Overview

overview

8

Static

static

1

GraphPad.P...64.rar

windows10-2004-x64

7

GraphPad.P...64.rar

windows11-ltsc_2024-x64

8

Resubmissions

29/07/2026, 23:46

260729-3se8gaveka8

29/07/2026, 23:20

260729-3bjvbsxxfs8

29/07/2026, 23:00

260729-2zfbdathrf8

29/07/2026, 22:52

260729-2tfd7agc687

Analysis

  • user interaction
    yes
  • max time kernel
    900s
  • max time network
    902s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    29/07/2026, 23:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    GraphPad.Prism.10.3.1.509.x64.rar
  • Size 216.6MB
  • Sample260729-2zfbdathrf
  • SHA256 75789e217425131f57f97a655ffb86dd53633d876720c12cf5265f66e0ec4a75
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarespywaretrojan

Malware Config

Signatures

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 32 IoCs
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 20 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 3 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 15 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 2 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 13 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 53 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\GraphPad.Prism.10.3.1.509.x64.rar"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3736
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:4412
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4408
    • C:\Program Files\7-Zip\7zG.exe
      "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\GraphPad.Prism.10.3.1.509.x64\" -ad -an -ai#7zMap17470:138:7zEvent16609
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:984
    • C:\Program Files\7-Zip\7zG.exe
      "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\GraphPad.Prism.10.3.1.509.x64\" -spe -an -ai#7zMap10082:138:7zEvent2869
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:4128
    • C:\Program Files\7-Zip\7zG.exe
      "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\" -an -ai#7zMap9348:138:7zEvent7334
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:616
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\GraphPad.Prism.10.3.1.509.x64\ReadMe (How to Install).txt
      1⤵
      • Opens file in notepad (likely ransom note)
      PID:1200
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://soft98.ir/
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:5108
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://soft98.ir/
        2⤵
        • Enumerates system info in registry
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4024
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x260,0x7ffb8a4dc188,0x7ffb8a4dc194,0x7ffb8a4dc1a0
          3⤵
            PID:2040
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,514245975708001815,380447570540780099,524288 --field-trial-handle=2292,i,13938937276779058682,6354078356349572984,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:3
            3⤵
            • System Time Discovery
            PID:3224
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,16539558153830869669,2120698730720433424,262144 --field-trial-handle=2292,i,13938937276779058682,6354078356349572984,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
            3⤵
              PID:644
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,7809307022360829581,381004643515893783,524288 --field-trial-handle=2292,i,13938937276779058682,6354078356349572984,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:8
              3⤵
                PID:4224
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,12601903736172963515,7160354509165116356,2097152 --field-trial-handle=2292,i,13938937276779058682,6354078356349572984,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
                3⤵
                  PID:4848
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,2387192715638906438,7423954347534354827,2097152 --field-trial-handle=2292,i,13938937276779058682,6354078356349572984,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
                  3⤵
                    PID:3852
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,10793773885461226591,148620047946705132,2097152 --field-trial-handle=2292,i,13938937276779058682,6354078356349572984,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
                    3⤵
                      PID:668
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,15485826020096497723,18278039703620024543,2097152 --field-trial-handle=2292,i,13938937276779058682,6354078356349572984,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:2
                      3⤵
                        PID:764
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,9211219027737319608,13206165636138233615,524288 --field-trial-handle=2292,i,13938937276779058682,6354078356349572984,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8
                        3⤵
                          PID:3196
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,17962123628521880999,12601076617128881923,524288 --field-trial-handle=2292,i,13938937276779058682,6354078356349572984,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
                          3⤵
                            PID:2124
                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                        1⤵
                          PID:584
                        • C:\Users\Admin\AppData\Local\Temp\GraphPad.Prism.10.3.1.509.x64\GraphPad.Prism.10.3.1.509.x64\Crack\prism.exe
                          "C:\Users\Admin\AppData\Local\Temp\GraphPad.Prism.10.3.1.509.x64\GraphPad.Prism.10.3.1.509.x64\Crack\prism.exe"
                          1⤵
                          • Executes dropped EXE
                          PID:5112
                        • C:\Windows\System32\msiexec.exe
                          "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\GraphPad.Prism.10.3.1.509.x64\GraphPad.Prism.10.3.1.509.x64\Setup.msi"
                          1⤵
                          • Badlisted process makes network request
                          • Enumerates connected drives
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of WriteProcessMemory
                          PID:1088
                          • C:\Users\Admin\AppData\Local\Temp\MSIB634.tmp
                            "C:\Users\Admin\AppData\Local\Temp\MSIB634.tmp"
                            2⤵
                            • Executes dropped EXE
                            PID:4640
                        • C:\Windows\system32\msiexec.exe
                          C:\Windows\system32\msiexec.exe /V
                          1⤵
                          • Enumerates connected drives
                          • Drops file in Program Files directory
                          • Drops file in Windows directory
                          • Modifies Internet Explorer settings
                          • Modifies data under HKEY_USERS
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:4872
                          • C:\Windows\syswow64\MsiExec.exe
                            C:\Windows\syswow64\MsiExec.exe -Embedding 803AB6355C30B7130B9B0E094DB2A0C9 C
                            2⤵
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            PID:1208
                          • C:\Windows\system32\srtasks.exe
                            C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                            2⤵
                              PID:4084
                            • C:\Windows\syswow64\MsiExec.exe
                              C:\Windows\syswow64\MsiExec.exe -Embedding 1F69F9E4A5E7E896D066BAB0FEE307EA
                              2⤵
                              • Loads dropped DLL
                              • System Location Discovery: System Language Discovery
                              PID:1340
                            • C:\Windows\System32\MsiExec.exe
                              "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\GraphPad\Prism\PrismSearchPlugin64.dll"
                              2⤵
                              • Loads dropped DLL
                              • Modifies registry class
                              PID:1692
                            • C:\Windows\syswow64\MsiExec.exe
                              C:\Windows\syswow64\MsiExec.exe -Embedding 3675F8546CF35F44A7CDF318710AC568 E Global\MSI0000
                              2⤵
                              • System Location Discovery: System Language Discovery
                              • Modifies data under HKEY_USERS
                              • Suspicious use of WriteProcessMemory
                              PID:4768
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\system32\cmd.exe" /c Echo Y| cacls "C:\ProgramData\\GraphPad Software\Prism" /t /e /c /g everyone:F
                                3⤵
                                • Executes a command shell one-liner
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:4052
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /S /D /c" Echo Y"
                                  4⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:528
                                • C:\Windows\SysWOW64\cacls.exe
                                  cacls "C:\ProgramData\\GraphPad Software\Prism" /t /e /c /g everyone:F
                                  4⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:3276
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\system32\cmd.exe" /c Echo Y| cacls "C:\Users\Admin\AppData\Roaming\\GraphPad Software\Prism" /t /e /c /g everyone:F
                                3⤵
                                • Executes a command shell one-liner
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:3456
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /S /D /c" Echo Y"
                                  4⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2720
                                • C:\Windows\SysWOW64\cacls.exe
                                  cacls "C:\Users\Admin\AppData\Roaming\\GraphPad Software\Prism" /t /e /c /g everyone:F
                                  4⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2796
                            • C:\Windows\Installer\MSI3C30.tmp
                              "C:\Windows\Installer\MSI3C30.tmp" /EnforcedRunAsAdmin /DontWait "C:\Program Files\GraphPad\Prism\\prism.exe"
                              2⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              PID:740
                          • C:\Windows\system32\vssvc.exe
                            C:\Windows\system32\vssvc.exe
                            1⤵
                            • Checks SCSI registry key(s)
                            PID:2672
                          • C:\Program Files\GraphPad\Prism\prism.exe
                            "C:\Program Files\GraphPad\Prism\prism.exe"
                            1⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Checks whether UAC is enabled
                            • Modifies registry class
                            • Suspicious behavior: GetForegroundWindowSpam
                            • Suspicious use of SetWindowsHookEx
                            • Suspicious use of WriteProcessMemory
                            PID:428
                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=prism.exe --webview-exe-version=10.3.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --mojo-named-platform-channel-pipe=428.1648.4975418394032701315
                              2⤵
                              • Drops file in Program Files directory
                              • Enumerates system info in registry
                              • Modifies data under HKEY_USERS
                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              • Suspicious use of WriteProcessMemory
                              PID:4260
                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x178,0x17c,0x180,0x10c,0x1b0,0x7ffb8203b078,0x7ffb8203b084,0x7ffb8203b090
                                3⤵
                                  PID:2080
                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView" --webview-exe-name=prism.exe --webview-exe-version=10.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1768,i,1339073579192283130,14032003604626358760,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version --mojo-platform-channel-handle=1712 /prefetch:2
                                  3⤵
                                    PID:4028
                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView" --webview-exe-name=prism.exe --webview-exe-version=10.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2052,i,1339073579192283130,14032003604626358760,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:3
                                    3⤵
                                      PID:3216
                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView" --webview-exe-name=prism.exe --webview-exe-version=10.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2100,i,1339073579192283130,14032003604626358760,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:8
                                      3⤵
                                        PID:2748
                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView" --webview-exe-name=prism.exe --webview-exe-version=10.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=2748,i,1339073579192283130,14032003604626358760,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
                                        3⤵
                                          PID:3480
                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView" --webview-exe-name=prism.exe --webview-exe-version=10.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4212,i,1339073579192283130,14032003604626358760,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:1
                                          3⤵
                                            PID:552
                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView" --webview-exe-name=prism.exe --webview-exe-version=10.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2124,i,1339073579192283130,14032003604626358760,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:8
                                            3⤵
                                              PID:2512
                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView" --webview-exe-name=prism.exe --webview-exe-version=10.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5052,i,1339073579192283130,14032003604626358760,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:8
                                              3⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:4240
                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView" --webview-exe-name=prism.exe --webview-exe-version=10.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5088,i,1339073579192283130,14032003604626358760,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
                                              3⤵
                                                PID:3236
                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView" --webview-exe-name=prism.exe --webview-exe-version=10.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1280,i,1339073579192283130,14032003604626358760,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:8
                                                3⤵
                                                  PID:4760
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.graphpad.com/register/?SN=GPS-5869837-TLUW-2ABB9&ID=723E5985E0C&PC=RYSBVXZE&version=10.3.1&build=509&platform=Windows&osVersion=10.0.19041&osBitVersion=64&configuration=full&appLanguageCode=en-us
                                                2⤵
                                                • Suspicious use of WriteProcessMemory
                                                PID:4756
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://www.graphpad.com/register/?SN=GPS-5869837-TLUW-2ABB9&ID=723E5985E0C&PC=RYSBVXZE&version=10.3.1&build=509&platform=Windows&osVersion=10.0.19041&osBitVersion=64&configuration=full&appLanguageCode=en-us
                                                  3⤵
                                                  • Checks processor information in registry
                                                  • Enumerates system info in registry
                                                  • Modifies data under HKEY_USERS
                                                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                  • Suspicious use of FindShellTrayWindow
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:3744
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2ec,0x7ffb8a4dc188,0x7ffb8a4dc194,0x7ffb8a4dc1a0
                                                    4⤵
                                                      PID:3488
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1740,i,15757421341823054199,17023173788382195030,524288 --field-trial-handle=2576,i,9638532293694986644,5387837774954091800,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:3
                                                      4⤵
                                                      • System Time Discovery
                                                      PID:3912
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,12375027856872707517,8895906971280560125,262144 --field-trial-handle=2576,i,9638532293694986644,5387837774954091800,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:2
                                                      4⤵
                                                        PID:2548
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,915465655275823878,10171547314062248179,524288 --field-trial-handle=2576,i,9638532293694986644,5387837774954091800,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
                                                        4⤵
                                                          PID:2948
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3372,i,343104773798278096,4798506424210403925,2097152 --field-trial-handle=2576,i,9638532293694986644,5387837774954091800,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
                                                          4⤵
                                                            PID:3088
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3376,i,8647787474265447455,17109747890676232498,2097152 --field-trial-handle=2576,i,9638532293694986644,5387837774954091800,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:1
                                                            4⤵
                                                              PID:2956
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,2688602039534360061,16707827329379756280,524288 --field-trial-handle=2576,i,9638532293694986644,5387837774954091800,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:8
                                                              4⤵
                                                                PID:3772
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,12463273992947827129,170385182641231994,524288 --field-trial-handle=2576,i,9638532293694986644,5387837774954091800,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:8
                                                                4⤵
                                                                  PID:4272
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,12238779228121522277,15253394805449651234,524288 --field-trial-handle=2576,i,9638532293694986644,5387837774954091800,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
                                                                  4⤵
                                                                    PID:4028
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,3441893051671555607,17503547728714362192,524288 --field-trial-handle=2576,i,9638532293694986644,5387837774954091800,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
                                                                    4⤵
                                                                      PID:3008
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,1201882478492438147,1800231586134203752,524288 --field-trial-handle=2576,i,9638532293694986644,5387837774954091800,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
                                                                      4⤵
                                                                        PID:3884
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,1201882478492438147,1800231586134203752,524288 --field-trial-handle=2576,i,9638532293694986644,5387837774954091800,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
                                                                        4⤵
                                                                          PID:2632
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,13816869096484082453,586344185741781456,524288 --field-trial-handle=2576,i,9638532293694986644,5387837774954091800,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
                                                                          4⤵
                                                                            PID:4256
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,16487300697976844757,10056459527037457115,524288 --field-trial-handle=2576,i,9638532293694986644,5387837774954091800,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
                                                                            4⤵
                                                                              PID:3968
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,4109385732403342877,12135499559392201523,524288 --field-trial-handle=2576,i,9638532293694986644,5387837774954091800,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
                                                                              4⤵
                                                                                PID:2856
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,4688125237572409685,11839093389478273185,524288 --field-trial-handle=2576,i,9638532293694986644,5387837774954091800,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
                                                                                4⤵
                                                                                  PID:4888
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,1888982955461705799,5501788152327294710,524288 --field-trial-handle=2576,i,9638532293694986644,5387837774954091800,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
                                                                                  4⤵
                                                                                    PID:5216
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
                                                                                    4⤵
                                                                                    • Drops file in Program Files directory
                                                                                    • Checks processor information in registry
                                                                                    • Enumerates system info in registry
                                                                                    • Modifies data under HKEY_USERS
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    PID:5168
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffb8a4dc188,0x7ffb8a4dc194,0x7ffb8a4dc1a0
                                                                                      5⤵
                                                                                        PID:3348
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1368,i,6300606762982558825,9370974335180631943,524288 --field-trial-handle=2160,i,7337637456164379714,17533016564570366390,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:3
                                                                                        5⤵
                                                                                        • System Time Discovery
                                                                                        PID:5412
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,7709582869439197484,4407278069473138612,262144 --field-trial-handle=2160,i,7337637456164379714,17533016564570366390,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:2
                                                                                        5⤵
                                                                                          PID:5420
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,17209979367729925160,18230429214067087863,524288 --field-trial-handle=2160,i,7337637456164379714,17533016564570366390,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
                                                                                          5⤵
                                                                                            PID:2236
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,12335748811579792445,15745668508224037546,524288 --field-trial-handle=2160,i,7337637456164379714,17533016564570366390,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:8
                                                                                            5⤵
                                                                                              PID:5864
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,12335748811579792445,15745668508224037546,524288 --field-trial-handle=2160,i,7337637456164379714,17533016564570366390,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:8
                                                                                              5⤵
                                                                                                PID:5872
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,5210776206562584232,1162067290500055941,524288 --field-trial-handle=2160,i,7337637456164379714,17533016564570366390,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:8
                                                                                                5⤵
                                                                                                  PID:2304
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,15747973726476910086,13597673884233097968,524288 --field-trial-handle=2160,i,7337637456164379714,17533016564570366390,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:8
                                                                                                  5⤵
                                                                                                    PID:3476
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,12734056782569600303,1372463573038319697,524288 --field-trial-handle=2160,i,7337637456164379714,17533016564570366390,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:8
                                                                                                    5⤵
                                                                                                      PID:5144
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4692,i,17025323127601865854,4677313435257328405,524288 --field-trial-handle=2160,i,7337637456164379714,17533016564570366390,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:8
                                                                                                      5⤵
                                                                                                        PID:432
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,2462817974284163046,5948575322252906048,524288 --field-trial-handle=2160,i,7337637456164379714,17533016564570366390,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
                                                                                                        5⤵
                                                                                                          PID:4844
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4608,i,2148017291463297634,9298176709140185033,524288 --field-trial-handle=2160,i,7337637456164379714,17533016564570366390,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
                                                                                                          5⤵
                                                                                                            PID:6116
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5072,i,5215755012367899971,13705268903361033206,262144 --field-trial-handle=2160,i,7337637456164379714,17533016564570366390,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
                                                                                                            5⤵
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            PID:2084
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,12375709057484486910,1898149451106250278,524288 --field-trial-handle=2160,i,7337637456164379714,17533016564570366390,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:8
                                                                                                            5⤵
                                                                                                              PID:1436
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4076,i,7481988003506754560,3278437945269536149,524288 --field-trial-handle=2160,i,7337637456164379714,17533016564570366390,262144 --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:8
                                                                                                              5⤵
                                                                                                                PID:3476
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4756,i,540932612921111579,7872734758321576731,524288 --field-trial-handle=2160,i,7337637456164379714,17533016564570366390,262144 --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:8
                                                                                                                5⤵
                                                                                                                  PID:3824
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3956,i,6940265502984446547,47903180305581669,524288 --field-trial-handle=2160,i,7337637456164379714,17533016564570366390,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:8
                                                                                                                  5⤵
                                                                                                                    PID:5836
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,12719703656331124545,3610090233310388829,524288 --field-trial-handle=2160,i,7337637456164379714,17533016564570366390,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:8
                                                                                                                    5⤵
                                                                                                                      PID:6000
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,2650040987741903509,10055304032441756190,524288 --field-trial-handle=2160,i,7337637456164379714,17533016564570366390,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
                                                                                                                      5⤵
                                                                                                                        PID:4980
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,9340985941733742614,7539342707665713001,524288 --field-trial-handle=2160,i,7337637456164379714,17533016564570366390,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:8
                                                                                                                        5⤵
                                                                                                                          PID:3200
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3992,i,6548419289087679636,8934420179778808425,524288 --field-trial-handle=2160,i,7337637456164379714,17533016564570366390,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:8
                                                                                                                          5⤵
                                                                                                                            PID:1948
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,2630873688547298398,2970232777144153986,524288 --field-trial-handle=2160,i,7337637456164379714,17533016564570366390,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
                                                                                                                            5⤵
                                                                                                                              PID:2364
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,1404550534722414636,8243800335558082134,524288 --field-trial-handle=2160,i,7337637456164379714,17533016564570366390,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:8
                                                                                                                              5⤵
                                                                                                                                PID:6124
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,17940490590204833921,13235069723508684822,524288 --field-trial-handle=2160,i,7337637456164379714,17533016564570366390,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
                                                                                                                                5⤵
                                                                                                                                  PID:5820
                                                                                                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=prism.exe --webview-exe-version=10.3.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --mojo-named-platform-channel-pipe=428.1648.9731364925702510907
                                                                                                                            2⤵
                                                                                                                            • Drops file in Program Files directory
                                                                                                                            • Enumerates system info in registry
                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                            PID:5832
                                                                                                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x17c,0x180,0x184,0x158,0x258,0x7ffb8203b078,0x7ffb8203b084,0x7ffb8203b090
                                                                                                                              3⤵
                                                                                                                                PID:5860
                                                                                                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView" --webview-exe-name=prism.exe --webview-exe-version=10.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1888,i,15432272378961567447,11864774472599169133,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version --mojo-platform-channel-handle=1884 /prefetch:2
                                                                                                                                3⤵
                                                                                                                                  PID:2140
                                                                                                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView" --webview-exe-name=prism.exe --webview-exe-version=10.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1796,i,15432272378961567447,11864774472599169133,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
                                                                                                                                  3⤵
                                                                                                                                    PID:2044
                                                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView" --webview-exe-name=prism.exe --webview-exe-version=10.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2332,i,15432272378961567447,11864774472599169133,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:8
                                                                                                                                    3⤵
                                                                                                                                      PID:1032
                                                                                                                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView" --webview-exe-name=prism.exe --webview-exe-version=10.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3444,i,15432272378961567447,11864774472599169133,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
                                                                                                                                      3⤵
                                                                                                                                        PID:4160
                                                                                                                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView" --webview-exe-name=prism.exe --webview-exe-version=10.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3812,i,15432272378961567447,11864774472599169133,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:1
                                                                                                                                        3⤵
                                                                                                                                          PID:6140
                                                                                                                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView" --webview-exe-name=prism.exe --webview-exe-version=10.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3660,i,15432272378961567447,11864774472599169133,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:1
                                                                                                                                          3⤵
                                                                                                                                            PID:4472
                                                                                                                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView" --webview-exe-name=prism.exe --webview-exe-version=10.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4780,i,15432272378961567447,11864774472599169133,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:8
                                                                                                                                            3⤵
                                                                                                                                              PID:6132
                                                                                                                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView" --webview-exe-name=prism.exe --webview-exe-version=10.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2104,i,15432272378961567447,11864774472599169133,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:8
                                                                                                                                              3⤵
                                                                                                                                                PID:6104
                                                                                                                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView" --webview-exe-name=prism.exe --webview-exe-version=10.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4816,i,15432272378961567447,11864774472599169133,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:8
                                                                                                                                                3⤵
                                                                                                                                                  PID:5084
                                                                                                                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView" --webview-exe-name=prism.exe --webview-exe-version=10.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=796,i,15432272378961567447,11864774472599169133,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:8
                                                                                                                                                  3⤵
                                                                                                                                                    PID:5684
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView" --webview-exe-name=prism.exe --webview-exe-version=10.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4924,i,15432272378961567447,11864774472599169133,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:8
                                                                                                                                                    3⤵
                                                                                                                                                      PID:3136
                                                                                                                                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView" --webview-exe-name=prism.exe --webview-exe-version=10.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4932,i,15432272378961567447,11864774472599169133,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:8
                                                                                                                                                      3⤵
                                                                                                                                                        PID:376
                                                                                                                                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView" --webview-exe-name=prism.exe --webview-exe-version=10.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4916,i,15432272378961567447,11864774472599169133,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:8
                                                                                                                                                        3⤵
                                                                                                                                                          PID:4500
                                                                                                                                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView" --webview-exe-name=prism.exe --webview-exe-version=10.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4984,i,15432272378961567447,11864774472599169133,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:8
                                                                                                                                                          3⤵
                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                          PID:2776
                                                                                                                                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView" --webview-exe-name=prism.exe --webview-exe-version=10.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4980,i,15432272378961567447,11864774472599169133,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:8
                                                                                                                                                          3⤵
                                                                                                                                                            PID:5172
                                                                                                                                                      • C:\Windows\system32\NOTEPAD.EXE
                                                                                                                                                        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\GraphPad.Prism.10.3.1.509.x64\GraphPad.Prism.10.3.1.509.x64\ReadMe (How to Install).txt
                                                                                                                                                        1⤵
                                                                                                                                                        • Modifies registry class
                                                                                                                                                        • Opens file in notepad (likely ransom note)
                                                                                                                                                        • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                        PID:2944
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\GraphPad.Prism.10.3.1.509.x64\GraphPad.Prism.10.3.1.509.x64\Keygen\keygen.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\GraphPad.Prism.10.3.1.509.x64\GraphPad.Prism.10.3.1.509.x64\Keygen\keygen.exe"
                                                                                                                                                        1⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:1144
                                                                                                                                                      • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                                        C:\Windows\system32\AUDIODG.EXE 0x2f8 0x2f4
                                                                                                                                                        1⤵
                                                                                                                                                          PID:3340
                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                          1⤵
                                                                                                                                                            PID:4276
                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                                                                            1⤵
                                                                                                                                                              PID:2428
                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                              1⤵
                                                                                                                                                                PID:5772

                                                                                                                                                              Network

                                                                                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                                                                                    Replay Monitor

                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                    Downloads

                                                                                                                                                                    e5c017f.rbs
                                                                                                                                                                    • Path C:\Config.Msi\e5c017f.rbs
                                                                                                                                                                    • Size 195KB
                                                                                                                                                                    • SHA256 47c8ad07dfd15373795c7730d03407539726ba062d91f39b6e796fea956735b9
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    manifest.json
                                                                                                                                                                    • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4260_1715006838\manifest.json
                                                                                                                                                                    • Size 76B
                                                                                                                                                                    • SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    manifest.fingerprint
                                                                                                                                                                    • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4260_1955158119\manifest.fingerprint
                                                                                                                                                                    • Size 66B
                                                                                                                                                                    • SHA256 e84df839eb3dee2a10ba66de65c372c6e2bba0cbab46a39af041f4eeaab1ffe8
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    manifest.json
                                                                                                                                                                    • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4260_1955158119\manifest.json
                                                                                                                                                                    • Size 135B
                                                                                                                                                                    • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    hyph-as.hyb
                                                                                                                                                                    • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4260_752546112\hyph-as.hyb
                                                                                                                                                                    • Size 703B
                                                                                                                                                                    • SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    hyph-hi.hyb
                                                                                                                                                                    • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4260_752546112\hyph-hi.hyb
                                                                                                                                                                    • Size 687B
                                                                                                                                                                    • SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    hyph-nb.hyb
                                                                                                                                                                    • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4260_752546112\hyph-nb.hyb
                                                                                                                                                                    • Size 141KB
                                                                                                                                                                    • SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    manifest.json
                                                                                                                                                                    • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4260_752546112\manifest.json
                                                                                                                                                                    • Size 82B
                                                                                                                                                                    • SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    manifest.json
                                                                                                                                                                    • Path C:\Program Files\chrome_Unpacker_BeginUnzipping5168_1071972241\manifest.json
                                                                                                                                                                    • Size 165B
                                                                                                                                                                    • SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    verified_contents.json
                                                                                                                                                                    • Path C:\Program Files\chrome_Unpacker_BeginUnzipping5168_109973861\_metadata\verified_contents.json
                                                                                                                                                                    • Size 1KB
                                                                                                                                                                    • SHA256 c50e8b66b9c681cbc2fa16cb2d8fd7cc934df1a7863dcf4f0ebedf6a5b78638d
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    manifest.json
                                                                                                                                                                    • Path C:\Program Files\chrome_Unpacker_BeginUnzipping5168_1190915341\manifest.json
                                                                                                                                                                    • Size 160B
                                                                                                                                                                    • SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    manifest.json
                                                                                                                                                                    • Path C:\Program Files\chrome_Unpacker_BeginUnzipping5168_1221673949\manifest.json
                                                                                                                                                                    • Size 177B
                                                                                                                                                                    • SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    manifest.json
                                                                                                                                                                    • Path C:\Program Files\chrome_Unpacker_BeginUnzipping5168_1859043718\manifest.json
                                                                                                                                                                    • Size 238B
                                                                                                                                                                    • SHA256 1bdda4a8fc3e2b965fbb52c9b23a9a34871bc345abfb332a87ea878f4472efbd
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    LICENSE
                                                                                                                                                                    • Path C:\Program Files\chrome_Unpacker_BeginUnzipping5168_437860512\LICENSE
                                                                                                                                                                    • Size 1KB
                                                                                                                                                                    • SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    manifest.json
                                                                                                                                                                    • Path C:\Program Files\chrome_Unpacker_BeginUnzipping5168_437860512\manifest.json
                                                                                                                                                                    • Size 85B
                                                                                                                                                                    • SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    manifest.json
                                                                                                                                                                    • Path C:\Program Files\chrome_Unpacker_BeginUnzipping5168_657330791\manifest.json
                                                                                                                                                                    • Size 135B
                                                                                                                                                                    • SHA256 cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    manifest.json
                                                                                                                                                                    • Path C:\Program Files\chrome_Unpacker_BeginUnzipping5832_1226449243\manifest.json
                                                                                                                                                                    • Size 113B
                                                                                                                                                                    • SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Staging
                                                                                                                                                                    • Path C:\Program Files\chrome_Unpacker_BeginUnzipping5832_1715631462\Sigma\Staging
                                                                                                                                                                    • Size 36B
                                                                                                                                                                    • SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    manifest.fingerprint
                                                                                                                                                                    • Path C:\Program Files\chrome_Unpacker_BeginUnzipping5832_1715631462\manifest.fingerprint
                                                                                                                                                                    • Size 66B
                                                                                                                                                                    • SHA256 f96cf59ef5cdf10cdebb367e16c6736d188af934062a8721eb9d60539556a2a9
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    manifest.json
                                                                                                                                                                    • Path C:\Program Files\chrome_Unpacker_BeginUnzipping5832_1715631462\manifest.json
                                                                                                                                                                    • Size 132B
                                                                                                                                                                    • SHA256 68683970ce6d7de9a2043c34129106ae68af21a3b0a3c53cb59695640a7c1cbc
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    manifest.json
                                                                                                                                                                    • Path C:\Program Files\chrome_Unpacker_BeginUnzipping5832_1870649774\manifest.json
                                                                                                                                                                    • Size 1002B
                                                                                                                                                                    • SHA256 dca3cd7a673d0776a085c0b8958a85bdd8392923db21a0b55f4d37210f752322
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    manifest.json
                                                                                                                                                                    • Path C:\Program Files\chrome_Unpacker_BeginUnzipping5832_1950984139\manifest.json
                                                                                                                                                                    • Size 102B
                                                                                                                                                                    • SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    manifest.json
                                                                                                                                                                    • Path C:\Program Files\chrome_Unpacker_BeginUnzipping5832_284643340\manifest.json
                                                                                                                                                                    • Size 69B
                                                                                                                                                                    • SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    manifest.json
                                                                                                                                                                    • Path C:\Program Files\chrome_Unpacker_BeginUnzipping5832_911519505\manifest.json
                                                                                                                                                                    • Size 116B
                                                                                                                                                                    • SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    manifest.json
                                                                                                                                                                    • Path C:\Program Files\chrome_Unpacker_BeginUnzipping5832_953080541\manifest.json
                                                                                                                                                                    • Size 79B
                                                                                                                                                                    • SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                                                                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                                                                                                                    • Size 471B
                                                                                                                                                                    • SHA256 b6370e40beec453b472e64045b4033fc9e4caa08a5916d0908da56399875f33c
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    8EC9B1D0ABBD7F98B401D425828828CE_7CE6080A65116FEFFC20BEF93F5DC5A5
                                                                                                                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_7CE6080A65116FEFFC20BEF93F5DC5A5
                                                                                                                                                                    • Size 727B
                                                                                                                                                                    • SHA256 b9847086a2520bc105d0cf1f842af43ee413b97ba29b095664513a203dc3fa22
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                                                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                                                                                                    • Size 727B
                                                                                                                                                                    • SHA256 a979724fe78a75e9ebd04b45951bedf4560a843e90fe02283b2da2d01c3c6f11
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                                                                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                                                                                                                    • Size 400B
                                                                                                                                                                    • SHA256 4d62eda0c0d805713ac892269a04f82daae7d371bb84f14f7bd7707d59603fea
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    8EC9B1D0ABBD7F98B401D425828828CE_7CE6080A65116FEFFC20BEF93F5DC5A5
                                                                                                                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_7CE6080A65116FEFFC20BEF93F5DC5A5
                                                                                                                                                                    • Size 408B
                                                                                                                                                                    • SHA256 a76c4cbf73ec04795aad495a7ad05a7eed32b4e6070bb0d2284ca45609e65a06
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                                                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                                                                                                    • Size 412B
                                                                                                                                                                    • SHA256 346c298fc8a16df3b0e99abab2a378ef593f0d4a72e85f9139fa359136c984b4
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    settings.dat
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                    • Size 280B
                                                                                                                                                                    • SHA256 4958157b216859fd627d1156a14774d747a13ccc6e3f4b10427cd65a4945e3f8
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    settings.dat
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                    • Size 280B
                                                                                                                                                                    • SHA256 31206a8a289dc81adb297404f3fcc5a840506488f1d99e07b24cfe5740937bc0
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    settings.dat
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                    • Size 280B
                                                                                                                                                                    • SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    settings.dat
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                    • Size 280B
                                                                                                                                                                    • SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    settings.dat
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                    • Size 280B
                                                                                                                                                                    • SHA256 a31d8d87abf7db54e5af159959ffb39655ef3b9838cf4cf3862ab9032cffa32f
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    8fdc4b84-0ac5-4e45-950b-6c328c502a3c.tmp
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8fdc4b84-0ac5-4e45-950b-6c328c502a3c.tmp
                                                                                                                                                                    • Size 414B
                                                                                                                                                                    • SHA256 7a423ec8e7a6a11360a3161171c408ed9874a5b547991a3c7dd9c94a8f2c0f02
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    the-real-index
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                    • Size 3KB
                                                                                                                                                                    • SHA256 e4fa34cd7b641fd04f5e8ccac430cd16a9426be29203ff5c9d89a563853a4a30
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    the-real-index
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                    • Size 3KB
                                                                                                                                                                    • SHA256 311c1e8d5edccf0582b4319b984e1f9d25d5962a73a415922886c5a16fefe80a
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    the-real-index~RFe5b5281.TMP
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5b5281.TMP
                                                                                                                                                                    • Size 3KB
                                                                                                                                                                    • SHA256 0bac2975413aa17d9214cf5c64e0817247054ae7e1214020586ff72c7649dd4f
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    62eee277-adc2-4a90-a9bf-6cc1834d6b8d.tmp
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\62eee277-adc2-4a90-a9bf-6cc1834d6b8d.tmp
                                                                                                                                                                    • Size 2B
                                                                                                                                                                    • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Edge Profile.ico
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                                                                    • Size 70KB
                                                                                                                                                                    • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    5930b860-11ae-40d7-8bfa-01de3347fed7.tmp
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5930b860-11ae-40d7-8bfa-01de3347fed7.tmp
                                                                                                                                                                    • Size 40B
                                                                                                                                                                    • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Network Persistent State
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                    • Size 5KB
                                                                                                                                                                    • SHA256 98025e9ddee7b753203dafe41394000821e466de9bcd64b4e101a58454735899
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Network Persistent State
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                    • Size 1024B
                                                                                                                                                                    • SHA256 25d90d226f513428bdbc06336a0ded4a0be02bee76f591ed4b273ceff11df15f
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    SCT Auditing Pending Reports
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                    • Size 2B
                                                                                                                                                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    TransportSecurity
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
                                                                                                                                                                    • Size 689B
                                                                                                                                                                    • SHA256 e40b4f24511631ca536a06ce40ee1432daf14595152be1655c56da782b87c371
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Preferences
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                    • Size 10KB
                                                                                                                                                                    • SHA256 26f0e5694b3047e469c8cba16c2e910a65dfc7031a6e030ce9f9e10f47625b98
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Preferences
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                    • Size 13KB
                                                                                                                                                                    • SHA256 f0f62a242a44e3c9cfed0ef88389a111d36fe014d2f464a0fcbbdbaf765b0f88
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Preferences
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                    • Size 15KB
                                                                                                                                                                    • SHA256 1d65e7f1307dc9db516d8f08187f12fe389024676ab928d448bd7d4e5a19eade
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Preferences
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                    • Size 14KB
                                                                                                                                                                    • SHA256 1b8aeee74923ea09eff600486e24bcda87f7d32278fc5587f6b547dc4a0c789f
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Preferences
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                    • Size 14KB
                                                                                                                                                                    • SHA256 6612c2100ed3d8196a5d8e7e6462d040b6fee9c9c793b3cd91ff25b841cd13ef
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Secure Preferences
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                                    • Size 27KB
                                                                                                                                                                    • SHA256 5be021a9f94f16cb2e8e908c53ced3a866e21ffcb962a1d5450ebc4289a879f7
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    sync_diagnostic.log
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                                                    • Size 4KB
                                                                                                                                                                    • SHA256 86d0fe1bfbcb038b8b93db100b6e8d747c9133d0ce7f1dcc9fbba5ff968559a6
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    dbdcc4b6-d060-46df-999d-0693882bbbd2.tmp
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dbdcc4b6-d060-46df-999d-0693882bbbd2.tmp
                                                                                                                                                                    • Size 6B
                                                                                                                                                                    • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    OperationConfig
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                                                                                                    • Size 22KB
                                                                                                                                                                    • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    OperationConfig~RFe60f810.TMP
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe60f810.TMP
                                                                                                                                                                    • Size 3KB
                                                                                                                                                                    • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    office_endpoints_list.json
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
                                                                                                                                                                    • Size 9KB
                                                                                                                                                                    • SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Local State
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                    • Size 8KB
                                                                                                                                                                    • SHA256 bf6323adc00335fc02e6178ff437fc7ee35d1d42a9eb8082a8331060127e1928
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Local State
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                    • Size 15KB
                                                                                                                                                                    • SHA256 24d839d4ecf3901756b022d0a6929663601609829a3e3b489f96e073fca120d9
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Local State
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                    • Size 12KB
                                                                                                                                                                    • SHA256 60d04d78e6a5a1d9361775fe26faa7abe993ca59e88cc18793f030baedae440c
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Local State
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                    • Size 12KB
                                                                                                                                                                    • SHA256 439596fee203619c4ef69c59d5fb32070e01ff32ddc587f953a3a352c754d419
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Local State
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                    • Size 44KB
                                                                                                                                                                    • SHA256 aa306b7d89df7817f0aaf46a2d1c1a5dc994a95725f6934ac99e1cc84b41b462
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Local State
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                    • Size 18KB
                                                                                                                                                                    • SHA256 09e0ec8db5ee9b23d778b719a4f041012a10a379dd2c92beba3cd1c1a6d1c288
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Local State
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                    • Size 9KB
                                                                                                                                                                    • SHA256 b7083f4a5dce28d7d15b9fd92fc255470e7681d069786acd103ac78e9d469bce
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Local State
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                    • Size 16KB
                                                                                                                                                                    • SHA256 a99fab85fb1fbb5c65239a4fc7ac4e8eee89d02e92f72c3905021064d306dce9
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Local State
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                    • Size 21KB
                                                                                                                                                                    • SHA256 3fbd37c28912fe9a0faa0f931f8b8a6c7995e636c023fb5d14915984e8b977d3
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    manifest.json
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials\0.0.1.7\manifest.json
                                                                                                                                                                    • Size 43B
                                                                                                                                                                    • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    data_1
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
                                                                                                                                                                    • Size 264KB
                                                                                                                                                                    • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                    Submit Download

                                                                                                                                                                    VariationsRuntimeSeedV1
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
                                                                                                                                                                    • Size 484B
                                                                                                                                                                    • SHA256 9fd2b7fae87c2d863b486a425834283f19b1444749c84650d5a48c9eadb12e2b
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    nav_config.json
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
                                                                                                                                                                    • Size 2KB
                                                                                                                                                                    • SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    metadata.json
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                    • Size 372B
                                                                                                                                                                    • SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    metadata.json
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                    • Size 132B
                                                                                                                                                                    • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    metadata.json
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                    • Size 1KB
                                                                                                                                                                    • SHA256 756ef3483952cd4f6f9b80821083dfbdf9bccdec392e28a2854f00ab9fd415ee
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    metadata.json
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                    • Size 492B
                                                                                                                                                                    • SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    metadata.json
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                    • Size 972B
                                                                                                                                                                    • SHA256 6bbc409c6c8e5287723de210e3463bc9873d0adfd3542a753ad8169fa6342edd
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    metadata.json
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                    • Size 252B
                                                                                                                                                                    • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    metadata.json
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                    • Size 852B
                                                                                                                                                                    • SHA256 51fa2add3b372e4d932d6926ca9be223a98d6ad3b63fcf099338f199d0a4ad28
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    metadata.json
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                    • Size 732B
                                                                                                                                                                    • SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    metadata.json
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                    • Size 1KB
                                                                                                                                                                    • SHA256 0f4851d2d08fedaaf8104a0fbdc543c6f5a7c82fd67345db7d671b449362cfbb
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    metadata.json
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                    • Size 612B
                                                                                                                                                                    • SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    44ebd0a3-71ed-462d-a09c-3b5340871203.tmp
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\44ebd0a3-71ed-462d-a09c-3b5340871203.tmp
                                                                                                                                                                    • Size 13B
                                                                                                                                                                    • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    thumbcache_idx.db
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
                                                                                                                                                                    • Size 28KB
                                                                                                                                                                    • SHA256 70db988c536f878a381bca5c6bc0bebd9a8ae4835c3a79cf679dc62d81186c43
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    3a7e9e3c-1f98-422c-a0da-74247bb41627.tmp
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\3a7e9e3c-1f98-422c-a0da-74247bb41627.tmp
                                                                                                                                                                    • Size 153KB
                                                                                                                                                                    • SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    prism.exe
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\GraphPad.Prism.10.3.1.509.x64\GraphPad.Prism.10.3.1.509.x64\Crack\prism.exe
                                                                                                                                                                    • Size 26.2MB
                                                                                                                                                                    • SHA256 3627930b8877f58c15a71d916f3b63539c680615d406e372a59d74843a0a6034
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    ReadMe (How to Install).txt
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\GraphPad.Prism.10.3.1.509.x64\ReadMe (How to Install).txt
                                                                                                                                                                    • Size 1KB
                                                                                                                                                                    • SHA256 a0a1299c4784df29fb9e666d4430cd80c5055e7783db06049bdae46c865bcf6b
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    MSIAD05.tmp
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\MSIAD05.tmp
                                                                                                                                                                    • Size 587KB
                                                                                                                                                                    • SHA256 e140990b509dd6884a5742bde64f2cdaa10012d472b0b32de43ebecbc83242b6
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    MSIB634.tmp
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\MSIB634.tmp
                                                                                                                                                                    • Size 118KB
                                                                                                                                                                    • SHA256 a26e648313b81f80b5bddbe2823e7d477a08826df0c449ebb810162a36a547e4
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    MSIB6E2.tmp
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\MSIB6E2.tmp
                                                                                                                                                                    • Size 709KB
                                                                                                                                                                    • SHA256 1a3c0e60aad0a3bb92a6e0b786df93920aed7b0c7ec56ab49f2692102ac5adec
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    f89916c7-f7ff-4061-83e4-f887718fc6a6.tmp
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\f89916c7-f7ff-4061-83e4-f887718fc6a6.tmp
                                                                                                                                                                    • Size 1B
                                                                                                                                                                    • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    6db15a1f-a3b1-4078-8894-116980117609.tmp
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3744_661254902\6db15a1f-a3b1-4078-8894-116980117609.tmp
                                                                                                                                                                    • Size 10KB
                                                                                                                                                                    • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    content_new.js
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3744_661254902\CRX_INSTALL\content_new.js
                                                                                                                                                                    • Size 10KB
                                                                                                                                                                    • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    protocols.json
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
                                                                                                                                                                    • Size 3KB
                                                                                                                                                                    • SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    crl-set
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
                                                                                                                                                                    • Size 22KB
                                                                                                                                                                    • SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    settings.dat
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Crashpad\settings.dat
                                                                                                                                                                    • Size 280B
                                                                                                                                                                    • SHA256 407eb3d16c6d2e75b8bb6293513aec55662a66aeb18497fbbe5c7d09967ffb2d
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    settings.dat
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Crashpad\settings.dat
                                                                                                                                                                    • Size 280B
                                                                                                                                                                    • SHA256 bf0c5ddc33a108ca1e484bacd31c1692e59b78c5b84eb1fdf5d8532c8009d697
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    settings.dat
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Crashpad\settings.dat
                                                                                                                                                                    • Size 280B
                                                                                                                                                                    • SHA256 b3fba5944d02678676f84d75e1ad7f89b67735398b499f0d1631624dbd2f34af
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    f_000002
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Default\Cache\Cache_Data\f_000002
                                                                                                                                                                    • Size 112KB
                                                                                                                                                                    • SHA256 4de61ab2c7f52f5bb6005ff1bb040e4b6057c846a89fef4948f1c15bd8da6c3b
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    the-real-index
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                    • Size 144B
                                                                                                                                                                    • SHA256 215f15d788e6b5310a5632f1d2644aeb28b5360e455395b94274f12b0286bc41
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    the-real-index
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                    • Size 144B
                                                                                                                                                                    • SHA256 3bf66f2639987dbc42a1dea8814484241abfed6a390c85b1974f13b505ffaf92
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    the-real-index~RFe5d08fb.TMP
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5d08fb.TMP
                                                                                                                                                                    • Size 48B
                                                                                                                                                                    • SHA256 863782dac1197a62f3d75218da50c747e7482b1e156da73ef74967028192e520
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    data_0
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Default\DawnGraphiteCache\data_0
                                                                                                                                                                    • Size 8KB
                                                                                                                                                                    • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                    Submit Download

                                                                                                                                                                    data_2
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Default\DawnGraphiteCache\data_2
                                                                                                                                                                    • Size 8KB
                                                                                                                                                                    • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                    Submit Download

                                                                                                                                                                    data_3
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Default\DawnGraphiteCache\data_3
                                                                                                                                                                    • Size 8KB
                                                                                                                                                                    • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                    Submit Download

                                                                                                                                                                    index
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Default\DawnGraphiteCache\index
                                                                                                                                                                    • Size 256KB
                                                                                                                                                                    • SHA256 f05c909b438f1f05526a6a91b88dcf7d642dac885a354d2d2ce482e05fc6c628
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                    Submit Download

                                                                                                                                                                    index
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Default\GPUCache\index
                                                                                                                                                                    • Size 256KB
                                                                                                                                                                    • SHA256 65f330bcc4380b25a490ce721ce2b32da136b70e569695f12b8252eb9e951a04
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Network Persistent State
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Default\Network\Network Persistent State
                                                                                                                                                                    • Size 59B
                                                                                                                                                                    • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Network Persistent State
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Default\Network\Network Persistent State
                                                                                                                                                                    • Size 836B
                                                                                                                                                                    • SHA256 62f6b9828a2216bcdf0744c6f6fcc96cab8d3c0086e1c0a4aa79b44106adba0a
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Network Persistent State
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Default\Network\Network Persistent State
                                                                                                                                                                    • Size 489B
                                                                                                                                                                    • SHA256 43a6e0230833825d03a5279f1156f84c136884f154f76594957d53a9b4a6063e
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Network Persistent State
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Default\Network\Network Persistent State
                                                                                                                                                                    • Size 111B
                                                                                                                                                                    • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Network Persistent State~RFe5cc422.TMP
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Default\Network\Network Persistent State~RFe5cc422.TMP
                                                                                                                                                                    • Size 84B
                                                                                                                                                                    • SHA256 712196693e3527ac1131831f1a2108b6c0e5c68967b26d51a452611cdfb86e0c
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    TransportSecurity
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                    • Size 522B
                                                                                                                                                                    • SHA256 49f47902138bfb20fe5a345ae2dad279e7d7ab1ca55a40be77f9765110a6a896
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    TransportSecurity
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                    • Size 522B
                                                                                                                                                                    • SHA256 489295a3fb36b1368f2f48fdea6957dca9da55aa5d35d64c6f3590994a0044f7
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    TransportSecurity
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                    • Size 522B
                                                                                                                                                                    • SHA256 0272abc0483f7602724f1270221bee417f1786451601b79fc2dc67d08e718c5f
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    TransportSecurity
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                    • Size 522B
                                                                                                                                                                    • SHA256 d5be153af7942669252780e6401f24a9e118f94da5367e14bb4ca4c20c84e40a
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    TransportSecurity
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                    • Size 522B
                                                                                                                                                                    • SHA256 3332e29d968aed482e1bca513765b3beb8f9897eec4b5a1550fe04cfb6559738
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    TransportSecurity
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                    • Size 22B
                                                                                                                                                                    • SHA256 6b40f4ae548688a472be3ca0c1b08ecf520b31e706fec0f9793b4666134eba06
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    TransportSecurity
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                    • Size 522B
                                                                                                                                                                    • SHA256 5e31e81efa3f990fefb685237cbc521ed60e97a6bd5c8ec128c42e0509b64bc9
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    TransportSecurity
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                    • Size 522B
                                                                                                                                                                    • SHA256 2245aed896524dce538c288449da8ba507a1a4993469ed65fa4d9b0960f4941f
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    TransportSecurity
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                    • Size 522B
                                                                                                                                                                    • SHA256 76168ef24ee3cda13c189694fec0a866a16e46bc328d6ee433502d98c842ad69
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    TransportSecurity
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                    • Size 522B
                                                                                                                                                                    • SHA256 c150a3590835c3089063f861e581d50a9003b85bd538c7db6784cf101ce8b1a1
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    TransportSecurity
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                    • Size 522B
                                                                                                                                                                    • SHA256 4c4382b124935b49e59f28741bd7a095d47ae76ba097807447e5c34f07cdeebe
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    TransportSecurity
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                    • Size 522B
                                                                                                                                                                    • SHA256 43392eea4d5f126cf8f70b29111a5270df5637bf92365581860f3ad2a08f1e55
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    TransportSecurity
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                    • Size 522B
                                                                                                                                                                    • SHA256 2c514b41f66eaefc48c97d0e9341c86d4c1a98b8255247ee1ba5d4dd72ec5b36
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    TransportSecurity~RFe5ce6ae.TMP
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Default\Network\TransportSecurity~RFe5ce6ae.TMP
                                                                                                                                                                    • Size 522B
                                                                                                                                                                    • SHA256 46fad0b83720ff91ee5c1de1519460d2792c4a99aaaeea2102c5aadd279ee84e
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Preferences
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Default\Preferences
                                                                                                                                                                    • Size 6KB
                                                                                                                                                                    • SHA256 9ce5ea8e2594090a259b65ecbb62a24f9bf2c031ea5161576d991b78fef7a8b3
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Preferences
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Default\Preferences
                                                                                                                                                                    • Size 7KB
                                                                                                                                                                    • SHA256 689f464e34a99836773450581147a1e2ad409ef623099bab3472c66e06ba49ab
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Preferences
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Default\Preferences
                                                                                                                                                                    • Size 7KB
                                                                                                                                                                    • SHA256 ffcf0ee34f484d0e318c37ceff3cef8a76b79798dc68c2eef22088c139bf76be
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Preferences
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Default\Preferences
                                                                                                                                                                    • Size 7KB
                                                                                                                                                                    • SHA256 b0adefb071a29653f80bc0a3ef47cf81b05cce704dc573a78b04bb3b30cd3f3d
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Preferences
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Default\Preferences
                                                                                                                                                                    • Size 6KB
                                                                                                                                                                    • SHA256 92741e381ae6cc157f196b8b2c11e0dce53851db0208ba8534c568e5631cd8f9
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Preferences~RFe5cd73d.TMP
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Default\Preferences~RFe5cd73d.TMP
                                                                                                                                                                    • Size 6KB
                                                                                                                                                                    • SHA256 3132456dac297516edb0deef94d37fdec04716ca0f9263483ff99bcd60bf2c01
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    CURRENT
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Default\shared_proto_db\metadata\CURRENT
                                                                                                                                                                    • Size 16B
                                                                                                                                                                    • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    MANIFEST-000001
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
                                                                                                                                                                    • Size 41B
                                                                                                                                                                    • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Local State
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Local State
                                                                                                                                                                    • Size 1KB
                                                                                                                                                                    • SHA256 b66c9273d91ab3b230aa0d37a1fb369ca1b242992d3cfe49770cfa4b25bff5c6
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Local State
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Local State
                                                                                                                                                                    • Size 2KB
                                                                                                                                                                    • SHA256 ef1253253fb39ba27c0bc7c3ea62e9123a2af9d82f8d76ca06e872b9598d3ab9
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Local State
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Local State
                                                                                                                                                                    • Size 3KB
                                                                                                                                                                    • SHA256 6532cdc17caa81548fb06c997aa4110b9a883cacdad1cb4aab1f571fe578939e
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Local State
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Local State
                                                                                                                                                                    • Size 17KB
                                                                                                                                                                    • SHA256 e62b5e6cdb697e7f6b0eb9eb65ba5a3ed1de8b5481760632dfe8ae0256bb689b
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Local State
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Local State
                                                                                                                                                                    • Size 16KB
                                                                                                                                                                    • SHA256 1afe6fea0ef1cec5642b9cbeb9dbc3c7d486ef4bbed4171b169f122025519c43
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Local State
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Local State
                                                                                                                                                                    • Size 19KB
                                                                                                                                                                    • SHA256 d4f8383becb992871eeb74b1dbd5c341d2411d0464a6189e7472f7b518a73676
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Local State
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Local State
                                                                                                                                                                    • Size 17KB
                                                                                                                                                                    • SHA256 d47cb982dc3d4e9bf2108791e4e85310e7e28af5e424da002f67926b17e8aaa1
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Local State
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Local State
                                                                                                                                                                    • Size 4KB
                                                                                                                                                                    • SHA256 d7723145332efed379fb96ae431a8b6a2ea5255a63d9b8361984b9e0128e2c50
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Local State
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Local State
                                                                                                                                                                    • Size 18KB
                                                                                                                                                                    • SHA256 1b7cc6673a9e6eca749aeb3fff95d70821f8e531699240e3229f2e1ed13729ea
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Local State~RFe5c8525.TMP
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Local State~RFe5c8525.TMP
                                                                                                                                                                    • Size 1KB
                                                                                                                                                                    • SHA256 bb61d06c026e65b3940b189adb54bb8151756471dafe766f575762ce685966f0
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    crs.pb
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\PKIMetadata\46.0.0.0\crs.pb
                                                                                                                                                                    • Size 233KB
                                                                                                                                                                    • SHA256 c132e2ba94619caf6143b3bbdd9c32944e80cbf3bff87364175c42801afe2584
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    ct_config.pb
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\PKIMetadata\46.0.0.0\ct_config.pb
                                                                                                                                                                    • Size 16KB
                                                                                                                                                                    • SHA256 aaeeb46cd91a4a392223cf2885f449bf532f0878c087d50bb0cb3fc7fa873a60
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    kp_pinslist.pb
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\PKIMetadata\46.0.0.0\kp_pinslist.pb
                                                                                                                                                                    • Size 10KB
                                                                                                                                                                    • SHA256 b5b2a45a5b25becb901916b13752e3477d4126a42d088f29863bd8672320ecf6
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Filtering Rules
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
                                                                                                                                                                    • Size 2.1MB
                                                                                                                                                                    • SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    LICENSE
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.84\LICENSE
                                                                                                                                                                    • Size 24KB
                                                                                                                                                                    • SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Advertising
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Advertising
                                                                                                                                                                    • Size 19KB
                                                                                                                                                                    • SHA256 5989ccf9a58e4ffd47c2422bd8dfcb3ea4e1d412fbdec2291385a9955af9eace
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Analytics
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Analytics
                                                                                                                                                                    • Size 4KB
                                                                                                                                                                    • SHA256 163a5318312b814104d244a4b37b676a02f827068820aa60fc069e6346cb2b75
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    CompatExceptions
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Trust Protection Lists\1.0.0.34\Mu\CompatExceptions
                                                                                                                                                                    • Size 689B
                                                                                                                                                                    • SHA256 5b462316a51c918d0bae95959bf827cb9c72bbd84ffb0e43b750aa91fbf3ba53
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Content
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Content
                                                                                                                                                                    • Size 4KB
                                                                                                                                                                    • SHA256 7869993fcb93b302598643be96c6ab94c4f3be47c9fc344959773c754291376e
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Cryptomining
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Cryptomining
                                                                                                                                                                    • Size 668B
                                                                                                                                                                    • SHA256 1e92781e88ee786bf6d1d5cb71d467a92fe7f281f2d1e548524bf119d7ddc700
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Entities
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Entities
                                                                                                                                                                    • Size 68KB
                                                                                                                                                                    • SHA256 f6e93c83d9e3cfdff064535647cee76fc85aa1c86fd22a93dcf3d2c377346d94
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Fingerprinting
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Fingerprinting
                                                                                                                                                                    • Size 1KB
                                                                                                                                                                    • SHA256 c7d2b05ff6e790af78b0f1f341219fdb554dc5e14fbf3e3981819fccdd1ddfed
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    LICENSE
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Trust Protection Lists\1.0.0.34\Mu\LICENSE
                                                                                                                                                                    • Size 34KB
                                                                                                                                                                    • SHA256 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Other
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Other
                                                                                                                                                                    • Size 34B
                                                                                                                                                                    • SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Social
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Social
                                                                                                                                                                    • Size 754B
                                                                                                                                                                    • SHA256 4955c3e7f56641a4ae0ce9c79b4ceee4b21733b0f6dedc980bf8d822a792eba2
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    TransparentAdvertisers
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Trust Protection Lists\1.0.0.34\Mu\TransparentAdvertisers
                                                                                                                                                                    • Size 105B
                                                                                                                                                                    • SHA256 d2cd0bef5f45daf490c53e705d6f67dfe12390c72a00efa6f5117432bd8edb8c
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Advertising
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Advertising
                                                                                                                                                                    • Size 20KB
                                                                                                                                                                    • SHA256 868f3ed3f86f1e82a5041f0a7b382bdd720e411531df2dc680da34eb60580b75
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Analytics
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Analytics
                                                                                                                                                                    • Size 3KB
                                                                                                                                                                    • SHA256 33d2b069ea874c12ec96242ca7eb539c1086d38ac6c2e4858c0efcd74fc632e5
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Content
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Content
                                                                                                                                                                    • Size 5KB
                                                                                                                                                                    • SHA256 d99df5936c57a50aebb7f0a3ca65fcc682f523ace93641fbcfb9b09cfb71c739
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Cryptomining
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Cryptomining
                                                                                                                                                                    • Size 32B
                                                                                                                                                                    • SHA256 696e930706b5d391eb8778f73b0627ffc2be7f6c9a3e7659170d9d37fc4a97b5
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Entities
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Entities
                                                                                                                                                                    • Size 106KB
                                                                                                                                                                    • SHA256 0f305323c627cf0c790831c7e0bc38455b7a99983c4ab5bd9d2d9567766c3499
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Fingerprinting
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Fingerprinting
                                                                                                                                                                    • Size 2KB
                                                                                                                                                                    • SHA256 ec0fcbf71d58e707aaf6ba8d3c0719972f26727febe03f8efbf570b9635faddf
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    LICENSE
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\LICENSE
                                                                                                                                                                    • Size 66B
                                                                                                                                                                    • SHA256 44071e0fcffb9a9a32e8fa7010bb18dbc41afd0b176f81bf700b15b638a88a51
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Other
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Other
                                                                                                                                                                    • Size 198B
                                                                                                                                                                    • SHA256 c9ab8dbc87043c71dd649fc06bb006e7f62e81c973c37b125afb88e654e436f8
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Social
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Social
                                                                                                                                                                    • Size 3KB
                                                                                                                                                                    • SHA256 e520603e6fb543cd078b2a7dbd8ccfc175e9aecf71654fc19785927a014d3435
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    keys.json
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\GraphPad Software\Prism\EBWebView\TrustTokenKeyCommitments\2026.3.23.1\keys.json
                                                                                                                                                                    • Size 8KB
                                                                                                                                                                    • SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    default.dic
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                                                                                                                                                    • Size 2B
                                                                                                                                                                    • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    MSI1E07.tmp
                                                                                                                                                                    • Path C:\Windows\Installer\MSI1E07.tmp
                                                                                                                                                                    • Size 734KB
                                                                                                                                                                    • SHA256 f56891ac174d36207456047814c7e2b6e27700ac518c94b0e361ab523ee585a6
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    MSI3C30.tmp
                                                                                                                                                                    • Path C:\Windows\Installer\MSI3C30.tmp
                                                                                                                                                                    • Size 429KB
                                                                                                                                                                    • SHA256 8e6f14106b09d81ad0b6b477b3ef49011d39da9c96f27df1aef1e0cc109574ab
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    memory/428-755-0x000001FB4DA60000-0x000001FB4DA96000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/428-751-0x00007FF68D9A0000-0x00007FF692766000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/428-754-0x00007FFB89B70000-0x00007FFB89D57000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/428-756-0x000001FB6A3C0000-0x000001FB6A5B7000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/428-752-0x00007FF68D9A0000-0x00007FF692766000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/428-753-0x000001FB67D80000-0x000001FB67F67000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/1144-1216-0x00000000077E0000-0x00000000077F5000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/1144-1222-0x0000000010000000-0x000000001003E000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/1144-1225-0x0000000010000000-0x000000001003E000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/1144-1219-0x0000000010000000-0x000000001003E000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/1144-1204-0x000000007FDE0000-0x000000007FDF0000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/1144-1203-0x0000000000400000-0x0000000000478000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/1144-1224-0x0000000010000000-0x000000001003E000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/1144-1231-0x0000000000400000-0x0000000000478000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2140-2849-0x000001F094CD0000-0x000001F094DFA000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2748-784-0x00007FFBA5F90000-0x00007FFBA5F91000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2748-785-0x00007FFBA7890000-0x00007FFBA7891000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2776-3497-0x0000020AABAE0000-0x0000020AABAE1000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2776-3491-0x0000020AABAE0000-0x0000020AABAE1000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2776-3492-0x0000020AABAE0000-0x0000020AABAE1000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2776-3499-0x0000020AABAE0000-0x0000020AABAE1000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2776-3498-0x0000020AABAE0000-0x0000020AABAE1000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2776-3496-0x0000020AABAE0000-0x0000020AABAE1000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2776-3495-0x0000020AABAE0000-0x0000020AABAE1000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2776-3494-0x0000020AABAE0000-0x0000020AABAE1000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2776-3490-0x0000020AABAE0000-0x0000020AABAE1000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/3480-809-0x00007FFBA6700000-0x00007FFBA6701000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4028-780-0x00007FFBA6700000-0x00007FFBA6701000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4028-1061-0x0000016ECFB10000-0x0000016ECFC3A000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4240-1310-0x00000197BC290000-0x00000197BC291000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4240-1309-0x00000197BC290000-0x00000197BC291000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4240-1308-0x00000197BC290000-0x00000197BC291000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4240-1320-0x00000197BC290000-0x00000197BC291000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4240-1319-0x00000197BC290000-0x00000197BC291000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4240-1318-0x00000197BC290000-0x00000197BC291000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4240-1317-0x00000197BC290000-0x00000197BC291000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4240-1316-0x00000197BC290000-0x00000197BC291000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4240-1315-0x00000197BC290000-0x00000197BC291000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4240-1314-0x00000197BC290000-0x00000197BC291000-memory.dmp
                                                                                                                                                                    Download