customerloader | ddbd930cf742882ea6cc10ea5495f8aec24003664b81257c1b3900f3627b6684

Resubmissions

02/07/2026, 01:40

260702-b3qcmsay4y10

02/07/2026, 01:18

260702-bny18sg17k10

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/07/2026, 01:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ByteBreaker V1_95459322.exe
Size 583KB
Sample260702-b3qcmsay4y
SHA256 ddbd930cf742882ea6cc10ea5495f8aec24003664b81257c1b3900f3627b6684
MD5 7392e839c67ba537093c55353be265ba
SHA1 7c9bce283d6eb9b49dcdcc850e66e0148dc30d71
SHA512 07ccf85180c1d63cc03f9d0ff986d0c704f1ac7719e6f7bec56d32f397eb4400a623a19954914b1d391270ce0b08226ee48f92462c7ec2b6ee29500a36ca0617
SSDEEP 12288:w7yjhihTaVWs+OfaOp0XWgWasfMJo7WLrc7SrnTGf0TRz4hTB2eLsHjlsGk8y:yyjz99asfnyNrnTe0TShhLijlsGJy
TLSH
T132D49E123592C036C5B111B01929EFA690BEBD344F7245DBA7D41B2EDB346F26F31A3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery downloader customerloader loader ransomware themida

Malware Config

Signatures

Family: Customer Loader
Customer Loader is a downloader written in C#.
downloader loader customerloader

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	bytebreakerV1.exe

Downloads MZ/PE file 5 IoCs

flow	pid	Process
137	4520	bytebreakerV1.exe
137	4520	bytebreakerV1.exe
137	4520	bytebreakerV1.exe
137	4520	bytebreakerV1.exe
137	4520	bytebreakerV1.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	bytebreakerV1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	bytebreakerV1.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	ByteBreaker V1_95459322.exe

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/4520-124-0x0000000000190000-0x0000000000E6E000-memory.dmp	themida
behavioral1/memory/4520-125-0x0000000000190000-0x0000000000E6E000-memory.dmp	themida

Contacts third-party web service commonly abused for C2 1 TTPs 10 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
144	discord.com
175	raw.githubusercontent.com
107	discord.com
116	discord.com
136	raw.githubusercontent.com
139	discord.com
156	discord.com
106	discord.com
125	discord.com
137	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4520	bytebreakerV1.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ByteBreaker V1_95459322.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2912	chrome.exe
3180	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274301133366732"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\OperaGXStable	ByteBreaker V1_95459322.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\OperaStable	ByteBreaker V1_95459322.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OperaStable	ByteBreaker V1_95459322.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	ByteBreaker V1_95459322.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{6EF01D89-A9A8-4019-BF8D-3210DEE96EC7}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OperaGXStable	ByteBreaker V1_95459322.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{48164B5D-D3FC-4769-AA7D-89F30D99017E}	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2304	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2584	chrome.exe
2584	chrome.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
2584	chrome.exe
2584	chrome.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe
4520	bytebreakerV1.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
6624	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 2304	3216	ByteBreaker V1_95459322.exe	96
PID 2584 wrote to memory of 1888	2584	chrome.exe	99
PID 2584 wrote to memory of 2912	2584	chrome.exe	100
PID 2584 wrote to memory of 2580	2584	chrome.exe	101
PID 2584 wrote to memory of 2580	2584	chrome.exe	101
PID 2584 wrote to memory of 1120	2584	chrome.exe	102
PID 2584 wrote to memory of 1120	2584	chrome.exe	102
PID 2584 wrote to memory of 4880	2584	chrome.exe	103
PID 2584 wrote to memory of 4880	2584	chrome.exe	103
PID 2584 wrote to memory of 632	2584	chrome.exe	104
PID 2584 wrote to memory of 632	2584	chrome.exe	104
PID 2584 wrote to memory of 2032	2584	chrome.exe	106
PID 2584 wrote to memory of 2032	2584	chrome.exe	106
PID 2584 wrote to memory of 2120	2584	chrome.exe	107
PID 2584 wrote to memory of 2120	2584	chrome.exe	107
PID 2584 wrote to memory of 396	2584	chrome.exe	108
PID 2584 wrote to memory of 396	2584	chrome.exe	108
PID 2584 wrote to memory of 3904	2584	chrome.exe	109
PID 2584 wrote to memory of 3904	2584	chrome.exe	109
PID 2584 wrote to memory of 4008	2584	chrome.exe	110
PID 2584 wrote to memory of 2084	2584	chrome.exe	113
PID 2584 wrote to memory of 2084	2584	chrome.exe	113
PID 2584 wrote to memory of 3112	2584	chrome.exe	114
PID 2584 wrote to memory of 3036	2584	chrome.exe	117
PID 2584 wrote to memory of 4028	2584	chrome.exe	118
PID 2584 wrote to memory of 3084	2584	chrome.exe	119
PID 4520 wrote to memory of 820	4520	bytebreakerV1.exe	121
PID 820 wrote to memory of 3820	820	msedge.exe	122
PID 3820 wrote to memory of 1912	3820	msedge.exe	123
PID 3820 wrote to memory of 3180	3820	msedge.exe	124
PID 3820 wrote to memory of 4572	3820	msedge.exe	125
PID 3820 wrote to memory of 4572	3820	msedge.exe	125
PID 3820 wrote to memory of 4572	3820	msedge.exe	125
PID 3820 wrote to memory of 2104	3820	msedge.exe	127
PID 3820 wrote to memory of 2104	3820	msedge.exe	127
PID 3820 wrote to memory of 1808	3820	msedge.exe	150
PID 3820 wrote to memory of 3128	3820	msedge.exe	129
PID 3820 wrote to memory of 1808	3820	msedge.exe	150
PID 3820 wrote to memory of 1808	3820	msedge.exe	150
PID 3820 wrote to memory of 3128	3820	msedge.exe	129
PID 3820 wrote to memory of 3128	3820	msedge.exe	129
PID 3820 wrote to memory of 4896	3820	msedge.exe	130
PID 3820 wrote to memory of 4896	3820	msedge.exe	130
PID 3820 wrote to memory of 4896	3820	msedge.exe	130
PID 3820 wrote to memory of 1556	3820	msedge.exe	131
PID 3820 wrote to memory of 1556	3820	msedge.exe	131
PID 3820 wrote to memory of 1556	3820	msedge.exe	131
PID 3820 wrote to memory of 5484	3820	msedge.exe	134
PID 3820 wrote to memory of 5484	3820	msedge.exe	134
PID 3820 wrote to memory of 5688	3820	msedge.exe	135
PID 3820 wrote to memory of 5688	3820	msedge.exe	135
PID 3820 wrote to memory of 5696	3820	msedge.exe	136
PID 3820 wrote to memory of 5696	3820	msedge.exe	136
PID 3820 wrote to memory of 5696	3820	msedge.exe	136
PID 3820 wrote to memory of 5276	3820	msedge.exe	138
PID 3820 wrote to memory of 5304	3820	msedge.exe	139
PID 3820 wrote to memory of 5276	3820	msedge.exe	138
PID 3820 wrote to memory of 5304	3820	msedge.exe	139
PID 3820 wrote to memory of 5576	3820	msedge.exe	140
PID 3820 wrote to memory of 5656	3820	msedge.exe	141
PID 3820 wrote to memory of 5656	3820	msedge.exe	141
PID 3820 wrote to memory of 5392	3820	msedge.exe	143
PID 3820 wrote to memory of 5892	3820	msedge.exe	144
PID 3820 wrote to memory of 5892	3820	msedge.exe	144

C:\Users\Admin\AppData\Local\Temp\ByteBreaker V1_95459322.exe
"C:\Users\Admin\AppData\Local\Temp\ByteBreaker V1_95459322.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:2304

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffbdee3c728,0x7ffbdee3c734,0x7ffbdee3c740
  2⤵
  PID:1888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1656,i,333833935225704495,2903224317962335541,524288 --field-trial-handle=2072,i,2622523967441503913,3282491863986873305,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1768,i,604139168526020701,540854743482154074,262144 --field-trial-handle=2072,i,2622523967441503913,3282491863986873305,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:2580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2444,i,5360231853060296792,1045449804844142198,524288 --field-trial-handle=2072,i,2622523967441503913,3282491863986873305,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2464 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,8425211840811487995,14505959758680166967,2097152 --field-trial-handle=2072,i,2622523967441503913,3282491863986873305,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3276,i,9532967225877207620,9248068296677605316,2097152 --field-trial-handle=2072,i,2622523967441503913,3282491863986873305,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4072,i,9132266714637063415,1247255524586190397,2097152 --field-trial-handle=2072,i,2622523967441503913,3282491863986873305,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4356 /prefetch:2
  2⤵
  PID:2032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4812,i,7145632516901742593,16519884745723975211,2097152 --field-trial-handle=2072,i,2622523967441503913,3282491863986873305,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4652,i,5450381919278852433,5019198859684352132,524288 --field-trial-handle=2072,i,2622523967441503913,3282491863986873305,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4956 /prefetch:8
  2⤵
  PID:396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5068,i,4878340653222941155,13335171930374832604,524288 --field-trial-handle=2072,i,2622523967441503913,3282491863986873305,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:3904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5572,i,13140375075939274206,5082635551040740706,524288 --field-trial-handle=2072,i,2622523967441503913,3282491863986873305,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:4008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5572,i,6067629156349776983,14196387654052762144,2097152 --field-trial-handle=2072,i,2622523967441503913,3282491863986873305,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6060,i,13825070329474426379,6240433111426893858,524288 --field-trial-handle=2072,i,2622523967441503913,3282491863986873305,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5224,i,936936577832947058,12784934241938072963,524288 --field-trial-handle=2072,i,2622523967441503913,3282491863986873305,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:3036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5104,i,14078782838909452905,2558606932299342847,524288 --field-trial-handle=2072,i,2622523967441503913,3282491863986873305,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6036,i,9732518987509950157,9371368638656802901,524288 --field-trial-handle=2072,i,2622523967441503913,3282491863986873305,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:3084

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4324

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3728

C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe
"C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Downloads MZ/PE file
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/invite/qfyfqMnBYK
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://discord.com/invite/qfyfqMnBYK
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ffbd3ecc188,0x7ffbd3ecc194,0x7ffbd3ecc1a0
      4⤵
      PID:1912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,15096309530546104509,468067857020699615,524288 --field-trial-handle=2212,i,8624086520787520476,1529238020662517692,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
      4⤵
      System Time Discovery
      PID:3180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,5280280559997955437,18315720085999854768,262144 --field-trial-handle=2212,i,8624086520787520476,1529238020662517692,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
      4⤵
      PID:4572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,2640623840450235210,10513210752865933295,524288 --field-trial-handle=2212,i,8624086520787520476,1529238020662517692,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
      4⤵
      PID:2104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,4687104806560702434,18360174721724756963,2097152 --field-trial-handle=2212,i,8624086520787520476,1529238020662517692,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
      4⤵
      PID:1808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,15029246908607680240,3479800070465607988,2097152 --field-trial-handle=2212,i,8624086520787520476,1529238020662517692,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
      4⤵
      PID:3128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,11045349708934242894,504413448492030104,2097152 --field-trial-handle=2212,i,8624086520787520476,1529238020662517692,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
      4⤵
      PID:4896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,2863391083195724777,10173457471400194485,2097152 --field-trial-handle=2212,i,8624086520787520476,1529238020662517692,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
      4⤵
      PID:1556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,3260950735240209356,10360753324198639718,524288 --field-trial-handle=2212,i,8624086520787520476,1529238020662517692,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:8
      4⤵
      PID:5484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,14850071886380859129,11369897261672048251,524288 --field-trial-handle=2212,i,8624086520787520476,1529238020662517692,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
      4⤵
      PID:5688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5232,i,4098009208610427489,9430405230164834736,2097152 --field-trial-handle=2212,i,8624086520787520476,1529238020662517692,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
      4⤵
      PID:5696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,17584205485443209156,5797127898116522108,524288 --field-trial-handle=2212,i,8624086520787520476,1529238020662517692,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:8
      4⤵
      PID:5276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,6147542379454907058,13014667129748301591,524288 --field-trial-handle=2212,i,8624086520787520476,1529238020662517692,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:8
      4⤵
      PID:5304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,15556615259972956590,2580538426180255268,524288 --field-trial-handle=2212,i,8624086520787520476,1529238020662517692,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
      4⤵
      Modifies registry class
      PID:5576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,14362640523787852427,2760209111714694236,524288 --field-trial-handle=2212,i,8624086520787520476,1529238020662517692,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
      4⤵
      PID:5656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,2233901478088326174,15545014541050706798,524288 --field-trial-handle=2212,i,8624086520787520476,1529238020662517692,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
      4⤵
      PID:5952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,2233901478088326174,15545014541050706798,524288 --field-trial-handle=2212,i,8624086520787520476,1529238020662517692,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
      4⤵
      PID:5392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,7231081618066004303,11921707759880136778,524288 --field-trial-handle=2212,i,8624086520787520476,1529238020662517692,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
      4⤵
      PID:5892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,16999419174502077647,12818446332236623330,524288 --field-trial-handle=2212,i,8624086520787520476,1529238020662517692,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:8
      4⤵
      PID:5396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,5612827597859169108,7259239798711535131,524288 --field-trial-handle=2212,i,8624086520787520476,1529238020662517692,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:8
      4⤵
      PID:5404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,9619976380247955010,14857224259811012052,524288 --field-trial-handle=2212,i,8624086520787520476,1529238020662517692,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:8
      4⤵
      PID:5452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,10744713120936655417,9037307116132494089,524288 --field-trial-handle=2212,i,8624086520787520476,1529238020662517692,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:8
      4⤵
      PID:6456
- C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\decompiler.exe
  "C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\decompiler.exe" serve
  2⤵
  PID:3036
- C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\decompiler.exe
  "C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\decompiler.exe" serve
  2⤵
  PID:1808
- C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\decompiler.exe
  "C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\decompiler.exe" serve
  2⤵
  PID:6552
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=bytebreakerV1.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=4520.5360.16455319661448339652
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:6624
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x178,0x17c,0x180,0x154,0x188,0x7ffbcb15b078,0x7ffbcb15b084,0x7ffbcb15b090
    3⤵
    PID:6648
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView" --webview-exe-name=bytebreakerV1.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1768,i,17857400535100082344,16109429602653448387,262144 --variations-seed-version --mojo-platform-channel-handle=1764 /prefetch:2
    3⤵
    PID:6904
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView" --webview-exe-name=bytebreakerV1.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2072,i,17857400535100082344,16109429602653448387,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:3
    3⤵
    PID:6908
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView" --webview-exe-name=bytebreakerV1.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2408,i,17857400535100082344,16109429602653448387,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:8
    3⤵
    PID:6464
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView" --webview-exe-name=bytebreakerV1.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3656,i,17857400535100082344,16109429602653448387,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
    3⤵
    PID:6328

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 7f0df92ba109a05fc4ec4f5ace27dd22788af7214d0bb20c562017a317e9ae9d
MD5 0bb5c0b22acffa889c1e932293de3655
SHA1 b84a05f9e8d6ac209f2d5a51f02475c2c3aa711b
SHA512 4579862e4727325c3cd326a370f79e3904b63dd5b83f57ff97dadad680a127bd818e37369d58f6200b6c28fdad4a5a9ea6206b6691346085f8d81de02d6e8752
TLSH
T150E02B69C966EC2B28FD0718A0141785EB64239B2A41994B7B3DC20C8FB26374985C1C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b8d058698dda2b0f734ebd9b51ed0a14fde832bd89de7816bac779d112336b38
MD5 77d42927b2664603dae828c558b0ce84
SHA1 03332230e918ca3d29d41b145a49f37310535532
SHA512 6d2e352c307a262c0df369043117ef96e990aa61f7310e8636c81fb905313f70dfb0268165cd95911b01f4f9c7ceb41e1a9d770d23540e51790eb63fa44583a4
TLSH
T144517DB3D3E88A7D891156F4AB116E1FCE690A14531C3C62C8E4FE5B53E2972D34178E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0227e985ba351d2e17d5ed4280cdebb073f483d5dde9488606b1426fd415ed90
MD5 84477f2f2e7f231d40d001b9b92e27f2
SHA1 d91fae6dbeab18edab444981611aba5d754daea8
SHA512 7a8c589ab1f2109bf5b9a5720708f0f3c3972866ada717794fd939acfa3713e79697b2c3d8213aa6fc33ff2e026ba02b8efc2f0573af8c356e391c5d895c14e3
SSDEEP 192:cRp3SA0/SMbv70pAPRp2dj9+Hhob+WNn4s0NQ7JesmVyIsnAUgtaJ:cRp3YBjgUX68CT0C7n+8
TLSH
T18842942EEA50697B6CDFD229FD617B57D3F2102125951E80E6FC8A1C16E75CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 61c34ce5e38eca9dc9c0693027dbe1c72ee127993022d2416db094bd3655c9bf
MD5 70654df10446ef5c99f13ba0e82485de
SHA1 c78f40cc83b428dcc45e370822d121fce52be76f
SHA512 9f4eb5f6fb688172215d86b0969b35302b4d42a6825f5247f9cf256a5cad20a3c09d3c126ede130c81cbc3ff57bc56ea37bb1807063c864b9161e67154e0b6cf
TLSH
T195B012C084035901C00206F811421CC87114DF10D70A270793F069228C361508155051
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59df69.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59df69.TMP
Size 96B
SHA256 9a00ff619d50250aac1c75ba90f1edb092f49bcdf7954f8bb28b09fa94cdc4bd
MD5 de3f287a13e5cb78d2af4c1631ad4319
SHA1 0f60572f4f387b6bc0101beab3579142cd415cbc
SHA512 a7b0451ac1175917a07139050a1c51fbf6ea2e04adbb35a58f2b21eee9c40b28bc0a8ba399f3c5a2e573aebbe9ba4077ac599a521647d884d77e8665f9d27669
TLSH
T150B02222C0022202C00223F028C0C2CCB220CF20CA03C22283F02A22CCBB2302A280A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 5c19801d02598d201613dbe18564f2abd77fdb5835de3c494f17a47d303e1ac6
MD5 c9aec0b46225f170a835ee6f70e74d10
SHA1 78d48aeae5aa86fec2bf90d1025ed15f7e453cdb
SHA512 d4bed8f084e49eef7634e9faa65895568be977acd7e4c0f65cad1ebdc026fe1872a2c31d845c2df88ef8e6f998290901441344ae123276693fc4d1e6cb082bc8
SSDEEP 3072:Ig1mgCELZtCpXh5qTfATCuIbzQACV1cnJLL5jqfd7NtZL8cHQRZEQ6Sps0e:nmg1kQfATCFbzQACjCqZ/ZLW3Ex0e
TLSH
T10134127BCBD10E3A1F424A7075430EEAB3F64A6AD5315744A36E27FB69C3C422682859
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 88f29668502196f5aa8394e4a3b998c9ff8dd048da0ad1ec8ac09251fe9d1889
MD5 91d647caa6aa561da01359c66118a3f6
SHA1 54450665aa990c151b6b4dac4553da5faeea4b2d
SHA512 30564325b174783940f028eb5da6b9d44ec80804eae61d3bb11cc7fdb9542e223966c73521d01300793ad693962a78b320424d0713596a53a19018d5d264512a
SSDEEP 1536:bbLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:9qfd7NtZL8cHQRZEQ6Sps3
TLSH
T10AC30237EBC21F339D97CB64B9130FDA67B644A99030D301AAAD37EB7C93591644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 f5b38f511398c78e983ff90170a52a682b45505e4001250391faf26e0c0e0b12
MD5 9af20d3f0a8b0f2b9bffa8bcfa15d97f
SHA1 167ae27dfedbd991d2e6531060f76a49579ec3f5
SHA512 b951916369499f351f7678ca7af62657683e96ac8e1dbf7352bd3fb61f60d57f2bc5130b63164cf7b3ae6c9bdd9514d6081169ed665f4994f4a6eb5c5ee45fbc
SSDEEP 3072:Rg1mgCELZtCpXh5qTfATCuIbzQACV1cnJLL5jqfd7NtZL8cHQRZEQ6Sps0e:gmg1kQfATCFbzQACjCqZ/ZLW3Ex0e
TLSH
T1E534127BCBD10E3B1F424A7075430EEAB3F64A6AD4355744A36E27FB69C3C422682859
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 6f93c2e19d5a13595d9f83e1fa480d827bcecb94c50cdd2151a41b8b81d4c786
MD5 1321e78345163c28792ac980dcad805e
SHA1 09deeaf4bcc37504b98b1dd660b1ec26c1d806a9
SHA512 549dc89729efb45d5bcff6ee06ce62f5ac2ec9bd748251db97456ba3548dc35f1bb8f2c5e3d17f7b709d22c0faf6cc3c9501e6fdfdf87e9d128bf801687015e2
SSDEEP 3072:wtB1mgCELZtCpXh5qTfATCuIbzQACV1cnJLL5jqfd7NtZL8cHQRZEQ6Sps0e:mvmg1kQfATCFbzQACjCqZ/ZLW3Ex0e
TLSH
T17434123B9FD00E3A1F424EA065431EA5A7F65A6FC9305748A36E27F76DC3C426682858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5ef87265fb315ae353f8956fe1637a70ca75d0378e75d68dbf9b58fa31835c95
MD5 912bdf113fdea1155b0bb71c70fc62ce
SHA1 052925f70ca969f313ab3aaeed0df4da91409ba6
SHA512 5c32f1fa9e8a135369e8504b0a4a8e5eaf2a496ca55168f52d194647cc5d05ca5cd548a96e485542904dd958fd50a5f59b2b35eaebc4f4e67f470b7b723ae89a
TLSH
T1B8D023317B65AAD1D135357AA4304741BF250176239DC1176154840CDC7D4C65BC97C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b28cb7be2bb68a6cda7ff7689f0ec4acdf8699e4818545d4dd692148ce1d64d2
MD5 a712889d00fb4f0945d13b925681156a
SHA1 1448cbfbc2c620e016aa5e6fccd0ac75e74ef2d1
SHA512 65f51cf451d5f77c9e695462e66abc873922db3c3999c172526727c2356a5a29052ce4b77ead44b02780ca80f6b290696b7633f537570254f36e7374ce0d04a5
TLSH
T12ED09B3277C5D541D5423276A41447816E164568159AC2175474444CDC69445579D147
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c5b1a407270ca9ae8bec8f20cc56244f3bde6f042890a4cabcdf4df3d21fdad
MD5 16f782e6f4d4592598936b2f29b6b339
SHA1 5c8c22b7f56af2b2e0d9978418f077cc8fd13c41
SHA512 28b2f7186b910539fa22408b47131fb16874b4c2192a721a69393efd7812da561ea9977b8af678cd3a9e37c23f186f876d7086a20afe28b16659db70955cf16f
TLSH
T15DD09232B7C9E241E14232BAA81447826E2A4A68259AC2176478844CEC6984AA79D28B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 13d55ad126102111d8133dda64e880263ae479a3dacef5d43086c056bbb008ad
MD5 b21755a653960b0f109a46da230da2f9
SHA1 24cc72802185702de0fe2cbe97b40b3c2778d74a
SHA512 4e0e739ab0e93a4d082d2629b7dc29728e0613a2b75d42848cffeb4a5fc3199ef9b310a87f2b858a6dec600eed09815aabf402018a8525c1c4b161cf221846f4
SSDEEP 96:cxpxlIEBWDib1T1haf7lEnF01PhE9SBCA9p:kpxF1p1hS7lUO15ESBvp
TLSH
T1A4E1B40923F904ECD711A739E3C9D92938F3EB7A29435D492D48E87C6839773A2E5027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a5bdd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a5bdd.TMP
Size 3KB
SHA256 2521fddcfc091aeb4dcd27cc68adcd79a00359a136ed20a999479d53fcb68aae
MD5 94f4b92bc06ff7dd4aa5158fca5591ac
SHA1 fa35678089e6602ff6ab3d58a7166390789107c7
SHA512 7680c78bf2d45a1efb7f9ab7f8bdf82687ff4a6ea0bdaf9e154d754551c7fdb18710e70ad139b13febe7b7edf31ed114c9bac0fb67565f00b7fb90977bd3d55a
TLSH
T1BF712B1A02FA489DD721A330F1DA1D1E7CF3E19A0E139E89319CD8BDA53A734E4A6558
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8478fd9ebd28aa51765cc926e88ac36c1f2d1b4cb47f385066d60347fac9aaf5
MD5 b07b794604df7a29855cf1c26515edbc
SHA1 266d95b23a5aa5f0be921da2bc7c08b3ca16e8b6
SHA512 2907a476590f638d354e2ec15b85b2998e430f00530319138628ead3a67d578ac1c7dbff72af900ff330771f98c9ba86e1fb896035475d55d9c773dc8b7dea29
TLSH
T10D516BF3C6E8862DD90156F4AB187E1BCE2D0A54832C3D6AC4E4EF5B93E2571E14194F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9333ae01cc5e07e2f5f01f450f694a1fa7560fedc32aa7fcf9b328f4e7d070c4
MD5 8c24a5bba2888b5cd94cbe43ad59842b
SHA1 18a816b9c660066565889018c427a2d08d409d80
SHA512 eba5846bee27719994f7c9a347e93932d572c88ad7eaeac1d39a975bc7c64479f3ed9c689b2f915d86a093a5053ac2a3a69759ea74c27d32faeb6ae98f12a372
SSDEEP 192:sxZURNyM/jK1Ml8MiF/fUscaRaSjLkFIdpETHW6+WNzw//eB84s3vYIg4J:sxZUnqF/fUscaA6LJiHbw/e5c
TLSH
T1E852E816AA385977CCCBD209FA55BF53D6F50572A6910D44AAFCCA0C01E6BED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4e03c2b3d9d219eb941cd424842608c82dd081968b9ec0d66bb301c7b7c4d2f5
MD5 66e2ed6cb891e99d480fe3def46f7ab2
SHA1 632bdd3b33ae7780f08ab2e8051fb3ac03a2833c
SHA512 4c977939d17dd7a7c53c54a95a21ed19d452fccd70b84dd9cd01829ee9e788d8ebdfcc358a41c09dac370e581ecf6469717adc93ad05c95b89f8ec8769fa6ced
SSDEEP 192:sxZURNyM/jK1Ml8fijF/fUsUWpVeaRaSjLkFIdpETHW6+WN+Sfw//eB8QuQhQmIh:sxZUnQGF/fUsUWveaA6LJiHbrU/eJlO
TLSH
T18D62D706AA345977CDDBD20DFA557F53D6F8046292910E44AAFCCA1C01E6BED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 56c7d8e81631dcd099d87e341445ec390e2e605921ead5790ae5137d64d430ac
MD5 6f0e142e128875af3a321c23d0a54e69
SHA1 8f3549e035fb55f3f600af01b358c31978622902
SHA512 50414e53153a4e62258c9a0c813fb735207606244d750d3914daf58375bfe2f64210d91e629417fb2afd95d5a42c9554296dd7348d0ca041b4c4b53fd9b5e986
SSDEEP 768:eQ8iJjB7pLuL7xNWvx78r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVi7hALl6opdhroV:eQ8iJj3E7xNWvx78ru1jaz7hALocdaoY
TLSH
T155F2FB3B6C0CCB7E4F804E9CEC2A7E9A6DE8018F5A98895447FA841C03C66EF55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 3390cf203a909f12d66972f7fcbfefa6b29a4db8e3fd4cf753bdd692f8cf31f2
MD5 21e850ae119db4e86c8ca5160312a2bc
SHA1 cd0aa0c7d435e1b5757d91b17912827d0c28855e
SHA512 870f055aa3dadad81b24c76548bb5fa4810b7b43cf929d46e4ca357457f50e307295eebd0ee2ace0f847b14adc2f817cb5201569dd10b548dd98ab80d2fc8e0e
TLSH
T167D0975BD2A20DA0E7FA8B82023102AB0B143C88584CA48CF403642E10BA6828321EE2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 86566e0e0bbc9d2c0ad9b7cca504be5ad14178c354748b014fe1e0400eb3345e
MD5 2caade8ce45ebab154757b4958255c9d
SHA1 30a419b12f00c0b148044cdbeaede2082e489480
SHA512 649290760a6ab9a4f6253bef4405aafac2ce44b3020ff838c21f8f44cb55ff8445a959b4a2c35649721bb0b4119682fffb884fc3ee8de222569c4dd0be8201aa
TLSH
T1CED0975BD2920EA0EAFE8B81023102AB0F003C88545D948CB403442A44AA6828322EE2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a2e83.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5a2e83.TMP
Size 138B
SHA256 383b7a23efcab5ea25abf2b38c5469a4d6651d1423453383417d4f3ea16225b6
MD5 707245719241fef3a0bc4052d2548afe
SHA1 34650dcee1a1f9dfecdb470b653b83e532c61542
SHA512 dea6bb3a1ca7a03985bdc1c7feb98490ef4f0072afa52d8026eed446e349d65da4d2467bc3a53537d7feb230d71f91c3ce15179f5f40de9b1b8f23d72ade0452
TLSH
T149C02BB7E3920D20DB7843810332415D4B843CCC1C8B888CB003341C20B4E132302EF5
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b2b89df70af97cb914d4a9f8197f207fc7f4b1f2ea0ad3294fa48f526fe110ee
MD5 3a08d11244bd2fd967f3821117fd20ce
SHA1 e923e74828c5fcdd494e635a98694d7489e9211e
SHA512 0627b4900f71bc80d680adb6397e5f1ee0154051f443427b53b8173210f27a06b0206263f91717e5690b0c332a96c61e7f8677ac7d537e08ae92d42627f5e585
SSDEEP 96:Ksg4KBW2qEgKNC/dqjXNn7vWj4mgfvK4+gBvcldQzLkH787d7I7s7G7K7+7MW7P:CXHadqjXNn7Oj4XfV+gBkldQzLkHoZsP
TLSH
T109911322317712122C3D3D49F295A6664682B5A33128F46B77E985B20F7BE254CFC8FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 3e649a2b3dd8c056c695f8d1bc9c8ec74937bbc020b5b9428dcb806bd0e901cd
MD5 9a22399c02764c7693dbad1cf3e16a38
SHA1 f7f91f4bc4805ee71e746a26f592aed3e7229422
SHA512 7fe3ccb69a8d867c82cc26dc4c707a838b4e23e08a12f4efffeaf7b508fc193009f5abca7879be8a713c64712aaef9e105dc6fcef815284d8deb291be3521d1c
SSDEEP 384:nPtNn/s3n9SfsNXdPN3c3kkTiiIKl8BhBTPLBliOA:Pj+9U9VIKl8BvTPaOA
TLSH
T144927D32AC681D7B4DA39949F50736175FB4407BA7C52FA4DAEC6B1C00DB2AC530BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 ce9c76d2cbc6025ef3dee9854c0ecd1c24a4289f06de2750749e4f3b5f4962e8
MD5 d62dd6ef856abbd67ba2accb241c5061
SHA1 2bf32a6731f87e73b157c9503a8888ebcc2d43d0
SHA512 e0ea3e1ef65c7b76998a7474db928cbfa053f8478f3a0607adc14eb6da8d9318090d8470e9aa1746d817ed1b1c4a4eb506a5bccbe865d76439f323bd112c737a
SSDEEP 384:ngtNn/s3n9SfsNXdPN3b3kkTiiETAStSIpO0Y5qY437qKl8BhBTPLBliOA:gj+9UkV1Scv5qY437qKl8BvTPaOA
TLSH
T12AC25AB1D8951CEB0992E8C9B543F6176DB40037868C1E5CE6F8BB3C309F6F82716969
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 47cf12e8fa7df188f4b32b05344803956380096c2172c3d1f4de99774d451073
MD5 7786a3204c0b29b352d99d0b711d8941
SHA1 6ca76bf16ba201e933e328e80328906b6287fe88
SHA512 861ca2dd6800a73657d6b56914806def28961fd607c96624463ba39d134c9a24aac4766ea6788fd1135ea4b24b58a6790d0a184ec14bee8e4105235964321ecf
SSDEEP 96:ZqONk1QsjpfmUTmDK5ih/cIPURHl8h4otop5V5DBBhPwivh50xy0SFYKCAxTeYNd:gONl6kDfQmiUyn3Z903plQibctU6
TLSH
T1B102F935A8786CBB8EA3AE46F44737175FE4112BEA952F84DAE81B1C04D764C1707837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 66349c2c453a6c60309ba10da6e84b184a755a7bc7094599c8c6c935f0b72f9c
MD5 363a2b9948745518610d94b7fc568774
SHA1 6dac772f0f614ae587fc7593ec88afb662669048
SHA512 58c6cdd10fd25b5b866bea43b2487b0ba068552073f10104a64cb9b0c0bec996c4755e68b756e5e45dc3f73877d700ca123d85d3df3704d5390133126e0af413
SSDEEP 96:yqONk2QsjpfmUTQK5ih/cIPURHl8h4otop5VGDBBlPwivh50xy0SFYKCAxTeYNsd:JONC6kxQmiUyS3F903pTeF3ycRbqyEU6
TLSH
T1FF122A36A8B86C7B8DE3A851F44336175FA44127EBC92F91D5EC2B1C05EF69C130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f639b144-efb2-4d2f-89d3-20257791aad0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f639b144-efb2-4d2f-89d3-20257791aad0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0e5cb720c5129400e7b8a6fab31a393b61e2948533f45722e91da8e9663eefb4
MD5 f16c2864db465c7a3ff2cc4114734e1b
SHA1 38d38859e642f5e55a7cdb2ea008e76b4c84496e
SHA512 2a878dbbb6d30cff3a2fab0fb7a14db54ec1bd5c5f189972d0db144574b4c5cda8d0f9ee9c12937667a2ffff61ff050b449098d6c4d6deda964342f8eeec429d
TLSH
T151412C58AAF91148B3736F5AAFF6A86E487F7C772E06C05D10120E4F0666740C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

a65a0b85-6942-450e-a9c9-1cec87745123.tmp

Path C:\Users\Admin\AppData\Local\Temp\a65a0b85-6942-450e-a9c9-1cec87745123.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd032ccd-d1ae-4139-ad11-5c9ad4bbd251.tmp

Path C:\Users\Admin\AppData\Local\Temp\cd032ccd-d1ae-4139-ad11-5c9ad4bbd251.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3820_1356181489\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a256f359-35f8-4530-8fbe-535b379e2d1f.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3820_839035644\a256f359-35f8-4530-8fbe-535b379e2d1f.tmp
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file.txt

Path C:\Users\Admin\AppData\Local\file.txt
Size 58B
SHA256 7d6509fd6f1774ac084a2f5dbbb6b44e29f556f02d577c8e29af7b881d8e0c2b
MD5 95eca2ab115d93f43e4871136ff8480c
SHA1 2dfd2001c5666d8bcc072fdc152124601f31735b
SHA512 47e8ce003370c1bcae94b8e77e9fbf48153dfe9c79f42d2f194e4322dbcd642467e824104a21e23e547f0953dc332954b3d3880c89988e18dd10c8caec49fa22
TLSH
T105A002946590A5899C5DC7583D90F4801461408719EFD255CC305A15000661214B6149
MD5 SHA1 SHA512 TLSH

Submit Download

bytebreakerV1.zip

Path C:\Users\Admin\Downloads\bytebreakerV1.zip
Size 16.0MB
SHA256 74da5f785c95021eeb25dbe3c37a460e163dfdfe9df95e87e04e169171d5ea0d
MD5 5376031c9ec523b94481616520a52ef4
SHA1 6a21745db8772ee32bb6e2bc7876e499983f50e3
SHA512 abc89bb89b829b4bd91b6fbbac71e00c7b2dd315bb0bdd28907ece79f6066387306a5a8f6170bc38e9645925c465c806fbc59d85e08e9c555831c3950f6677da
SSDEEP 393216:wj5R/2SB1426c3qVqZDptsf8Ijhva2jCg5f:wdR/LCIqVm/sEWhPGg5f
TLSH
T1FBF63349575281E1CC2932B174E3FE72FA80A210DCA1FD4302D9DB26A976BD92DD3B74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ab056dee08b5c72a9e9e27f392875c5d870426a882120fdf14eff9318acc5f77
MD5 17dd5e90c697e509f252eb127d61434e
SHA1 b84618f39b5443d08c5692727cd32eb8de02b3f7
SHA512 49654bc6a4fef8853e281a64c8e6bd30d5bd196665bcf0dc3626ae4dbae33275adfb844615aff4624cea37f0d5cb293ac163e661f0bd6fde5e78783ec8db092f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ea311b3255535bc01a9a679d8bf3fc64fca97fe37731171c87da2308ec8e4f0f
MD5 975e7e2f010d890575935cc4202f2884
SHA1 5e1d780e7398e63024889e15e7d6ccafa3efadfb
SHA512 62c86d3a9a1661e3cfedfaab853192c3f3cd1802ba5cf84902133ab9db772cafe6ea353a20e07a0b2d6cbda251714581af6f803280f528289f09fa53243fd236
TLSH
T15FD0121273110138C01030330142B2085400C10B401580445469951E2B5C0542D16896
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Local State
Size 1KB
SHA256 b51affb40a6c0a7b519fd62ed63625cdd5f1b3d4c4fb735bfad38f54b2024bed
MD5 c38ef7c3601d29c91cdc14fb28e35390
SHA1 f989b876c72445fff72b18566ddf23a09a4dd38c
SHA512 6800ae7bff13151fffedf622e82b5ba985953372d4cb4ed9f228c08c0c0f97fdfcc0f42b4c6978f83a8b93067d5c2f9bfa09cc1958fc9857de2f0cf9a43ef106
TLSH
T18C318777E0982F37ACC2954676563B4F2E31006E82114D1496DD4B0D13F35EDD52AD23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Local State
Size 2KB
SHA256 804044b54fd71e363f17d6e60b63adecd1e03881b9d296e0e333817056b67b21
MD5 cfe557ebb9a3083a1223a0ae12eb11ff
SHA1 a1b006a84938f1633813a7a04385ee1eb4c2d1a8
SHA512 83e0d71b87f82a5cce443134ecbf988259ea767d655fa1b4e936b640f158dd621aa91f641f0807ba2117dda4fb0b72cc3fa659ff99682423e7df8f24068e3612
TLSH
T10F51B433B858AB378DE3D9447D093F0BAE3500A597621F608ADC0B0C02E76ED6306C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 0a8f2577755560f5a570205f65d56f92a613b1f008c87da61494b69b31413d8b
MD5 70483892a987bddab4f513cbf18e6e55
SHA1 b747f4e64d2bad0bffb4229ba5397bb0c8230ba8
SHA512 9f6bd33ec68dbf9effd530c8226c3c6ddb3c8c3c57f7a4db80b133b915cebc06cfb0210ba1d8a78057108edec416d75caddeafb026a6e8f4fafa1a1593ab2e12
TLSH
T141719837A868AA374DE3D945B9853B0AB6750137D6952FA4CAEC0F0C02E73D91352C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Local State
Size 15KB
SHA256 aeabdc5ea9c9c4af754bf3403e3da281affb78057c6982cafb4b51efc2021fbc
MD5 466b4755c24d61dc7447500f07e1eabb
SHA1 08d52d0ac88e91c438885e6984be19d973a552cb
SHA512 0b72e382f3a2f6098e52e94b319a3a9d1e60f9c3c15b4a915fc8a5638dc093cf9eb289044744baca48b86bebd186b0560802fcb2ba23b3c2c04beacf07e1a8f3
SSDEEP 384:zksrv+89zHqlDNP9oid6NbuWiuZFwynkNB:Drv+4UNbddAFwykNB
TLSH
T11D729E33A57C97339DF2D945B48A3A073B7851AA96D20AB4C9DD4F8D42DF0DA2316D03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5a5824.TMP

Path C:\Users\Admin\Downloads\bytebreakerV1\bytebreakerV1\bytebreakerV1.exe.WebView2\EBWebView\Local State~RFe5a5824.TMP
Size 1KB
SHA256 903abdf5359343e5fdc66a8c93d93d2df6a245c33c08d038345946d23309769a
MD5 45291ae470ec28f2ab9a1ad97b4caa5b
SHA1 718eaac4531f41e4d61a27b8cb68ad3af03a063f
SHA512 392338e63dcdb56c30daf24003a41533e55abe37366adf775bb1d1459eb0df4477861ad008eaf531245d8a4d9ceb5a08d7128315dc66d119b288aa304ea0ae7d
TLSH
T117214277D0985B37A9819446B612778F2E3001AE92144E18D2DD470913E75EED676823
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4520-129-0x0000023765990000-0x0000023765A44000-memory.dmp

Download

memory/4520-138-0x0000023765F50000-0x00000237660D6000-memory.dmp

Download

memory/4520-120-0x0000000000190000-0x0000000000E6E000-memory.dmp

Download

memory/4520-124-0x0000000000190000-0x0000000000E6E000-memory.dmp

Download

memory/4520-1075-0x0000023766CC0000-0x0000023766CC8000-memory.dmp

Download

memory/4520-890-0x0000000000190000-0x0000000000E6E000-memory.dmp

Download

memory/4520-631-0x0000023765470000-0x0000023765667000-memory.dmp

Download

memory/4520-625-0x0000023765E70000-0x0000023765E7E000-memory.dmp

Download

memory/4520-624-0x000002376AC70000-0x000002376ACA8000-memory.dmp

Download

memory/4520-623-0x0000023765E50000-0x0000023765E58000-memory.dmp

Download

memory/4520-620-0x0000023765E80000-0x0000023765F18000-memory.dmp

Download

memory/4520-1424-0x0000023765470000-0x0000023765667000-memory.dmp

Download

memory/4520-130-0x0000023765D90000-0x0000023765DB2000-memory.dmp

Download

memory/4520-128-0x000002374CD90000-0x000002374CDA8000-memory.dmp

Download

memory/4520-125-0x0000000000190000-0x0000000000E6E000-memory.dmp

Download

memory/4520-127-0x000002374CD70000-0x000002374CD8A000-memory.dmp

Download

memory/4520-126-0x0000023765820000-0x00000237658CC000-memory.dmp

Download

memory/4520-1384-0x0000023765470000-0x0000023765667000-memory.dmp

Download

memory/6328-1222-0x00007FFBFC150000-0x00007FFBFC151000-memory.dmp

Download

memory/6464-1167-0x00007FFBFCB10000-0x00007FFBFCB11000-memory.dmp

Download

memory/6464-1151-0x00007FFBFCEB0000-0x00007FFBFCEB1000-memory.dmp

Download

memory/6904-1101-0x00007FFBFC150000-0x00007FFBFC151000-memory.dmp

Download