP
Size 96B
SHA256 904e729a769e412cec31c8c9ab0f62fb79eefefa9870d9c33cbd4903a9814d26
MD5 de2a789f91e0fae78f2ec81d110f731e
SHA1 b12530d4f0a8913246ba23956fc8f81bcdadecd3
SHA512 09b6fbfbee486200f5b489d94a56b3cf13fa939c924e8c2c14d30df450db77b605f88b6023e9ba98cd419bca0f6206d0b1622d698b6edef69091b0148f482d98
TLSH
T15CB02220C0022203C08303F83A80C8C8B0A0CF22C203020AEAE00E33CC222A00020230
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 2acbb5b1c9d19ee30b2b391009a4dded6be8aaf88c4687ee75ccf9ba9c4f412a
MD5 e08d8e2da6bd9e8544c4a48552eebdd6
SHA1 1131d4dc917b5bd8a3479a56aaf6b66ca9676a41
SHA512 96f428f611a0bca76cc7b749d0c9377e6b33d8b5e77e8a0ca282ddee5a03f7809267f0fd4dfd0df3dd949532cc705e41b9178e1721ed3c1b903f8488a5c5200f
SSDEEP 6144:qeBx9rqZyf3xecZCpWa78Um7Rkm1tYpBeh2BAoT:qkx9mZyvxecvaq9oBGcAoT
TLSH
T158341233ED70FD3715B6A61EB189572F0DF049ABC824C9A1C4D9AB8836E56DD1909C3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 5d8792f9738f18b7e9ae09cc65f3f5b4224a2642f73864761dc7d0a7d50a1a4f
MD5 fbee5d92712c418462ec7f3da33a0887
SHA1 943765bbf20b2bfe3c91c861bfd2acbbdaad3faf
SHA512 c4b3ef8b060e7ee0b46754ea89edafdbd56eddcf0cdc3aee6c95521dde7af9a2d8a84e0fd36f05dbc1f45b59261ad27781a95e804dfd8a9b8998bb258f30fc15
SSDEEP 6144:5r/+XBx9rqZyf3xecZCpWa78Um7Rkm1tYpBeh2BAoT:5Ex9mZyvxecvaq9oBGcAoT
TLSH
T17D341237ED70BD3705B6A61EB189273B0DF04A6BCC14C991D4D9BB8832DA69D1A09C7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 87e5aca2a978a56215b3e940d017cc274c0c464361fac5e320a4f38e8efb823d
MD5 9cc60e952725c4b7582cd8fa1676d7c6
SHA1 4ebc1139c0b04051878b3fb3ade703c6466e7b48
SHA512 2878b4f4600dffa9976d6734e579305fcc1045a0d1b4944972ea351c82136f5f31dcb6fd44c0aca53e02b4b8edcddffff8cb01fc5a87f01e0dc950224f4a4d78
SSDEEP 6144:5eBx9rqZyf3xecZCpWa78Um7Rkm1tYpBeh2BAoT:5kx9mZyvxecvaq9oBGcAoT
TLSH
T134341233ED70FD3715B6A61EB189572F0DF049ABC824C9A1C4D9AB8836E96DD1909C3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 276KB
SHA256 9c4f37cea19ef955a43f5c1bec0948d34061c10b9aec79ad84e7e5c09e18fa85
MD5 beb2ba631bb99a2da3d2f3902e3d8e23
SHA1 0db1b5717df469f609d69006df0cbd04df4d3298
SHA512 cb8eead20b13b68528f782be71f4d121a8c518332b0cd42809a8fab91f65597422ab1a3628e94c32c162c3e248ac1fe89526358ad8b47f8c301106950b89cb1c
SSDEEP 6144:5hnnb1pKfQARh6jBx9rqZyf3xecZCpWa78Um7Rkm1tYpBeh2BAoT:5hn5A7Ex9mZyvxecvaq9oBGcAoT
TLSH
T170542333DD70BD3655B6971EB1896B3B0EF04A9FC828C592C4E56F8836AE58D0906C7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 7708b9d7ce7841139e24568485607282989859b10f35477f082581ececccaa68
MD5 104df519645680c76eae63aabba79dc4
SHA1 a8208c1b0664b1325cb7323747027cd01cca8663
SHA512 332a5b55485b6e87546ee99cf287cf56860c5e7c8fef0e4b69e4f59e7fd525c5bff01a0199cea5932a1c35ffb0cb422c6f1d2a9e27628883fac61781af436e53
SSDEEP 6144:5OeBx9rqZyf3xecZCpWa78Um7Rkm1tYpBeh2BAoT:57x9mZyvxecvaq9oBGcAoT
TLSH
T1FF341277ED30BD3705B6A61EB189272B0DF04A6BCC14D9A1C4D9BB8836DA6DD0909C78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 bc35dee822a621ffb3440b9cd6d496ad0a4e95dfc811a190cb5ad54bf505fce0
MD5 0d58757283ef2dccfce20ed217102395
SHA1 0f0959801166ae0daaaf4f9ef76dd4a4975d4ebf
SHA512 5488853c387f6c13297366ddd24cc5b4ec05c83a38e8f299ab1dd9c4c258509b66fe6616c484d5c814bc81a5c7e9785cb5bf9ad94e6259e2e1a5557b2c4988f4
SSDEEP 3072:/4Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/zm7Rkm1tYpBeh2BAoM
TLSH
T11AC312275E75E9375878BB0EB08E0B1F1EF14AA6D830DA92C8D86B0467F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 48bbb920163cf3089513d783a2b1ee9491a6abae430cc7e290b842d6b4c351e1
MD5 f60bf77389697d84f1e8ba30d0616461
SHA1 ff9a8624af0c49f1d99d59d96a1a7a6484c31705
SHA512 4b24d9ba5e535420a5df0f7a364c8e4cda348b45983d888084311a7cad757052540ed9a3b38685989519a4e0f1d5b253e67a9d39b13c08227f7550d57288622c
SSDEEP 3072:JfKQFBIK9rqNyoyf3SuHe4997e5HLjvO+WBfOHIl6DIpPG1:Jf/FBx9rqZyf3xecZCpWa78q
TLSH
T1AAD312B2E970BE3711B3C40AF261A3374D58556FC859C4B084D5ABDE20866EE171AC7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 4ed590edff9c9fe0ee51e648f63ad96899f6c8ddb24347ce124785678a2756c0
MD5 25def3a0ebbc49d1a4e04becabb58ad0
SHA1 937e69d4dfb6e2d9c87c232284b82cbc0a942a35
SHA512 3aacbe62b14eee4228bb6ca79d6e8f779db129cecca123113d655b52689f0a41a6f2a3c991ceff45d3e368c7a4104d4b100229781d4a138f0c3cc3e8cec5b606
SSDEEP 3:MsEllllkEthXllkl2zEw:/M/xT02z
TLSH
T1A84404147FD00C05DD0410304531C3D50370D5500715DF43345104135CC77C00C00054
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 85B
SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
MD5 bc6142469cd7dadf107be9ad87ea4753
SHA1 72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c
SHA512 47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182
TLSH
T1F2A0120384738407E4144051C45C1341287C84570119C0012068931304240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b7f070a4d3175a30ab1f73e5c86d8af917125a0b9ba72da395511cdb1d406c6
MD5 bc3e311326d2799984bcb4de5723ee07
SHA1 2c2dfb72259a6daa964eb7a402ee00bfd5f5217a
SHA512 6c40c35ca92f726c413299822798ea8c4de22875c9fdbcb3c3186bfb1444faf40cb63b86b40b1a70191e14627bc482df4bf291d36b77367e2aac76d3c7e3f85e
TLSH
T1DBD0A720BE24A896D23A21B255204700AE5454A321668185A124481CCCBD885DA96796
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 90a01ad4e66d8498320261dab68ad05617998dba78841976aa6d5c4b26590271
MD5 0919a3c100b85040228db1a4ff24c939
SHA1 56a482316b324a2fe900dbea9e6fe86115de4d6c
SHA512 7c9bb0829fcf9b7ddbf4cecd812be0675b11600e57d918e95b265bb9453804af94e8d06cce47354e6350fb7ec3cbeddab6b16a4c324507fd0f3badc0d218134e
SSDEEP 192:vj8Z/Z/6W/WNNMMPPwdGMppSSSoVVV+++TTTTEEMjLO:vj8Z/Z/6W/WNNMMPPwdGMppSSSoVVV+t
TLSH
T1EFE1555AC2D5D39BCB05508A8DA0635E60B0371EEBDCEA08038C9DDD304E59FF9B5AA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 7KB
SHA256 6183c5df3a759fd4469cbf631cecc7f0d479de7cc194910af3823e7abbe84ef0
MD5 89185e3b7ce07a6088079c33833bc875
SHA1 907aa23169032471d3db7f32465756408bfc4c62
SHA512 4ee932c19c387532b2e5dcad5f6eb21f0eed449589e582b58b48a36beff7198a41b20ed58c29c4a8167b282c18c93f96938e3719c22f70ec83c1b93d914f1e22
SSDEEP 192:Qj+k6PwwwwwwwwwwwwwwwwsssssssssssssMnh:Qj+k6Pwwwwwwwwwwwwwwwwsssssssssg
TLSH
T164E16C678395D39A9F19208E4DA4726C00767B0EEBECD50C038DDDDE304FA9EE5A56A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 f2cbaca49a3bbd293ad8f8274ddcdd1c73d18cb3d9605c9f439c060f0ad69593
MD5 f3d36ee222f47eb0161b627073d35873
SHA1 6acc4edfb922b2a562b71ab514054b890c08291f
SHA512 d24a97050aa33fb4d1e62774dccd3ff6a2b3a9da76e4a0959ac75c5133c7adc8c4a52c24eaaef49df9c210bd83bac347487e9d8ab3af79b10d01b0e8428043ab
SSDEEP 96:MzGUAbuOXaavI/Kqn+e/4fkwz4ajDpohFa:MzXxOXatL/4jz4ajeDa
TLSH
T1C0C1B771509E3E98FB424F73CCDE48543370A6FAFC3E1BD7AC8550AAA9176C1482A079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 5b21e22602c63e8533426027a06978a018c258f995a44376507d70f1d37dcd82
MD5 a70334b83a2d9092931581bf18da7295
SHA1 96bd6e277cbe7edd4e8a93e4c4c3ad956010b4fc
SHA512 5135a83a0c0a650aa52e61a0f2c0715c7f6e5961ad3e5d13af418fb882c9f01597594590786daceaad0ab19c2b11d51215c0c8987d04304f7035bdf02af288fb
TLSH
T16281DAF7C3E5862D891196F0AE187E1BCE190952437C3E4A89E4AF4B93F2871E151B4E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 12a7761e55307dbce3febc8a9bcaf392644bc3af708681187acb1478938ee8a7
MD5 5fef93d09cff07e0baaff385ec4e252e
SHA1 b7c20af1f71629627332486b6898e51fa6a243d3
SHA512 4e1cdb761d0664e3bddf3c6743788c47a4807809e81b6a2488c4125dc895749e4a0fd6891e0b9052e0ef9be7da0d0a2d9f9733756d1cd5424df155745f899435
TLSH
T15C71EBF783E5826ED91196F0AA18AE2FCF2C0455436C3D5E88E0AF4B93F2471E151B4E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 fe19016d4efbe497aa597a0d6f4f37d76ed1bf980d20c7d34564b7169f64fb9c
MD5 5df6748097906e247bc945950279bc7b
SHA1 94d8ef57fa06444429740975bb3e632ef52241d6
SHA512 368c963a5968168f3e75e50404a8da054dde8bad4732578accb1449c48dfc1feee9a0dfbf544b96f373f32fc7853c587358c2cc0e5512ebff898e29fa9722659
TLSH
T19B81DBF7C3E5862D891196F0AE147E1FCE190952437C3E4A89E4AF4B93F2871E151B4E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c3b96d92c4d201153e811f675ff0c0da0e07bab8b3627a8c2a8b31bd349202e9
MD5 212dcfafe30de5d947fc15513772c7be
SHA1 86ceb6f21223eef5d311a07f460fe31d486c1e55
SHA512 244bf74ed7690e5b840b30ea1b63e363d0484c1703b284d79e01a81894045853384c121637eb244f4c66264ebdd7d45455e5603bcb793dae69dc5f494b29624b
SSDEEP 192:sxZGR5yM/jK1Ml8M3B/fwsDTbd+V1bM7dpmTHW6+WNBVq/rIwg3FvmBsliLIg4J:sxZGD/B/fwsDTJ/3kHbi/r8Qc
TLSH
T19D52F912AA34997BCCDBD219F955BB53D6F51463E2940E48A9FCCA1C04E7AED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 588ea8f76563b8cc5ab9679f2e1b1557ca6e3cb1f8c9e09a16e6d3850cfcc945
MD5 0d9ef3dced2076ec3bb8fcba0b7d42c7
SHA1 bf9665a1d6892a588c0af6250ae7f48e09c858a4
SHA512 e6605ced3dec65b38e8e8d38bed6a042f49fbf413f31c2764fd5820fa836f6b7e6aaa9eaa5af617c3cba8f7b12803df0271a4d550d378e54fe4f4f18906bbb85
SSDEEP 192:sxZ0R5yMojK1Ml8M3B/fwsJTHd+V5bMndp4THW6+WNBVq/rIwg3FvHaBL1iLIg5M:sxZ0m/B/fwsJT9tTaHbi/rnQq
TLSH
T11662E802AA349977DCDBD219F951BB53D6F51573A2940E48A9FCCA1C04EBAED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 0dbbaf70a04b3098cfadf313d1cdc830d7cabb4105333c6dc2e549446f751a9d
MD5 1f0ecf66fa6b895584d015227ca86e51
SHA1 75dbbf776d1a96e5539afe5407c4e1f25dacddbe
SHA512 86f1de0671a1a2e131cd5e0f19ca3d4630b66a80bca487b29fcca69f1217dc6f61d911e661449c75fcbcf81717cae847090fb210894b2e399430e341bb5b60cf
SSDEEP 192:sxZ0R5yM/jK1Ml8M3B/fwsJTbd+V5bMndpmTHW6+WNBVq/rIwg3FvmBsliLIg5WJ:sxZ0D/B/fwsJTJtTkHbi/r8QM
TLSH
T17762F902AA349977CCDBD219F951BB53D6F51563E2940E48A9FCCA1C04E7AED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 97530e0eca47e359bbbee946b806af4a7084dc32ebd1b936d0a18af90aaad4df
MD5 ec49de7264cad8550204bdd6ec814786
SHA1 248fe54ce0950ba1a3a33737dc89ee8e236629c8
SHA512 d6ed3320867baf5c2f573e2f279e66622717819356fd85de04615d17dd43637add1c078c375568a8e13c3e10db83b0d805e44f0af314aaa9a732e3aa3680704e
SSDEEP 192:sxZ0R5yMojK1Ml8UQu3B/fwsJTHd+V5bMndp4THW6+WNBVq/rIwg3FvHaBL1iLIf:sxZ0mqcB/fwsJT9tTaHbi/rnQq
TLSH
T11562E812AA348977CCDBD219F951BB53D6F51473A2940E48A9FCCA1C04EBAED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 8384f68ef608308c92f8c76cd5eba6e1ea13d6a8a2030a09f90108d665b64b14
MD5 58456e5e21c2252306fae2fbe839a106
SHA1 6c05b00e797d4bab1c6580e3dcde0cc6dc71ad0c
SHA512 ddfd492126b9fb9697ab6e736862e05c89e1b34cd2f441352660a758567e2875ef56dead6fa0ad08a683cf8f193a245602219150f7f9cb3454482c5241feed30
SSDEEP 192:sxZ0R5yMvZjK1Ml8UQujB/fwsJAWpV1HdQV5bMZQdp4jRHW6+WN4aFAeqVq/rIwv:sxZ0BqqB/fwsJAWv19LCkHbTx/r564
TLSH
T1EC82F812A634897BCDD7C219F955BF53D6F91463A2945E48A9FCCA0C04EBBED2203C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 9195a64e8ce60cb8365e302fd70badf8f1cdcff9587d85e4319d3d9f2cbc621c
MD5 f1ca5665889f59adde036274c3d706e1
SHA1 f2c1b5e9e29a6b1eb37d034e410ec20ae6ab44ab
SHA512 ebc2897b5eb74eb86de1a69102a901e0202374f8ab6dca271a431b33e101ca971120da91653df488000c4d64fc2abbeafb79bfe9233213131e543cac5a857da6
SSDEEP 192:sxZ0R5yMvZjK1Ml8UQujB/fwsJTHdTV5bMZQdp4jRHW6+WNXFAeqVq/rIwg3FP/0:sxZ0BqqB/fwsJT9ICkHbPx/r/wq
TLSH
T16672F812A6348977DCDBD219F955BB53D6F51163E2944E48AAFCCA0C04EBBED2203C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 508aa989a9be0fb0192ebce43cf046c3de42f30f5e8266a9fcc64d80178f735d
MD5 48409e44e71b87764d80460f9419a130
SHA1 577ca583644697d46577227ce816f5811ba4a70a
SHA512 b523e8240be81d24b5d70e680bfb0af73016304e08ccf9981f1a845d2720d7dad14c4c7860f14113eadb995a8ae1ff059bf50408eb982a65e8455e781fb3289c
SSDEEP 768:YmseJfh7pLuL7hxWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OV9cVcLly0ppLroe:YmseJfXE7hxWvhfynu1jaYcVcL88p4e
TLSH
T180F2EB3B680CCB7E4F844E9CED2A7F9A6EE801CB56D8895447F9880C02C76EB15175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\070fc69b-28b6-45cc-8a56-75c8dc728b82\index-dir\the-real-index
Size 72B
SHA256 7727e45e7dd6b1027adfbc8f7f2169aaa7f454c20f3614eaf0041917b322b53d
MD5 6434fe56b981afecd5f17c37524ffffc
SHA1 77ccdb6f3c50ee536c9f597867b6f46b52d4d8cf
SHA512 82e5992ee2588b2966d99beea92621c3982fb8fb9f476108019e50c06675fd1392004417d9e28be78f4a1ddd0dda232adbcc635a5f82866d978be08849f290e1
TLSH
T14EA00230CB8040C5C42256B1295707493319D8A42D15230B44910145DE604805D4101C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\070fc69b-28b6-45cc-8a56-75c8dc728b82\index-dir\the-real-index
Size 72B
SHA256 16ee7305357892f76c889e1c18ac5d9297c30fc6ca09b92ce84f14b40e33c355
MD5 b232fe091793ac06c6e594d3aafe6d3b
SHA1 01ddf43105a52c4c4d572a4eecb63cffaf3c7224
SHA512 6ca1cafaf1919f5b0f1c1c2484f29b76a4dbd798554b15c0ab4aa8d6e1aad7bed04ad216033a655d4779c7a9169bdc01ea0d92064e626d005447cd092f3776ea
TLSH
T1D2A0021403817402C10252F325D71162321459D10321133B92A5018DE8E0746454100E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 3KB
SHA256 ea8b5af9373e4f15488eedea236d4d02dfc518bcfb876d4af09d2059ae53eea8
MD5 b6b84d44617de272ef670622ed35512c
SHA1 93cb630f8a5ba48663a6918c2be95412b752e4b7
SHA512 6e16acde34832148d99596253110056e5770fa8d2ddbbf50fef780694d52f716ac1b0fd1493861dd4a01a0c6423503ea208f67a261cc1fcdfa40fb5e8c91f448
TLSH
T1A651B75D9C877A22DD7C0A7328F5048C373D9ADC6A899F1720FCB2746EC3329295899C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 624B
SHA256 6e1dd2b5e5c4b6ca9432f6b268a5d428dcd7bc4d378ac698d61eeed8a20073c5
MD5 e79f48702deb7726509002973f54367f
SHA1 66db7851a9d1f098a9efd34a6eda8ebf71e59b69
SHA512 a7693217151401285f505af33bde04eb5089c0a9050c0d50896988ee90c72cfdd9730f94426603b4a621ca1aff9076b8d7ef9d57dbf2168b831871b9ccc57a78
TLSH
T153F0D4254F810C16E628457725F6A0E063704DDCB32199772C5C5C7E1D213CC74563EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a1157.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index~RFe5a1157.TMP
Size 624B
SHA256 6278a62e436d0c2769dca8aa68a3f482d79b0aa8bcc7ea3da1c91f9b1dcd489e
MD5 ba88f4003fe99b985140a7a50d3d2186
SHA1 39f9f91b81d82283ae668dcbda91d68308096b3a
SHA512 38447a6a8be63904e6ac59887b582d3263325e826a2e3e15a78e04143b68e690d13827af8ae6b129d5e4c3c5ff423a2cf653c97a58f23abf8bd53b727a01b21f
TLSH
T19DF0A3554B914D11D42009772EE6D4A8F3308C50B632FAE7345CA82E6C75BC959062DC
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 549ffa8848c90f3b08201454336ca30ae56dee2e6a652dcacdbad30cbfbb74e1
MD5 8979b8e81ef775faa562fdf933c7e2d3
SHA1 53ca3f6efcfc47bb5d79789232b5b107c9818214
SHA512 32a3c27aefa055cbed2f0948e65159301f2338f6698b0b770c6531c0a8db96cfc4d96b1611fb1491ece144bbb39d81a979b6852ca569a8f69b3367340b5fee90
TLSH
T14DE0C0B62DD32414BDAFD3D22030C0900A0A74ACE905FC0E541BF6C3107231530DBC35
MD5 SHA1 SHA512 TLSH

Submit Download

f1cdccba37924bda_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_0
Size 117KB
SHA256 4fbba197290847170f788988d31139cd567d64d5223c1c09406ae59db44e8d80
MD5 776638fd461ab6ca3844c91948b890ea
SHA1 73512903b111e3ed29358f9994f295f9ffe02dfe
SHA512 a3ba5d5f5412d4c24a9240e511324eabdd905b54bd6e338884563681d2f51c38438ce5395c093cdad28588185bc471e130d8f34b0143c797922601c35ee36e70
SSDEEP 3072:k/J9B4xPCL1uOsetdmL/UFp0W/ux0gL/dL/oL/PL/rL/lhL:k/zBmL/UDj/ux0gL/dL/oL/PL/rL/z
TLSH
T1B4C39A33769D50AB0E8ABA645056B50392BC7467B8449038F254A7FC25DBFB013FBEB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1cdccba37924bda_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_1
Size 201KB
SHA256 b2609804a17a28962528d20051372df5679e02254fe476a300a7e1f0fc141c3c
MD5 76d889876177ce50a8698b98dc308dea
SHA1 5a2c0168fbb3d1399afb6369db19ce91402a1a66
SHA512 b6ca5daba256a2d86f787c820fe9533b3746ba4096553348d6a11bafacbd754e319106ed82b904baa085fc2e79842bf2ed359d467665aaffd73f1a8fd412944d
SSDEEP 6144:L0kEcuA86GUTxBGdStr8fPRzxwAyL/iZdp8zy4hERIWwo5MgAJcvL/OL/5L/TL/z:4kL/sX1AJcvL/OL/5L/TL/wL/EApR0l
TLSH
T191141922235521AFCD5993B913239A17B7B44006BEC3D3699581A334186FBF32FDF962
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 23fc3a351df2754f7463006fc3fcca589bff0d18d80e3ac56f7e5d1199fe0855
MD5 2a569384f2500cb1702303773d7877a7
SHA1 c502e64c26d4873c153c12c7ac571bc476a69352
SHA512 b76b4df52c139a02c9a350a36d10383f1edfdc62e9bba7e98b9eee999aede95bc1eac9e2a4b5ab852ba3270ee1ad6c72de3885c9596070a1a761c99bddc5bd18
TLSH
T1F2A00294914B1C01F8240675745551513354C822010612838F98D8D9ADAB1406543581
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a7495.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a7495.TMP
Size 48B
SHA256 2e390af44445fdd25376273dae5c0e96941966b5576ac4d7f479d80c71693774
MD5 85b41b90ef5baf44031fa7e42b99e64c
SHA1 e717557bd74fcc543d88a16679501e1201977a8f
SHA512 72294166d33d4a4cc05353838626b7444bd0cda597a800b0860df329216f213f493107b31ed82d63ce82ef064a0f2a3e38f85589a8f457c4f1459d7d5444fb50
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 e84fe6bfaed173975d4027408a0561abd40095adfcbb235468d59facc635e6c6
MD5 ea42d46df4be6f08d0a72db25fb65ee5
SHA1 91e4f64413cc9cfc56d0da1057c66869b72fc0c7
SHA512 68c1b6ce16c0293f98a5a6f072b2219166354b44c58036fa8a3e96e8808f6a34a921e85d5b0938b28b17d0f74e524858d157926e71a5d8868b190c20ea447d03
SSDEEP 48:KYHIhKggkXyR8IHKZW0DypKIPKrCYfytJIZKSc0r:KYH+KggmC8gKZWiKK0KrCq2JyKSc8
TLSH
T100C10256343F02023C7E2958B2A29E3A8E4271633458A4FFBBB900911E67E151EFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

95a02536-28a9-4262-a1d3-a54ab5745eae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\95a02536-28a9-4262-a1d3-a54ab5745eae.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 fb47a84ead17f710f459fb9c71448b8421ddefd17981e8df67c75e46655ae0f5
MD5 eb6c3456ba20c7929540feecafc3417b
SHA1 df5eeb71893e852417888b491d76ff6aa2b66bb1
SHA512 60e9c20126056bf5fba56fe8e59d0a77083f13d8034e1f15f48a4020ed798386a28c8a6f0c35e7b2baf2675f743b05cdf6780b7f3e506b1714323ef9eb9ac30a
SSDEEP 384:n4tNn/s3n9S2sNWGTFkr7vfudGdwdUZ/0V:4j+9FYQyEUUZ/0V
TLSH
T1FD624A326C789C2BAEA2A584F44637071FF4916BAAC52F54E5ECAF0D01DB6AC1307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 f9148faef67fcdd4e36cc5b38f857e594e256ee8eed4f19acd1e011f55277422
MD5 89d972ed95dc0342c8912bf4f24eb6db
SHA1 773505f764aaad283937b0845b676135b75794b6
SHA512 f83493686982c7b9fff570522de1b5cd5b76451d434c241d397fa1fb31f23211ff8d5e532f019c8459607747b809d19e092bf50312ac7f7d3bb4e5ebb578dae8
SSDEEP 384:ndtNn/s3n9S2sNW7TFkr7vfNdGdwdUZ/0V:dj+9FvQxEUUZ/0V
TLSH
T10C625A326C789C2B9EE3A584F44637071FF4916BAAC92F54A5ECAF0D01DB6AC1307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 e68c59f3252a8f45b7d80b7b7337b1ad19e368802a91ad300aaaffb347dfb4da
MD5 bb3965facc44c4a2a4d18d3bca15f91a
SHA1 1e6ae5bea3d944739869192544b77252987f0c1f
SHA512 d24d755f01673d11dfb4ff2b39e2f188dcd5fa781185e23648bc96ebb547d4da6fb4840e4bd444d10608f70a3d97b9ab37bdf801da6a40ef66d4e27e8231e17e
SSDEEP 384:neiF1tNn/s3n9StisNW8TUNTUlIl7TFkr7vfNd5DfcydwdU5/0V:1F1j+9jXwg3QxcyUU5/0V
TLSH
T15BA20836DCA4CA2BADE397C5F60676479EF041A796C959C4EADD6E4C00CB6ED030BC06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d978b67e48d03d03478d1db0262a1832a9e28c57317dd0fa07347c91a0fa1081
MD5 e24aa1d1fdf667ca7487e877727d4c34
SHA1 a5a0ff5c79382fc13d7498306b993ea3ce2fa32b
SHA512 1af6579103cc1033f90e1299f963d487d41c16bf55641cd0f88d6ac773406767b603bcc9615e36df3318deec3c1d3c3f583663f99f75f71b7fcb21a0cd7b5938
SSDEEP 192:lONnZ6vMtPQmiUy7QThTZS+FdLF847DSU/u:lONnZ6UtR/TFdJuU/u
TLSH
T136020735AC786C6B9AA3AD46F48A37171FA4517FAAD11B50EAE86F1C00D769C1303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 8f08debf6fb2b726e24ea0f909a49a9dbf412ae93dc41d741087ea7c2b3a434f
MD5 028d004dad22f9c623670a63533dbae8
SHA1 2821dc497ae8456f6091e009ce8659343a537343
SHA512 1885885fa7cca1b9d077d28df81e3ae4ae58bbf0583fe5f9808b6d3c005718ffec75029c87c84ffab615351af4e0072adaf07d5369de27ca42316b2edac8d23e
SSDEEP 192:RON/6vMgPQmiUyDQNhTZS+FdLK7Fd3E380IPqsU/u:RON/6UgRdNFdwdUo/U/u
TLSH
T1E4120B32AC749C2BAE93B545F48737035FB0916BEAC56B50E6EC6F1C01DA69C1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 9d52e61cd3fd18ab50ffe50d6072524635ee28ac48d1d6ae1f63b957b08fd6b2
MD5 60f7ca9ce38eb5ab3ca3e927151e413f
SHA1 613d4981d2573a320384a348c0a2b8f3c708f295
SHA512 9b582023dc8518751a1325c364d62b23e90f05c13adbf99773fcff05b3b92ec46f72060b2b25b6dbc2addba73a839107b9d3d2da89722eeaa2fdf9caaac70b2d
SSDEEP 384:neiF4tNn/s3n9StOsND8TUNTUlIR7TMkr7vbAd5FfoDydwdU8Ez2KRtBoaeioH9k:1F4j+9Pkwg6QQ2yUUBvRIH9/L0V
TLSH
T1B1D20972D8A4CEEBA8E2DAC5A606F5066DE40233858D599CE6F87D7C309F5FC4306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b58b72b3d18b1dac3ee628458019daead973400b1961a48c89d2db27498ccb9a
MD5 bfb38573dcee1a6e565365287a4a089f
SHA1 62833375b94e6b29d2dae83ec51e19ee0ee1b2c4
SHA512 b2f978e4db2592448a5bbaed09ded6f1f3669f9adcb26b88b5c153fa192b3ff2ff2daee3ce815381a307dec3d942009c8ba2e0d22f89c5eb462bee7aabc24fb8
TLSH
T1ACE001429300009EC02913310093163027E2802102B20206891042642D137042E60B94
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7962419cf0c7662bf084ff9bbf4364c678c67026a678f9f7353bf16e9ea8b04b
MD5 1a4a1360784246b6f165561aafa307f3
SHA1 ff2c58b17775a00a6284a867f3765f85ea92ea45
SHA512 22bcacde69ffe3963e869c8166f8cb755d81294a75c19220a6615dbaba1c46bdb8685457d63f429152fb2f307f90131139a2afeca8b99bb1ed64503ed4b57dcc
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5eaa09.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5eaa09.TMP
Size 392B
SHA256 72986a5d776ae1f49f10c329d880baf27ceb733f30904cfc9c8f03b21c241ed5
MD5 7da26cc9a4b3511cc789abb6e38ed78f
SHA1 1b232e75f28d78c7a9151f0ab12cac83e245ea4e
SHA512 ee048c9a9f958e3ccbc828c519f7940850a439548508b6c081aebb831e5f696caa6388501c100b3021e8e6f75b69633fdf50aaeef6bd25161335632d9d12a4c8
MD5 SHA1 SHA512

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.3.23.1\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 a5548ca519cf47ecb420c8f1299a8a50517fa463459a704ef2ff17c4db35117a
MD5 b2c40634bbfa57be0d4fad8adfbd6ccb
SHA1 6f8b9ba2f40d9aa42d217ed2bc6dbcdedd1763ad
SHA512 3cfbef4e4a4a7d8fa1530c69ea34fbc3b84627888361a9d201b21e6ead15f5d4e51fea8bc95edd07415b6d2d06a3c19beb1bcea3195e05a6d8af4939b95f77b5
TLSH
T1220110D29C7E26C2C5AA0FBFD08B26EC44C4A516F098747A1CCCF9D4823980E148243E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 142a7cc7a4933a976aae32a9d04e1758464486092207243f09edbbad51f1d934
MD5 95fe84d83629d03e0bc6e035f44a5cae
SHA1 2af304ef821c70f2d00b47a3e3872c17d33e40e7
SHA512 266ac6fd03731d757bebdacd0d27aa0326e022f9791d7892445f595285b17def95b722da875c974360a7567be530324d0d91a3310008958cbca0f09f04676301
TLSH
T14E0112D25C3D26C2C5BE0FBFD08776E844C4911AF19474BA1C8CE994827980E208243E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 98d9b184e4c7220b5aaf7ae412b0c1b3f32e3dc4933afcf852538b8082017b9e
MD5 c20138f2b92ee0645ce99eebc563daa6
SHA1 8e20392ea25dec3d3cef957c8ebbe1a0c589ea3b
SHA512 151098a27cb44d715d48210b12b95a9d1341beb7ca1de3096edc0434ba70c3d274e446604c7692d7a4d92af7b41872166747a30fd452fd0279407a6993fc02c0
TLSH
T15DF00CD28C3E21C2C5EA0F7ED04B2AF884D46507F0887439088DEAD4C17A80F118247E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 590065152acec5cf42dffc28eb04749514feaa899eb2ae04edce7d38a148fbda
MD5 30ae49636160992413baf749cf492c9d
SHA1 93edd7244143177356c931699cb8a266bad04660
SHA512 b986d2486431c75ee9ea0acd7d891c2d40042dfe9185910eedc52db52d68de586df47518bb97647f325416a600eb0e7b794c9d5db9242f3417882791a266829e
TLSH
T11E1114D25C7E26C2D5BE0FBF90877AEC44C4D616F194347A1C88ED94417981E154147E
MD5 SHA1 SHA512 TLSH

Submit Download

24eb0bd7-5eee-49b8-941b-ba73f61ae7d2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\24eb0bd7-5eee-49b8-941b-ba73f61ae7d2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 384KB
SHA256 e1ffda4b064ff7465b476c736fba8731992621a5cfa16b3d7204a88335f62c3e
MD5 217d5bbf9d14ce060a5b7ad98a6322ef
SHA1 22e6036c7352cc49e1012636425371bb4d4c5897
SHA512 c539e01d892e88075ed903ab4bea14775d71ba2f13032df4c9053073c27a91ba934a820bdc7509b6ccdcfe6460e48c42d39fb8995764dfadac27da3879c66745
SSDEEP 768:Gf0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrzcooJImdba5aSt35:G69tQeoVYo
TLSH
T162843037E5A0A084DF3C7171E2AC1F4CBE72650B11E406425FB4B57EBA237D58A0B5EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 34f98ba0166e71e6258b22d2c2425d9762dd6d51eb9fa3622b6dd90bd56f4931
MD5 8ab9cc4ec0a12b5eefbb7844178eee2c
SHA1 63fa061f2796c4a0e2cf57e94b0a50836f428157
SHA512 23f7d460992447eae635b90f635c369348583111d685b610f580a28918e4c595442700eaa30252759ec118b75b9f151ab6c90a3ca834d9e678e8ef4395d677b1
SSDEEP 768:o0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbar:WZP2tFP3vqY8AqEMXTaBacg
TLSH
T165259437D190B0C5CF2C7171E9ED8F09BA23A10B11A052465FF8A57E7A633D99D0B1EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1a8ac2c4e8e73112e0ef0e3d59600adc83693e403269e90a947dff6c30701491
MD5 b27b96de1d811d62b4a9afc55018a84c
SHA1 c27a1625caa5f09f8b469e264c8eaf6a5f22aff4
SHA512 eb206966955e641230b84ffbd83ba05ce0174e8612d9dc31164e70f429249eceb5f4ccfc3ced8c80bb7d8d99ca284fe81ff803338ceaf8f51363b30517a4fcd9
TLSH
T1E1412A5CAAF91148B3B7AE5B9BF7A96D447BBD732E06C49E10110E8E0663A00DC71733
MD5 SHA1 SHA512 TLSH

Submit Download

WMSDKNS.DTD

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD
Size 498B
SHA256 644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
MD5 90be2701c8112bebc6bd58a7de19846e
SHA1 a95be407036982392e2e684fb9ff6602ecad6f1e
SHA512 d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe
TLSH
T15BF027AD4BE26C59323110903E78A0B0DD05F0B3645B3A6970CE5C7679E7D9C0407FD1
MD5 SHA1 SHA512 TLSH

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 23dbf7014e99e93af5f2760f18ee1370274f06a453145c8d539b66d798dad131
MD5 5433eab10c6b5c6d55b7cbd302426a39
SHA1 c5b1604b3350dab290d081eecd5389a895c58de5
SHA512 207b40d6bec65ab147f963a5f42263ae5bf39857987b439a4fa1647bf9b40e99cdc43ff68b7e2463aa9a948284126ac3c9c7af8350c91134b36d8b1a9c61fd34
SSDEEP 96:zkZRAF6zyHUhm77yB1pZYCEnfHrHHbB6xTGH+YCLV3zwULJEYCJWyHht3zwFRhRM:BFV0bBPCfUdY
TLSH
T1112292A194818DD206290E275DB95C0DDA8CE9D3822C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

40c43d23-a087-41c6-aee9-26500e24fde7.tmp

Path C:\Users\Admin\AppData\Local\Temp\40c43d23-a087-41c6-aee9-26500e24fde7.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

6bf86516-8e2d-430b-b1e4-b5b59477755d.tmp

Path C:\Users\Admin\AppData\Local\Temp\6bf86516-8e2d-430b-b1e4-b5b59477755d.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1884_1932253323\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a80c7a0-5c49-4d5e-9255-d0c68cfb37ef.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1884_860481447\5a80c7a0-5c49-4d5e-9255-d0c68cfb37ef.tmp
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 8b174fde079fc6a584f5634330d15eac6e71111133f4712041e4bbd6420c262e
MD5 16d45cbbc2ab76fb9370c1f079dba971
SHA1 92c493ffba6a257d98099d6f255860acdc98f1ce
SHA512 7535c5610fefbb57aebb35d58d9bb61f25569e414a9cd53abaf8776afc13e4248767c7c6ef2f2e72a7e96d94d3a92390f182693c8aec5648c0fead5f798980ca
TLSH
T1C0218B971B4EE4708AE01BE72DEC8E2573BBC7CE8391D0A5B34D9029480312D5B3D06E
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/780-29-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Download

memory/780-30-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Download

memory/780-27-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Download

memory/780-28-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Download

memory/780-32-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Download

memory/780-31-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Download