72fd906603d88838c343ead5d3bcf0e143eeb08a628659e263fbf647f43e30de

Analysis

user interaction
yes
max time kernel
435s
max time network
431s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 06:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ghost/bin/temp/resource_53.bin
Size 578KB
Sample260809-hlwxessflc
SHA256 72fd906603d88838c343ead5d3bcf0e143eeb08a628659e263fbf647f43e30de
MD5 4e87d50d712d2c036959de7083faf006
SHA1 b64fb9d990b9d782663a66c0fa4c53754efc62ed
SHA512 99111e296a412f944d46bf70b14528dd78c73da4720233b0e28c79a058a9a476bdaa5463a16c8f90b3bc53131ca47b3c107d85aa410244cac7d94eccb9b6b6db
SSDEEP 12288:oj40Fvs1bERqIB5SoWxzpflHRhiHCTa2TlVfKGl/Vj63SeXIe:T0Fvs1bERqIB8zxluCThxVf7d63Sex
TLSH
T10DC433A4A4D92FD509C52972C736342B7DC9F617E25D222323AB7F34D92A270B2FB405
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 15 IoCs

pid	Process
2616	AutoIt3.exe
5084	AutoIt3.exe
5748	AutoIt3.exe
6060	AutoIt3.exe
632	AutoIt3.exe
5380	AutoIt3.exe
3048	AutoIt3.exe
4512	AutoIt3.exe
744	AutoIt3.exe
4616	AutoIt3.exe
740	AutoIt3.exe
4172	AutoIt3.exe
4720	AutoIt3.exe
4884	AutoIt3.exe
3412	AutoIt3.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
208	href.li
206	href.li
207	href.li

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 2616 set thread context of 5084	2616	AutoIt3.exe	208
PID 5748 set thread context of 632	5748	AutoIt3.exe	220
PID 6060 set thread context of 5380	6060	AutoIt3.exe	222
PID 3048 set thread context of 744	3048	AutoIt3.exe	232
PID 4512 set thread context of 4616	4512	AutoIt3.exe	233
PID 740 set thread context of 4172	740	AutoIt3.exe	239
PID 4720 set thread context of 3412	4720	AutoIt3.exe	257
PID 4884 set thread context of 2656	4884	AutoIt3.exe	258

Drops file in Program Files directory 29 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping348_1473209162\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping348_774025780\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping348_1473209162\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping348_1963955385\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping348_1713031219\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping348_1168226504\extraction.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping348_1168226504\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping348_1168226504\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping348_1436401917\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping348_1713031219\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping348_1436401917\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping348_1436401917\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping348_1963955385\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping348_1963955385\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping348_1436401917\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping348_1808084118\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping348_1713031219\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping348_688087210\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping348_1713031219\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping348_774025780\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping348_528594876\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping348_1963955385\smart_switch_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping348_1168226504\automation.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping348_1168226504\classification.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping348_774025780\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping348_528594876\crl-set	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping348_1168226504\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping348_774025780\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping348_688087210\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
816	cmd.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5412	chrome.exe
864	msedge.exe
2604	chrome.exe
5484	chrome.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307319262378717"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Applications\msedge.exe\shell\open\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\.bin\ = "bin_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\bin_auto_file\shell\open\command	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{2B1361B4-CB12-4B1A-B341-DA0731E656DC}	AutoIt3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\bin_auto_file\shell\open	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\bin_auto_file\shell\open\command\ = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" \"%1\""	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{137EF066-A5C1-437B-915B-444B16666452}	AutoIt3.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe11000000020268dd3ae3dc01bb763ec841e3dc01bb763ec841e3dc0114000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Applications\msedge.exe\shell\open	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{0D391EE9-4EC1-4415-B9F9-ACBE0D41D191}	AutoIt3.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Applications\msedge.exe	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 8c00310000000000ae5cdc0c110050524f4752417e310000740009000400efbe874fdb49ae5cdc0c2e0000003f0000000000010000000000000000004a000000000051fa6c00500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000100000000000000ffffffff	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\.bin	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\bin_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2800	chrome.exe
2800	chrome.exe
6128	chrome.exe
6128	chrome.exe
6072	chrome.exe
6072	chrome.exe
6072	chrome.exe
6072	chrome.exe
5580	msedge.exe
5580	msedge.exe
4564	chrome.exe
4564	chrome.exe
2616	AutoIt3.exe
2616	AutoIt3.exe
2616	AutoIt3.exe
2616	AutoIt3.exe
2616	AutoIt3.exe
2616	AutoIt3.exe
2616	AutoIt3.exe
2616	AutoIt3.exe
5084	AutoIt3.exe
5084	AutoIt3.exe
5748	AutoIt3.exe
5748	AutoIt3.exe
5748	AutoIt3.exe
5748	AutoIt3.exe
6060	AutoIt3.exe
6060	AutoIt3.exe
6060	AutoIt3.exe
6060	AutoIt3.exe
5748	AutoIt3.exe
5748	AutoIt3.exe
5748	AutoIt3.exe
5748	AutoIt3.exe
6060	AutoIt3.exe
6060	AutoIt3.exe
6060	AutoIt3.exe
6060	AutoIt3.exe
632	AutoIt3.exe
632	AutoIt3.exe
5380	AutoIt3.exe
5380	AutoIt3.exe
3048	AutoIt3.exe
3048	AutoIt3.exe
3048	AutoIt3.exe
3048	AutoIt3.exe
4512	AutoIt3.exe
4512	AutoIt3.exe
4512	AutoIt3.exe
4512	AutoIt3.exe
3048	AutoIt3.exe
3048	AutoIt3.exe
3048	AutoIt3.exe
3048	AutoIt3.exe
4512	AutoIt3.exe
4512	AutoIt3.exe
4512	AutoIt3.exe
4512	AutoIt3.exe
744	AutoIt3.exe
744	AutoIt3.exe
4616	AutoIt3.exe
4616	AutoIt3.exe
740	AutoIt3.exe
740	AutoIt3.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3280	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 43 IoCs

pid	Process
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6072	chrome.exe
6072	chrome.exe
6072	chrome.exe
6072	chrome.exe
6072	chrome.exe
348	msedge.exe
6072	chrome.exe
6072	chrome.exe
6072	chrome.exe
6072	chrome.exe
6072	chrome.exe
6072	chrome.exe
6072	chrome.exe
6072	chrome.exe
6072	chrome.exe
6072	chrome.exe
6072	chrome.exe
6072	chrome.exe
6072	chrome.exe
6072	chrome.exe
6072	chrome.exe
6072	chrome.exe
6072	chrome.exe
6072	chrome.exe
6072	chrome.exe
6072	chrome.exe
6072	chrome.exe
6072	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	6128	chrome.exe
Token: SeCreatePagefilePrivilege	6128	chrome.exe
Token: SeShutdownPrivilege	6128	chrome.exe
Token: SeCreatePagefilePrivilege	6128	chrome.exe
Token: SeShutdownPrivilege	6072	chrome.exe
Token: SeCreatePagefilePrivilege	6072	chrome.exe
Token: SeShutdownPrivilege	6072	chrome.exe
Token: SeCreatePagefilePrivilege	6072	chrome.exe
Token: SeShutdownPrivilege	6072	chrome.exe
Token: SeCreatePagefilePrivilege	6072	chrome.exe
Token: SeShutdownPrivilege	6072	chrome.exe
Token: SeCreatePagefilePrivilege	6072	chrome.exe
Token: SeShutdownPrivilege	6072	chrome.exe
Token: SeCreatePagefilePrivilege	6072	chrome.exe
Token: SeShutdownPrivilege	6072	chrome.exe
Token: SeCreatePagefilePrivilege	6072	chrome.exe
Token: SeShutdownPrivilege	6072	chrome.exe
Token: SeCreatePagefilePrivilege	6072	chrome.exe
Token: SeShutdownPrivilege	6072	chrome.exe
Token: SeCreatePagefilePrivilege	6072	chrome.exe
Token: SeShutdownPrivilege	6072	chrome.exe
Token: SeCreatePagefilePrivilege	6072	chrome.exe
Token: SeShutdownPrivilege	6072	chrome.exe
Token: SeCreatePagefilePrivilege	6072	chrome.exe
Token: SeShutdownPrivilege	6072	chrome.exe
Token: SeCreatePagefilePrivilege	6072	chrome.exe
Token: SeShutdownPrivilege	6072	chrome.exe
Token: SeCreatePagefilePrivilege	6072	chrome.exe
Token: SeShutdownPrivilege	6072	chrome.exe
Token: SeCreatePagefilePrivilege	6072	chrome.exe
Token: SeShutdownPrivilege	6072	chrome.exe
Token: SeCreatePagefilePrivilege	6072	chrome.exe
Token: SeShutdownPrivilege	6072	chrome.exe
Token: SeCreatePagefilePrivilege	6072	chrome.exe
Token: SeShutdownPrivilege	6072	chrome.exe
Token: SeCreatePagefilePrivilege	6072	chrome.exe
Token: SeShutdownPrivilege	6072	chrome.exe
Token: SeCreatePagefilePrivilege	6072	chrome.exe
Token: SeShutdownPrivilege	6072	chrome.exe
Token: SeCreatePagefilePrivilege	6072	chrome.exe
Token: SeShutdownPrivilege	6072	chrome.exe
Token: SeCreatePagefilePrivilege	6072	chrome.exe
Token: SeShutdownPrivilege	6072	chrome.exe
Token: SeCreatePagefilePrivilege	6072	chrome.exe
Token: SeShutdownPrivilege	6072	chrome.exe
Token: SeCreatePagefilePrivilege	6072	chrome.exe
Token: SeShutdownPrivilege	6072	chrome.exe
Token: SeCreatePagefilePrivilege	6072	chrome.exe
Token: SeShutdownPrivilege	6072	chrome.exe
Token: SeCreatePagefilePrivilege	6072	chrome.exe
Token: SeShutdownPrivilege	6072	chrome.exe
Token: SeCreatePagefilePrivilege	6072	chrome.exe
Token: SeShutdownPrivilege	6072	chrome.exe
Token: SeCreatePagefilePrivilege	6072	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe

Suspicious use of SetWindowsHookEx 58 IoCs

pid	Process
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3280 wrote to memory of 3040	3280	OpenWith.exe	90
PID 3040 wrote to memory of 348	3040	msedge.exe	92
PID 348 wrote to memory of 2352	348	msedge.exe	93
PID 348 wrote to memory of 864	348	msedge.exe	94
PID 348 wrote to memory of 2596	348	msedge.exe	95
PID 348 wrote to memory of 2596	348	msedge.exe	95
PID 348 wrote to memory of 2596	348	msedge.exe	95
PID 348 wrote to memory of 2536	348	msedge.exe	97
PID 348 wrote to memory of 2536	348	msedge.exe	97
PID 348 wrote to memory of 3976	348	msedge.exe	98
PID 348 wrote to memory of 3976	348	msedge.exe	98
PID 348 wrote to memory of 3976	348	msedge.exe	98
PID 348 wrote to memory of 2376	348	msedge.exe	100
PID 348 wrote to memory of 2376	348	msedge.exe	100
PID 348 wrote to memory of 2376	348	msedge.exe	100
PID 348 wrote to memory of 2272	348	msedge.exe	101
PID 348 wrote to memory of 2272	348	msedge.exe	101
PID 348 wrote to memory of 2272	348	msedge.exe	101
PID 348 wrote to memory of 444	348	msedge.exe	102
PID 348 wrote to memory of 444	348	msedge.exe	102
PID 348 wrote to memory of 444	348	msedge.exe	102
PID 348 wrote to memory of 4160	348	msedge.exe	103
PID 348 wrote to memory of 3208	348	msedge.exe	104
PID 348 wrote to memory of 4160	348	msedge.exe	103
PID 348 wrote to memory of 3208	348	msedge.exe	104
PID 348 wrote to memory of 3272	348	msedge.exe	105
PID 348 wrote to memory of 3272	348	msedge.exe	105
PID 348 wrote to memory of 756	348	msedge.exe	106
PID 348 wrote to memory of 756	348	msedge.exe	106
PID 348 wrote to memory of 756	348	msedge.exe	106
PID 348 wrote to memory of 1344	348	msedge.exe	107
PID 348 wrote to memory of 1344	348	msedge.exe	107
PID 348 wrote to memory of 2208	348	msedge.exe	108
PID 348 wrote to memory of 3320	348	msedge.exe	109
PID 348 wrote to memory of 3320	348	msedge.exe	109
PID 348 wrote to memory of 4712	348	msedge.exe	114
PID 348 wrote to memory of 2364	348	msedge.exe	115
PID 348 wrote to memory of 812	348	msedge.exe	116
PID 348 wrote to memory of 812	348	msedge.exe	116
PID 348 wrote to memory of 812	348	msedge.exe	116
PID 348 wrote to memory of 4932	348	msedge.exe	117
PID 348 wrote to memory of 4932	348	msedge.exe	117
PID 348 wrote to memory of 4932	348	msedge.exe	117
PID 348 wrote to memory of 4256	348	msedge.exe	118
PID 348 wrote to memory of 4404	348	msedge.exe	119
PID 348 wrote to memory of 4404	348	msedge.exe	119
PID 348 wrote to memory of 4404	348	msedge.exe	119
PID 2800 wrote to memory of 2940	2800	chrome.exe	121
PID 2800 wrote to memory of 2036	2800	chrome.exe	122
PID 2800 wrote to memory of 2036	2800	chrome.exe	122
PID 2800 wrote to memory of 2604	2800	chrome.exe	123
PID 2800 wrote to memory of 4628	2800	chrome.exe	124
PID 2800 wrote to memory of 4628	2800	chrome.exe	124
PID 2800 wrote to memory of 1792	2800	chrome.exe	126
PID 2800 wrote to memory of 3740	2800	chrome.exe	127
PID 2800 wrote to memory of 1792	2800	chrome.exe	126
PID 2800 wrote to memory of 3740	2800	chrome.exe	127
PID 2800 wrote to memory of 2472	2800	chrome.exe	128
PID 2800 wrote to memory of 2472	2800	chrome.exe	128
PID 2800 wrote to memory of 1968	2800	chrome.exe	129
PID 2800 wrote to memory of 1968	2800	chrome.exe	129
PID 2800 wrote to memory of 5448	2800	chrome.exe	133
PID 348 wrote to memory of 6112	348	msedge.exe	136
PID 348 wrote to memory of 6112	348	msedge.exe	136

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Ghost\bin\temp\resource_53.bin
1⤵
- Executes a command shell one-liner
PID:816

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "C:\Users\Admin\AppData\Local\Temp\Ghost\bin\temp\resource_53.bin"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch "C:\Users\Admin\AppData\Local\Temp\Ghost\bin\temp\resource_53.bin"
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ff91040c188,0x7ff91040c194,0x7ff91040c1a0
      4⤵
      PID:2352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,8145686108533454221,16947860828122012330,524288 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:3
      4⤵
      System Time Discovery
      PID:864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,3534973359176780417,5525776872585370550,262144 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
      4⤵
      PID:2596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,1927280636905299984,4641696510203416755,524288 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:8
      4⤵
      PID:2536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,17577028643526358311,11024597127539958022,2097152 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
      4⤵
      PID:3976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,3135134053768878311,13695964454380453482,2097152 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
      4⤵
      PID:2376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4088,i,17905684244918440434,18162113751666431473,2097152 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:1
      4⤵
      PID:2272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4104,i,14144830008172799438,7137533313126126502,2097152 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:2
      4⤵
      PID:444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,9065141504756633927,12844611870020412562,524288 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:8
      4⤵
      PID:4160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,6470446683098167866,182621148200535638,524288 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:8
      4⤵
      PID:3208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,11824283496508695499,5492244838390571821,524288 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:8
      4⤵
      PID:3272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5572,i,5661385019241972996,6929128882431718006,2097152 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
      4⤵
      PID:756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,1397284222235927572,5506417348789366117,524288 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
      4⤵
      PID:1344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,1192260006281561552,7908535612933127114,524288 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
      4⤵
      PID:2208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,15513633485380654459,13356902233911030009,524288 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
      4⤵
      PID:3320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,12688245219652809469,4302874672411986338,524288 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:8
      4⤵
      PID:3644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,12688245219652809469,4302874672411986338,524288 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:8
      4⤵
      PID:4712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "C:\Users\Admin\Downloads\resource_53.bin"
      4⤵
      PID:2364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7092,i,7901367552791063209,14565071257839986659,2097152 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:1
      4⤵
      PID:812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7196,i,10128984645816636790,13496177618143597683,2097152 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
      4⤵
      PID:4932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7300,i,6156175883598419719,6930882489131431471,524288 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:8
      4⤵
      PID:4256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7032,i,11699115330205423003,3112622967605977076,2097152 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:1
      4⤵
      PID:4404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,6197440197310084877,13792599271761969459,524288 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:8
      4⤵
      PID:6112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,17299039407740305509,2173920303470785995,524288 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=7276 /prefetch:8
      4⤵
      PID:5148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6872,i,16335434541998535655,11601168674060921352,524288 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=7244 /prefetch:8
      4⤵
      PID:5592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,2527852309659385244,17869364615589849636,524288 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:8
      4⤵
      PID:3896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7248,i,6946078375323678275,15963558555755777648,524288 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:8
      4⤵
      PID:5924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3852,i,8265972177525581318,8049862147222234977,524288 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:8
      4⤵
      PID:5876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7200,i,17088610416862907663,12349431411370522844,524288 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:8
      4⤵
      PID:4048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7184,i,2503208686415418695,747355421587295493,524288 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=7188 /prefetch:8
      4⤵
      PID:5820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,12668848701755251391,17742377491886369258,524288 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:8
      4⤵
      PID:3856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,13219281646826350717,14006413453431496447,524288 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:8
      4⤵
      PID:2620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,8381862122401121560,2358111657840169818,524288 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:8
      4⤵
      PID:3500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=748,i,635043829564322805,18153262599461952865,524288 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
      4⤵
      PID:672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=744,i,6572385381589874707,13523870055134631940,262144 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,2120432992949599460,615625466051482972,524288 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
      4⤵
      PID:4180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,2889781574708370041,11998849507044710819,524288 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:8
      4⤵
      PID:5568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,13745508822836861204,7860160374093575936,524288 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
      4⤵
      PID:3060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,10108670314864047403,14146527448602348862,524288 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:8
      4⤵
      PID:4680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,4732702339944551200,1342804507682774827,524288 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:8
      4⤵
      PID:6028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7408,i,2071534808156768271,7824148512696651747,524288 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
      4⤵
      PID:2220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3140,i,4481228000462303471,17210925208899072992,524288 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
      4⤵
      PID:3276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1012,i,15091601310637111951,17938237046879229574,524288 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:8
      4⤵
      PID:6064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,5657196192591946398,11097268614201585993,524288 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=1008 /prefetch:8
      4⤵
      PID:4488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1012,i,18173315351374894041,2943039023234444115,524288 --field-trial-handle=2236,i,4609145687474604325,12609484337769678118,262144 --variations-seed-version --mojo-platform-channel-handle=1008 /prefetch:8
      4⤵
      PID:7028

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4712

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff90e08c728,0x7ff90e08c734,0x7ff90e08c740
  2⤵
  PID:2940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,16359494019942010956,16714307346551583079,262144 --field-trial-handle=1968,i,13105948969422988637,3063709281957438289,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1960 /prefetch:2
  2⤵
  PID:2036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1856,i,10801929294519381509,14263448787573121812,524288 --field-trial-handle=1968,i,13105948969422988637,3063709281957438289,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,7258206984587189410,624944385850346097,524288 --field-trial-handle=1968,i,13105948969422988637,3063709281957438289,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:4628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,9804454138415491790,3908280490612276159,2097152 --field-trial-handle=1968,i,13105948969422988637,3063709281957438289,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,4668631692399200963,5764161726167123242,2097152 --field-trial-handle=1968,i,13105948969422988637,3063709281957438289,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3972,i,16230983066959524513,6269666434812169600,2097152 --field-trial-handle=1968,i,13105948969422988637,3063709281957438289,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4468 /prefetch:2
  2⤵
  PID:2472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4736,i,14186387922920505084,733690682291578044,2097152 --field-trial-handle=1968,i,13105948969422988637,3063709281957438289,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5516,i,7801163383019193245,16724904625860025904,524288 --field-trial-handle=1968,i,13105948969422988637,3063709281957438289,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:5448

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5536

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff90e08c728,0x7ff90e08c734,0x7ff90e08c740
  2⤵
  PID:6124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2072,i,13212153007691961501,5204838753007415054,524288 --field-trial-handle=1976,i,4486880893609062035,10259130541133195560,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=2096 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,2615550843602165891,16435879687329059275,262144 --field-trial-handle=1976,i,4486880893609062035,10259130541133195560,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  PID:5588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2308,i,16765436773078001699,14517142969385997346,524288 --field-trial-handle=1976,i,4486880893609062035,10259130541133195560,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=2384 /prefetch:8
  2⤵
  PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3192,i,837663068354219433,17207335343144402427,2097152 --field-trial-handle=1976,i,4486880893609062035,10259130541133195560,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3196,i,9360975091466168372,5519908201201965518,2097152 --field-trial-handle=1976,i,4486880893609062035,10259130541133195560,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4504,i,9021138477375907602,16433488670921315959,2097152 --field-trial-handle=1976,i,4486880893609062035,10259130541133195560,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=4524 /prefetch:1
  2⤵
  PID:3788

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5772

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
PID:6072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0x8c,0x104,0x7ff90e08c728,0x7ff90e08c734,0x7ff90e08c740
  2⤵
  PID:6080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1920,i,8028277986644209077,7819686899967905424,524288 --field-trial-handle=2052,i,1135420334707622418,11160202148043813128,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,2226453272724432214,7317768270949464568,262144 --field-trial-handle=2052,i,1135420334707622418,11160202148043813128,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  PID:5652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2272,i,15437378121085211845,6407129375672689370,524288 --field-trial-handle=2052,i,1135420334707622418,11160202148043813128,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=2448 /prefetch:8
  2⤵
  PID:4024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,854372296161473970,15986374056396091565,2097152 --field-trial-handle=2052,i,1135420334707622418,11160202148043813128,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:5760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3204,i,12908755327096123002,8485322593500017279,2097152 --field-trial-handle=2052,i,1135420334707622418,11160202148043813128,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:5140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4532,i,11192343592386883509,10204630418541837129,2097152 --field-trial-handle=2052,i,1135420334707622418,11160202148043813128,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=4540 /prefetch:1
  2⤵
  PID:5436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5292,i,12942915490908076089,4108975143502686525,524288 --field-trial-handle=2052,i,1135420334707622418,11160202148043813128,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:5852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5376,i,6991358365220411236,14852926564430478298,2097152 --field-trial-handle=2052,i,1135420334707622418,11160202148043813128,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3492,i,14232551613415330379,982406724530858332,2097152 --field-trial-handle=2052,i,1135420334707622418,11160202148043813128,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5628,i,12417805880085165397,10496926439960199562,2097152 --field-trial-handle=2052,i,1135420334707622418,11160202148043813128,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:5440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5876,i,16171319589090742055,6847457433245153241,524288 --field-trial-handle=2052,i,1135420334707622418,11160202148043813128,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:5880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,11690337398947353212,8338891866454685885,524288 --field-trial-handle=2052,i,1135420334707622418,11160202148043813128,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:5812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5808,i,12076000729206930119,4066889524091644304,524288 --field-trial-handle=2052,i,1135420334707622418,11160202148043813128,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:5788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5864,i,6595578558580263728,2205905530702267823,2097152 --field-trial-handle=2052,i,1135420334707622418,11160202148043813128,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:5616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5936,i,16922227084422704919,13234673096567604897,2097152 --field-trial-handle=2052,i,1135420334707622418,11160202148043813128,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:5748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3252,i,17361116358108329070,6880571674136101513,2097152 --field-trial-handle=2052,i,1135420334707622418,11160202148043813128,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:5720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3264,i,1507171616151433987,10038055422669207926,2097152 --field-trial-handle=2052,i,1135420334707622418,11160202148043813128,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4408,i,10405273276726637495,10784989585880915498,2097152 --field-trial-handle=2052,i,1135420334707622418,11160202148043813128,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5896,i,8151640655616663958,16385709753757484489,2097152 --field-trial-handle=2052,i,1135420334707622418,11160202148043813128,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6360,i,8820054113411639833,2791950832597283905,2097152 --field-trial-handle=2052,i,1135420334707622418,11160202148043813128,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=6616 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6612,i,970453224556989296,9321920210475087129,2097152 --field-trial-handle=2052,i,1135420334707622418,11160202148043813128,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=3248,i,428147260464170143,4138696482776420517,2097152 --field-trial-handle=2052,i,1135420334707622418,11160202148043813128,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6400,i,8623420283805978831,328876578966616932,2097152 --field-trial-handle=2052,i,1135420334707622418,11160202148043813128,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6680,i,7159580863038951532,1293213343620519516,2097152 --field-trial-handle=2052,i,1135420334707622418,11160202148043813128,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5936,i,9032455308491542360,7396981428282958351,2097152 --field-trial-handle=2052,i,1135420334707622418,11160202148043813128,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6204,i,10141801166041983218,1761836814832051157,2097152 --field-trial-handle=2052,i,1135420334707622418,11160202148043813128,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=7156,i,17982616883967428559,7713012935673097536,2097152 --field-trial-handle=2052,i,1135420334707622418,11160202148043813128,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=7004 /prefetch:1
  2⤵
  PID:5864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=5912,i,10925735373756165832,11002833722829778489,2097152 --field-trial-handle=2052,i,1135420334707622418,11160202148043813128,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=6764 /prefetch:1
  2⤵
  PID:472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6828,i,9274196235628653561,11187057495533244713,524288 --field-trial-handle=2052,i,1135420334707622418,11160202148043813128,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=6672 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=5740,i,2033174490798435274,12356454182433035607,2097152 --field-trial-handle=2052,i,1135420334707622418,11160202148043813128,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=7292 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=7280,i,11665078331290589858,1756386186038234282,2097152 --field-trial-handle=2052,i,1135420334707622418,11160202148043813128,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=7308 /prefetch:1
  2⤵
  PID:732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6232,i,4533121104895798377,5542150569473236268,262144 --field-trial-handle=2052,i,1135420334707622418,11160202148043813128,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6240,i,8968346279293801702,2122128059813339343,524288 --field-trial-handle=2052,i,1135420334707622418,11160202148043813128,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6988,i,15426395076659443376,9736567958665352183,2097152 --field-trial-handle=2052,i,1135420334707622418,11160202148043813128,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=6908 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=7424,i,7561270780717766883,10270536345054190402,2097152 --field-trial-handle=2052,i,1135420334707622418,11160202148043813128,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=7432 /prefetch:1
  2⤵
  PID:6068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=7676,i,9232770838287728336,2327164038604565206,2097152 --field-trial-handle=2052,i,1135420334707622418,11160202148043813128,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=7772 /prefetch:1
  2⤵
  PID:6024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=7784,i,411474776311085082,15388088491352325194,2097152 --field-trial-handle=2052,i,1135420334707622418,11160202148043813128,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=7944 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=7488,i,11828277059714214561,3908774316714759500,524288 --field-trial-handle=2052,i,1135420334707622418,11160202148043813128,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=7792 /prefetch:8
  2⤵
  PID:4548

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4428

C:\Users\Admin\Downloads\Ghost\Ghost\Ghost.exe
"C:\Users\Admin\Downloads\Ghost\Ghost\Ghost.exe"
1⤵
PID:3648
- C:\Windows\SYSTEM32\nslookup.exe
  nslookup.exe /ajdf478374urjskldhf843
  2⤵
  PID:3500
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Exists.a3x
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:2616
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:5084

C:\Users\Admin\Downloads\Ghost\Ghost\Ghost.exe
"C:\Users\Admin\Downloads\Ghost\Ghost\Ghost.exe"
1⤵
PID:3860
- C:\Windows\SYSTEM32\nslookup.exe
  nslookup.exe /ajdf478374urjskldhf843
  2⤵
  PID:1924
- C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\AutoIt3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\AutoIt3.exe Exists.a3x
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:5748
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\AutoIt3.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:632

C:\Users\Admin\Downloads\Ghost\Ghost\Ghost.exe
"C:\Users\Admin\Downloads\Ghost\Ghost\Ghost.exe"
1⤵
PID:3968
- C:\Windows\SYSTEM32\nslookup.exe
  nslookup.exe /ajdf478374urjskldhf843
  2⤵
  PID:2660
- C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\AutoIt3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\AutoIt3.exe Exists.a3x
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:6060
- - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\AutoIt3.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:5380

C:\Users\Admin\Downloads\Ghost\Ghost\Ghost.exe
"C:\Users\Admin\Downloads\Ghost\Ghost\Ghost.exe"
1⤵
PID:2204
- C:\Windows\SYSTEM32\nslookup.exe
  nslookup.exe /ajdf478374urjskldhf843
  2⤵
  PID:4292
- C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\AutoIt3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\AutoIt3.exe Exists.a3x
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:3048
- - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\AutoIt3.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:744

C:\Users\Admin\Downloads\Ghost\Ghost\Ghost.exe
"C:\Users\Admin\Downloads\Ghost\Ghost\Ghost.exe"
1⤵
PID:5568
- C:\Windows\SYSTEM32\nslookup.exe
  nslookup.exe /ajdf478374urjskldhf843
  2⤵
  PID:5368
- C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\AutoIt3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\AutoIt3.exe Exists.a3x
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:4512
- - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\AutoIt3.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4616

C:\Users\Admin\Downloads\Ghost\Ghost\Ghost.exe
"C:\Users\Admin\Downloads\Ghost\Ghost\Ghost.exe"
1⤵
PID:2384
- C:\Windows\SYSTEM32\nslookup.exe
  nslookup.exe /ajdf478374urjskldhf843
  2⤵
  PID:2192
- C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\AutoIt3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\AutoIt3.exe Exists.a3x
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:740
- - C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\AutoIt3.exe
    3⤵
    - Executes dropped EXE
    PID:4172

C:\Users\Admin\Downloads\Ghost\Ghost\Ghost.exe
"C:\Users\Admin\Downloads\Ghost\Ghost\Ghost.exe"
1⤵
PID:6152
- C:\Windows\SYSTEM32\nslookup.exe
  nslookup.exe /ajdf478374urjskldhf843
  2⤵
  PID:5440
- C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\AutoIt3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\AutoIt3.exe Exists.a3x
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:4720
- - C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\AutoIt3.exe
    3⤵
    - Executes dropped EXE
    PID:3412

C:\Users\Admin\Downloads\Ghost\Ghost\Ghost.exe
"C:\Users\Admin\Downloads\Ghost\Ghost\Ghost.exe"
1⤵
PID:2852
- C:\Windows\SYSTEM32\nslookup.exe
  nslookup.exe /ajdf478374urjskldhf843
  2⤵
  PID:2968
- C:\Users\Admin\AppData\Local\Temp\IXP007.TMP\AutoIt3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP007.TMP\AutoIt3.exe Exists.a3x
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:4884
- - C:\Users\Admin\AppData\Local\Temp\IXP007.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP007.TMP\AutoIt3.exe
    3⤵
    PID:2656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping348_1168226504\manifest.json
Size 135B
SHA256 cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5
MD5 4055ba4ebd5546fb6306d6a3151a236a
SHA1 609a989f14f8ee9ed9bffbd6ddba3214fd0d0109
SHA512 58d39f7ae0dafd067c6dba34c686506c1718112ad5af8a255eb9a7d6ec0edca318b557565f5914c5140eb9d1b6e2ffbb08c9d596f43e7a79fdb4ef95457bf29a
TLSH
T1CEC09223CC019CB119743B642AB2AB82F7B41B0B6869705A3AB3148C1F7E1B48082680
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping348_1436401917\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping348_1473209162\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping348_1713031219\manifest.json
Size 85B
SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
MD5 8ce95626b39ebc2401eee0b34c24fc7c
SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
TLSH
T106A0121018015DE318880320213143D2D3A51C05247437001106108019B8636027A22E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping348_1808084118\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping348_1963955385\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping348_528594876\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping348_688087210\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping348_774025780\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping348_774025780\manifest.json
Size 78B
SHA256 c7e506687caffcf3906916ad3fc190a19212d67a2535479241096bd0d4418b03
MD5 259f068207f60fb9d4448c02c27b74ba
SHA1 99131d95cce94750a928738a99caa5c710bbc924
SHA512 fa41eac9d1ca244d06083e3d4230dd94700861155359722c1d815d0d9933dcd39c113b6f0f6ea02ff7ee1acd2fbc6ed40267d557afde16f417e80b678e8136bd
TLSH
T173A02230AC02E23320C803B002B083C383A02C02302A388C0B0320A232C823BE2F323C
MD5 SHA1 SHA512 TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 ae1bddb9e2cc97b0c9cd78ef3cd17553be6e5204677bd67e0b8f7fa27007f189
MD5 b0366599d64b0fc1adb2a712dcd02ee1
SHA1 b7a1c09ccd2846664cab5f76bd80b8e9f107acb0
SHA512 d7de6d48285018f8b709c81ca01688126db7893ce9f48829524ee3122aa6f2200c7f78186b5a558d0b1ecf8157ee78a20064b63b45ab89f7aa0835b8409435d0
SSDEEP 12:bHCsEXhVMMBKEKSCemJKlkQyYVhYJ0I+pPK6BsyW1inP6:biPROMMBS+MkIYWIE1BtXP
TLSH
T117252786A30815EFC54288B589AE03602374F9E55F52079B2E2DAA1F2E271D80F45164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 77bcdb2c3160a7fd4141144587938963255d18e2280ca048bae35e2b889daae1
MD5 f444c4b91d48467daad7fc304bf0b2b7
SHA1 0a54e0644c006f7b684b802915a76b0b9e907f2e
SHA512 954788cc6221a65dba3cd53452e7ffe912bdce7b20bd8cf2525ecbc1a2e6c0ba3448dfbcc8997d4347508beecb9ddb77704805450cb4090f76ac02aea569ca9f
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 bfb489d70aa67d61a91ebf84bb387b1729d0b2bae26a6a2daa797827841df369
MD5 7a8a4e3b05aa09e7a7f05b0c498a9d66
SHA1 1ab5ff8279db37ee037a73aa31fa38e32fc1ec9f
SHA512 e592829ccefc32f2dd5411f437ef062f39e8ec98ff9d4e9ac6b64a2577b0d46280b7398e3b77d6f8e683ff8c73001867e998bd9e841684bd3d9f2add0c436d59
TLSH
T18AE0AB96CC20AC7728FE471801914785EB1223162A80481F3A3CC30C4FF162A0182C9C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000075

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000075
Size 21KB
SHA256 cd5c3999d7d153b7b8e1a2effd1dd354ddebbf9c3974b8063e6429ef479c6972
MD5 484fcc38f9b75715d8be172de22421be
SHA1 08855b74ef006dc76b4163c833f40451e11a36de
SHA512 806be7ca2beb27ec54d30a2142f3b89abda341e703c335f3c0096c0b8e4160388d5841e71e6f9f0eab53a70a1fc0f6fe6933ba3fa0970a20d5a835259b252e31
SSDEEP 384:SNscoqwsdhvFdy7BDe9pk88eVL7MFEQpwsioMQuSmPTHefTSoNpLg:bTelvABDe9pk8zVLgEQyHvvbHerZNhg
TLSH
T164A2D122B93C414615F2C3E4334F82CBAD84D826EECE767F49EA93901D8C6AB535D457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000d2
Size 55KB
SHA256 52a37b3a78eb5b59df3bdb129b9115c6fed9bec6ca62b55ae56d8c2701de5972
MD5 fdf2600d905a0faa060d691e0212e1a7
SHA1 62550f0993a219e265ff9a0795a4d9f49b28748f
SHA512 7118d2ea3aafe3d77709842da20acbe3faaf4c6c92a50ab05ecd4986916bbb92fe297a1b00357572683b02c61762cdf31dc425f03221dd169803252db5f04f7f
SSDEEP 1536:HYDhrXLgUVTf98fcANMQnJULOK+z2N2Vr8KO:HYDhrbZTF8ffZaOzM2Vr8z
TLSH
T1804301FE4895FEB9B094C7938D7131E02A664022453CBB71774B13B76368E7682892DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000dc

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000dc
Size 55KB
SHA256 c0b1c3c6995c24eabd1a6fcc4f00523e022b546cf1fa4fce6c30d04763244d1b
MD5 cfd886e1ca849a7f8e2600763f236d78
SHA1 c1fc2b10d20c529c01b465a1edc0ed2fe04f0bd5
SHA512 254e37e3650b2c87b524c96f517586b690094abf7c8e0539b050ecdc4c56c2593bedab7b1a830b827ddc19f1c3e05ff4096ebdf4cc969b5bc5fd33cb34e94fd8
SSDEEP 1536:WJG/KL/shmr0SyKV2i0Qz0j72A2+0G+gSRLBeFDP3:liL/8mV2i0ac6A25G+1LBehf
TLSH
T1444302EC6A22F9ADAB11E5E847349AC2F140D6DE34156293509EDB98200F24ECDCB75D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9589032c075be4c92df374d3d03f34426e04cff4e9bf740505cbd693c2bc789b
MD5 4c7ea89c61396a9dd37fa57ece1fa9b4
SHA1 9c2ba36cf7780757f39b39ecd71dd02da9787c1f
SHA512 c6579fe89048176229146b4ab86391562952b3033732644407f88c87be596483d09d6c9d2d329d4083c87f2c5f20cf66316f0d050ab2e6d859194e779a77ef73
TLSH
T1C861CB7120C7629ACF182E7DD2D80C4D3175882EC4A72F8B2FA47CF12A56BC54FCA096
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 3e3d6feef2aad8f8065d9f3fbf924ea5b8cd7a21eec033638fb6a3d0e6669ae6
MD5 4ec0012385e3f4d5d1eb39ed9d980746
SHA1 dafbc9f106ceb3b4713f99de3cc28cfca9218a62
SHA512 496005bc48651e9a0df7414727646c365b9024f2a53397a3868dcbb6517cc4ddf6e348e7c833f1f9f59fba73d1bb05c1a8576e84532016a5032adc229620067d
SSDEEP 96:b+MUoD9u/we+zwWF/l3K1CT6Dx1PkpyET4AwZpuvhA/wdY/4ko1YF9mSDglR:SbKM/R+lK1yITP5ET4Luvh8tAko1Q+R
TLSH
T164028420D8C3F55FCF1C35789DA48F0EE1644C4B84731A4A9E596EA03A5E6C84AF70BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 317B
SHA256 ebff2dee706ddf9bdb1a024a82f6f9d32c1a4beae968c83ce2514ee22eaaa8de
MD5 c40d69b97aa00bc6ed0a6bf6f2808c4c
SHA1 732ed02318060e9a0b7b3db79afa1423956e1f38
SHA512 34959a94c8cd3e5ffc31842077bd4aa0f514fdc6b9075fac85468ea7044d5058c632f7a26f5f197a6a05580d541da7f998069ddb3be8b4e606d571832c5e47be
TLSH
T1A2E026C93588C16E44589827C778B74CCAE1B808ABD8F8460705F4683280905A1C0768
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.tiktok.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.tiktok.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Size 329B
SHA256 7ac46420f38346da238bde2be2b334357a8c4e8271bb83ef9390275089fe17ad
MD5 36ca56ac928ce9d34dc4e33101ba796c
SHA1 cb045ab2c2f940e543189f21bbcf161ceff5c285
SHA512 e3ee85d4fd6a15a0866967479ea0c46184196bd86f643a8b48fe682a70edc62f8b880cae2d50ea9eff55c2e202306ed8d7b86ba7967a359a8aa74777915b7595
TLSH
T12EE020D716CDC65D5508C05B57787B0DC7F03818DBCDA9014F00F54C71C48086AC0BB5
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 28KB
SHA256 328c5b0fe47b4f7200f2ed172e0a855eac834c9e3878b9523ceb1b05a4a6bc8c
MD5 946c9e0c13c9ca5c7d321495965009e9
SHA1 18f2c90a4458dfd003ccb885b8d69fa9362e6444
SHA512 5973adab23e1948f458f1c64bd86a19572f2e302172d72a2e301dab33fb1d1f4b21e7753bfd02c55587c2866a068250a344132ee15496c79c88ab3cbc0796476
SSDEEP 384:D8SXza2mvJGJQuaYItnEbmJ1eGnaIwr1JACRKpOg6IJTa6JfmNBj/VCNt/AyKY+q:SkPKgIqCFuYbyJnPxWnPcy+k
TLSH
T182D2AAF383E5D62E891156F8AB146E1FCE1C1A19432C3C26C8D5EE4BE3E2472E15964F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 0805c056b4d5c0d6226cfc9cbc34dd17adadf3ffd283405902405856ad38ce19
MD5 fb24fe8bdaf283ba2eb881e707c1a284
SHA1 0924587c436cc1bb17a44be327da68e3f621a62e
SHA512 4ea07aa1ec7ebb031a426a1a6797dc93dc3550c27c3517ffc4a56f97d14a61fa7895686418365cb999cac71bb8d0e2980fd28853d922528d64aabee5f8b42e02
TLSH
T1524160F783E4997E860196F4EB156F1FCE690924131C7C66C8E4AE5B53F29B2D10068F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a22c8ab66f200adb9472ed10501ce11a17b4c6614f9de91502938ce57d24a3d1
MD5 dd8d3e22d3356695196eb5a2e16e30ca
SHA1 abe06c5e5ff2978ae10c2c091e07106a8ab1a2c3
SHA512 964a7d14e75daca5285826356861b1e08bc48e787ba93f77b40cac935075e7f6904b611f5fc4ae29bfd8c191f4f2fa46605edcd829a857e216054ea1d7006c1f
TLSH
T1A14179F7C3E4897E890192F4EB156F1FCE690924531C7C66C8E4AE5B53E28B2D24068F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 42KB
SHA256 e2d4df799cfb8239e763fec5fcafbcf26cfa656858c21b048538e0ca3ca8608d
MD5 3350c880e4915070e55e952cfe740431
SHA1 f742539e322db891d524c2784bacb3364438f466
SHA512 b627d56d9972412edcc8f2a6b547cd4a32213daf8ba698e59766fa7287dc7bef508bd6bc715efebbbb9660a3cd1f0b4eb450d8d374069c89663b0802efef658a
SSDEEP 768:ZkgJY0fIgIq3FuYbyJaPoRbbAfbX/lY9ce:Iiekaee
TLSH
T13C13EBF783E5D62E891156F89A146E1BCF1C1618432C3C2689D5FE8BE3E3472E15A60F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 186d1d8eb43e2b85140256117b856946a92f5ff592331f0390e27a7616d40529
MD5 6573bcef4e406950b40a7a55b958549f
SHA1 3074f3be4dcd1fb7e1b9bee7903721c08854405a
SHA512 01ef39a3abf6a27e4534f3db09ecd5eb1a883754e1f530a7b254495762cd4a8e752060de9fc40bbf6723287fcf853d6d7bdc05c1626e44fdcd9d111da5bb695a
SSDEEP 48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBoOK:OIEumQv8m1ccnvS6bG
TLSH
T156F212FF07197501C0E49274D6810ECFFD2E051D4B9BBEC09AAC05F3AB861B39538219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 ae552f9560a3bc3f8ab157f01bc9731ae44196e465cf2bb46e45df600a60e704
MD5 0d4e50af8db912d76bdda843c907c71d
SHA1 7b35e2ce9dfc058103046c6d42f78c299caecd8d
SHA512 06700a84f8c4550b1a3d585e273da281c361d92e7e88403a2737a6a82776a5ab31c55d23abf18465d4432cf509dc84e14866c8765ac6d8f0343afcff6e67e259
TLSH
T148F050A7D67E703751BDC5BB1D087C0D35B6A43107D168F0CE6A416EB0C55E70B12457
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 7KB
SHA256 a93fdbdf7ff693ddc976008eb51c595f771731a4000622bc04453c9bfa65f947
MD5 318b24ef45b25b13cb910ab4d5a55443
SHA1 36398857a32c731ca4aa7b891b26f8993ebb74cb
SHA512 39bdf17ccc9ca6ae02c8735d79db2a22317dc6ec869877d1c2186b9d8ba52820910592805c5fe9e058059905f637cc9bcfaaf9eade2a2da3732d73b15f54dc43
SSDEEP 192:+2UXU5U3U2nUxAUCU2UxUsU1UNUUU+UOUDUmUGULU1U7cUgeUnGUUjULUEUDUiKh:+2OQCD2AHnyNygdv3M3jO+Cc9ecGvjSj
TLSH
T1A3E170E382FFB427907C4DBB1E48BC1969BEA4311281A4F9DB9791ACB0D59F71702427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 26142182853808ff1497d2849c921df59a30bd637031c707e7832054455b2aa2
MD5 4289189384d6b9850c2ff901ade95ff4
SHA1 f221971146319b1857d639a92db23297636602d5
SHA512 9dc08fe40ef64f7666d9417ad81baf89a2fdd211a66f06b222cbb2ebf9860f982b3fe9473f2f348733159bd176d19ce21b2b0a8e3ebf866bb44e2b2f08b11dca
TLSH
T167F050A7967E703751B9897B1E057C0A24BAA43103813CE4CF9A41ACA0A16F30B11487
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 f435e61cd451c923b42c82387212b7f3bcdc8c781e19cd8ee0e08ef211b33816
MD5 eb7867c2e670a3cdfc9b5daf4ae4f712
SHA1 c8a5266bf3634eefe45d2bcf50615d6f849838d9
SHA512 c65d731302ee0d5bc2f097415f20878719ec55f87c502f1ffeb766d45956f51effa73ded78b487672ebd3dd122d51afd3d49779cbc801cd4f56d3f6c750a8d82
SSDEEP 192:NRpmL/zv9sjjv7hpAPRp2W95Hsb+WNnUr0gouoPyIsnAUge:NRpQ78b9UXtrwM0Juye
TLSH
T1D832A71EB914B53B5CCBD21EF9367753E3F6142125A02E88EAFC8A6C15EB9CD2213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 aa0761b14937d8a3613fc13a44d5b5c70f3ca1fa7bcd816202aca7c8945eeae2
MD5 e1eecdd1bf07d9299959ce678f38c819
SHA1 ecd258eebde1ed5fbee4a0dfa60c00401103efee
SHA512 304835cd4f45b0c6d6eb68e0dca5f16a0cc6cdc3664ecdea9a8e944ee645f32df928dc3cf91c1a3e864cf7d895949638e3aa35f737098ba4e397cf244730031a
SSDEEP 192:xRkcBzqLD73sKpv7hpVPRp9aKXgsHlXMYNy295Hsb+WNtVBrgWba6408Zn+xf2R4:xRkmzE3tp9zXzHlrwtoJ02O2CaLuuJe
TLSH
T1B072D76EB420697B6DDAC229F961775BE3F6102214D02E88FBFC8D2C14E7ACD2217457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 c8d2f14c4b767f66da992f1fa99030d919657a0afccf5be197918656274cb374
MD5 ebf073fa19d27349da40501b43cab7ca
SHA1 e7bd2900416ffb23c544869c8ae6444ff7039cf0
SHA512 aa4933279475e90bf4f0a13cee22fde88b86732337a2dd5beaba4a60d2f04591f10fd91818e4236586a60d16cc46421a2972df78fb16e4ee32a24e24f11f5ab9
SSDEEP 192:JRXcBzqLD73sajv7hpVPRp9aKXgsHlXMYNy9395Hsb+WNtVBrgWba5Xg8Zn+xfH3:JRXmzE3hb9zXzHOrwtA1012U2CaLuuJe
TLSH
T1BA72D86FB420697B6CDAC229F921775BE3F6102215D02E98EBFC8D2C14E7ACD2217457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 17KB
SHA256 4c423d6aa29335c5b4b997cb5fadaf30ff297902e0b5ad606eaed846739800f3
MD5 71d522d4cc86115d832b669b6dae92e3
SHA1 39a0d94723f1b8148b5d285597c79bcb701ad888
SHA512 9697b9e47d96e0901b16de072a81038f160d94f2b8603413946df9bbaa5f7f9b1c041aa14cde49d480ef10ed9e93573ad180026960d9dd48560a943f7e77d883
SSDEEP 384:JRXmzE3tN9zXzHOrwtw10dIU2CaLuuUfe:jmzE3t3XHOrw0U2VLuuUW
TLSH
T1CF82D96FA420697B6CEAC229F921B75BE3F6202215D02E98FBFC8D2C14D76CD2117457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 89734fdc50c59e8858bb61c6320ffa0b82974bc7ba5fa50748bd0d3be416ebe8
MD5 535220af846e70045734f4d912cd6d50
SHA1 b829ec49f2da029cae239fd98f93a230a72036c1
SHA512 9c5113bce793e32142bf041422360c142fdb36ba807686a9546da4f3bc12b2c3d34ff7dbeea0fc5e5841720f7f20c8d032477143510f6fb14a3a023e6d56d37f
SSDEEP 192:xRVcBzmLr73sApv7hpAPRp2HXgclXMy95Hsb+WNOu06408Zn+xf2o42mbaa4uuvM:xRVmzQffp9UXS7brwGJ02Z2CahuuJe
TLSH
T17862E82EB910797B6DCAC22DF9217757E7F6102225902E88EBFCC92C14E7ACD2217457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 960b110a0303890d104b4ad7a44ea5a1dd0c31377890b267533047850d138c8f
MD5 5cf01aca0b8765b6dbff2d1bdbe4229a
SHA1 06ef2b64d9fcb48c73ee5133bb6df50088b927d8
SHA512 204f68db823f82c72893cf796d697b53fc590eee55f9a87ec27240c3689979ee7a2655af58a6bb64bc95c221f60066db227d26d0273fab39fb70e814f82ac0c7
SSDEEP 192:xRXcBzqLr73sKpv7hpVPRp9aKXgsHlXMYNy295Hsb+WNtVBrg06408Zn+xf2R422:xRXmzEftp9zXzHlrwtPJ02O2CaLuuJe
TLSH
T1DE72D76EB820697B6DDAC229F961775BE3F6102214902D88FBFC8D2C14E7ACD2217457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 3d31f276b12dfa88d2a946a6307bfb748a78bcc332f01f3d01491515f4793320
MD5 ebf3c36f681a18bd652812b5b63d8d28
SHA1 2122bdb02bfb304dba1b02d3702fa46a8614d8e4
SHA512 32c29ac1e87b6ea009d393628a04e3d5c49d0a5d0e7efa0fb37471ad19691f80b48e6fad3fd78bc62fe3a98728bf87fd178094beeb6831d7f365456b497f22ac
SSDEEP 192:JRXcBzqLD73siAv7hpVPRp9aKXgsHlXMYNy9395Hsb+WNtVBrgWba5Xg8Zn+xfHV:JRXmzE3Vc9zXzHOrwtA10Fkg2CaLuuJe
TLSH
T12C72D86FB420697B6CDAC229F961775BE3F6102214D02E98EBFC8D2C14E7ACD2217457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 ce650550d29b5b006a10e7b86bf42990cefc0bb8d2c8d63000fe05bb208eb6f6
MD5 2cde4b70667de0b7be5d491ff13517ce
SHA1 708cdcf3e594a9d48ed9db3766dfac025c64e2a7
SHA512 58ec9091f9a709ba01d064fdf7df68577732b1b0b38fc072bbac99630948ee439ad16f2def78b6eb187475725e25b2f4f23376ba13c384eed4a78e7399e8a1f9
SSDEEP 192:2RpmLr73sRG1v7hpAPRp2W95Hsb+WNnjQn1ouugPyIsnAUge:2RpQfiGF9UXtrwsnWuuqe
TLSH
T1E132B71EB914B53B5CCBD21DF9367753E3FA142225A02E48EAFC896C15EBACD2213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 15df7dd0bc9dc8947365ff08c8d95838d0210afdda668713b97c25c7a1b63a90
MD5 815990dc0acbc588dfc9406819d5b211
SHA1 c5926dde8a3b56a9f32dc1b6eafb5f066d1802f6
SHA512 81ea932537102fa82b686e3755477ee758907a4e94198ea2162aebab7c50f87d79bf74a5c33476324ddf7135277acd76996243f8a3be5be953c4c565b3a0df97
SSDEEP 192:xRXcBzmLr73sKpv7hpVPRp9aKXgsDlXMYg95Hsb+WNtVNg06408Zn+xf2R42mbao:xRXmzQftp9zXLH+rwtDJ02O2CaLuuJe
TLSH
T12F62E96EB820697B6DDAC229F9217757E3F6102225902E88F7FCCD2C14E7ACD2217457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 534204d3f896a14ff5c258d4762fe9ca1ddffb1d2b856e547c62c5b10a7aa22b
MD5 9394a1fc7404f8190d98e6e8f767f1ad
SHA1 48269da87f0b955ea5cbf34a9296f97c2618d59b
SHA512 bed6214a259297c585617a0cf0e629e8cb2f1f0248bda9d5115340924be39130c3536ad43657d5201247479f374c2a9a9e3021726b1590fd78662a32e5d41069
SSDEEP 192:JRXcBzqLD73sahv7hpVPRp9aKXgsHlXMYNy9395Hsb+WNtVBrgWba5Xg8Zn+xfH3:JRXmzE3hx9zXzHOrwtA1012U2CaLuuJe
TLSH
T16D72D76FB420697B6DDAC229F921775BE3FA102214902D98FBFC8D2C14E7ACD2217457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 a2bf07d4dc5e2f2e7f5ad9be13c9956911bf91eac9e8c6cf66aebc75635613de
MD5 64fa96f38d235746b635fac0faec3a1c
SHA1 8d45bb98f6bc601f9b2e8dd4934c48c9180dd1e4
SHA512 55a0253fe4f1062daf20504116f4cbe88e861fbeb1bf98b29e6054604b4a337ccfeb059cf943c631539186358eef7b641ce030c3077d6b068822bf00505da433
SSDEEP 192:xRVcBzmLr73sATv7hpAPRp2HX8WXG95Hsb+WNj0644xf2g42mbaa4uuvVyIsnAUp:xRVmzQffr9UXS1GrwO+2R2CahuuJe
TLSH
T1F7520B2EB910B97B6CC6C22DF9227757E7FA102225942E88E7FCC92C15EB5CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 f0fdf11617bf8aceeda5eb6d56b0bef822252855b63b4efb5a54eb03abb1931a
MD5 dcb049cece2d173a40e600af089ddb85
SHA1 3197d30a971d32241b29b7299a4def3d9baaf0c7
SHA512 d949d080314b239274906b525b7cd8be322557a6505eaef2d71ac4fb34fc4210cc73d51618ccba14ca7693ca1c53d12ce1da7a5dc9b7e40776bbde6473ee906c
SSDEEP 192:xRXcBzqLD73sKpv7hpVPRp9aKXgsHlXMYNy295Hsb+WNtVBrgWba6408Zn+xf2R4:xRXmzE3tp9zXzHlrwtoJ02O2CaLuuJe
TLSH
T17A72D76EB420697B6DDAC229F961775BE3FA102214D02D88FBFC8D2C14E7ACD2217457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 a8374d613726a66e178adb38923eb56bcd55a811682513e2482322fe4387770f
MD5 d8467509ae31bdd58afa620c901dded4
SHA1 36e14e1a671e57ec1a746b695667ddca782ce580
SHA512 11d76fc5c1fd85ece1359f3289e1a6e1f1f63f8bf6b8e6b03814c42e0a4458eaada3bc17d2957a16dbd8696941d4aaef9c14ffee257928ce594d9fce1772b46d
SSDEEP 192:xRVcBzmLr73sAHv7hpAPRp2HX8WXG95Hsb+WNj0644xf2S42mbaaduuvVyIsnAU/:xRVmzQffP9UXS1GrwO+2v2CaYuuJ8
TLSH
T1C552FA2EB910B97B5CC7C22DF9227757E7FA102225942E88EBFC896C14EB5CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a9a449fec53533856db12f8b0beec81aa1906c06646aefcff9d2c3f72e1001e9
MD5 c22ca1d63e542e806e97565ccff92163
SHA1 e653e2cff3f65697f1cd6215ff61c938d3822f6d
SHA512 589d473c6ada52918220ebef520a36f8f054c52a4e6c32673e8407c24a7cac47eec7d82c519f0a4f203fc4b8e898a4d3678f26568050d6d6653e35e1453cd3b6
SSDEEP 192:xRpmLr73sAcv7hpAPRp2W95Hsb+WNn640z42mbaaduuvVyIsnAUgtaJ:xRpQffI9UXtrwp0k2CaYuuJ8
TLSH
T1F452EB2EB910753B5CCBC22DF9623757E7FA102225942E88EBFC896C15EB5CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 7f2c3bb0b002e4d7d49e8ebd780daefdc42e5000eb8a51c5ee9d65c53ca14658
MD5 238ecb1a3e1c98f2912f099b0b7b8a1c
SHA1 8ef41ba79237b6d6468df95cd855e11fa292bdcc
SHA512 ce27ea08a3f6036dcdccaf5606f131bfeaa96a34cb88aad7fdbbef444d0eb669f860c23142443bbec8334482763511fadcc152f5ae3ac7f75fcb910a49c20877
SSDEEP 384:Kkj+F7KxkXqKf/pUZNCgVLH2HfgsloD7pLuLcSjsNXOD+F+ErU3qsHGZ45hUeHD:Ko+F7KxkXqKf/pUZNCgVLH2HfgsuD7pY
TLSH
T16D72F9677C4C9A3B0F94C6CCEC277B4FADB6024B65E9886542FA581503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\75dbf241-251b-4d80-bf50-a02a994629bb\index-dir\the-real-index
Size 72B
SHA256 bce316144ec87014f157750d1e9cebdc72ee2f71b419b948dd75a1dce6e4c8e9
MD5 06f598f75a7a634cb0132320c182db55
SHA1 313709750ff1d94a6ced09062005ea8a83831719
SHA512 ced4a8c4df12bda22c4592d9407a68c354f0d53c2dce2c3eaf8c9c5fec98709076d20b49378f4cbc828c08d6080f6e91d367582d2b411a62867f759780283409
TLSH
T105A0021903492841C96DCBF45A8B019162125D100112570144D8005DE967288C155519
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5e2345.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\75dbf241-251b-4d80-bf50-a02a994629bb\index-dir\the-real-index~RFe5e2345.TMP
Size 48B
SHA256 e10d84e5605c1a83bd0b0bbce345f957e750233ac2916bde62f2f0bfd866d98f
MD5 c97469feaff63da9d10c68d9a8368192
SHA1 53a0784a0dcc4e6ac50e2cc7da5f828ea79d2020
SHA512 db39c68255f15d33ee994926eb542c0193ef67ccc0082aa48070fa022b0da3eb72c5a28347460fd04709178bfa87305fd8155db01fdaab6758f7e62d82330a98
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\index.txt
Size 159B
SHA256 c7c1ec3bfeff0a2763f38ecf42342e1c8e6ab79e572d5dc5e65d50974b4e60db
MD5 587edb50f71d56d0a547bcdcb2fc5ff5
SHA1 1b96ff69736fefeed396b810a0f4b5753065ae31
SHA512 8f9c708628d4a1dd5802e9069f792fb0ac941f4ad984263f46700536ca2d1504d05e3f5c2d8c5d3caa78219c4751abae1468ef2b529107d74979db18d9b9922c
TLSH
T148C08C53682AC059EE309EC078A965145D2799C8A8A685DAA40222CC2A21D1088A9F7A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5e2374.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\index.txt~RFe5e2374.TMP
Size 165B
SHA256 a3c6f5f2f663989dfb2cb6f598fc79c68071383a67a88cdf767ffea12b3d36fb
MD5 0a08a36cdce53844b774b1d95fb565d4
SHA1 fa3a859b235ffb7b0efca00ae77f8f92a13a1b69
SHA512 a78778aff60b22173f57b831c26f8c193217c9aed6e861e2cd98b450739241d3490b2c5494113bb2b3f9f41bf3819856e64aea6709a130ffdd78b2740ba28c0c
TLSH
T15EC08C53683AC029EA305EC0B8B865044D279D80A89685D6A84232DC6931D11C898F72
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000003.log
Size 4KB
SHA256 184d014ab71712080f868933cf5b7ad4e09cec700ece67701d01f2a4ec6b9bf9
MD5 cf9cd8a1360231c5a25fc30a9204354d
SHA1 4dae10c5cab8458253a5060af820e71f63799ade
SHA512 07b76ab80d31d9a66469dbc321db6bc9161adadc033e51e8a07945a168636bbdd309c8c574fce42d220459ff8ee719cbd1b38326bcc1f346678410c8330921a0
SSDEEP 96:F1mKmMNORwcnDh1JcsOyLXbXFXKXTwFXSXTr3XFXKXT5xhXsXp0XbXNXKXTCuZXi:F13/NBmDhEsnL1ajiCj71ajh8SL9ajFy
TLSH
T1A9A14C6EB509184EE4AE4936CD78571B5FADCF0C27FE3767A9DF8A0405B0A5701086A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 333B
SHA256 1bcbdde66ed27abb980b8d654bedc5fcdfc9816d45cd6f77088053736b8ff02f
MD5 3c0c9067393d7f6262bc01c69b74bf0e
SHA1 6a217664be6c66ed8a38d673bb1a241d31c7e9b5
SHA512 feedaf3b323cff7d5dd1d0facf47638fced9c3762cad0730770865db0dfe53b0364f56e2c5ea101901f9e4beebc3aa4fcc822d8dafca96337ed940623cb19a91
TLSH
T1BEE0268926CEC5BD505DC00307A4A34EC7F4780EDBCCB9621F00E688A2C5E0C70D1770
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 b842bb90c2d530c916572fc742db3cf1217997438ce9c589cb34bfd49479af99
MD5 7b9fe3f4a897500f7d00b03bf8f8f7f9
SHA1 0800dabb650e1fc25d8ac96e832d810b2622fbe5
SHA512 67659cd0157aff5f7bd80a8f15541069265bd8a8e22941b5f44b9cc7684f7ad5a0bb1cfbcf9b4af8086d8c321bdd18d13c6456941977c829db52e4f565268675
TLSH
T16FB01200C4015210C00202B421025888B1089F28E9091B0193E06A63882536180A5054
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 360B
SHA256 2193a8627d0610d5d7489a38bf4cfc3038aa07ace678d3724d6f39d1bbcfa90e
MD5 0d46a16809e433837f566f52d5157597
SHA1 85f88ea9784a94350db1a08e7b79fafc67faffe3
SHA512 6fb027e2cfff746fc1370471ea38202f7f213f7e136cf0efe4e98e569dd81f930391930f3e0795b75f11769cda5aa03dcee200be750f35a48cc0ba75fbb97cfe
TLSH
T185E09706CA82A602C00B4330216BA1D77230AFF9C91D43ED022C380B7EB00324E261A8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59695f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59695f.TMP
Size 96B
SHA256 4b29cdd782a0d9a77b701971683101ca23a2805a4a7d18ee77921871e5095e71
MD5 0454376f41c8b7fad97bbfb84fc8aefe
SHA1 38cc006e4cc08544e3fc0b8d170e8614a345df61
SHA512 3a3b129298d3e046e9f3e6aabac3c6b76d708e26f53fb20ed74b1a7da1425183c48b057dbc34a74f6897964566d658451606442b8fe728e66926b27af4de7a06
TLSH
T1C6B00255C1126212C64307F02995A9D87260DF2DCA071317A2F69B67DC36A748DB5964
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log
Size 308B
SHA256 cbee1100a2c9add47776b7e416b58a809f6feb9fe458bef8185b0c176b5db340
MD5 4e7982b86b3d7d916b7722aa3b3f0669
SHA1 ce4e874903cb71d9012cc7654ca7a6ba5e4f7efd
SHA512 c4dda8b36e90a327061dab901730f47fc23cca129b02a157f1ed0c566a1d6dddf272a4e74d3acbf14eb3a7fac0820387a584db9e19ca299724ed7f3030f891bb
TLSH
T1E3E002D812C1F027FCD986300D4723302F21D8BD1F311D43C4CD35D0061FA653401441
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG
Size 317B
SHA256 aeb837888223b3fa629c0c41f05b9b8c52efe5ecc1e3f9284d0831fdb46cd642
MD5 ec21f195ce56f264fe80516651c8bc6b
SHA1 5a079dd7483562d833ac8a06ef088462ab8fa8d2
SHA512 4e91cc1b9635639a1223268aebe9e44fdcbd9797e25a3db266e402db321b57258451ab60735aa43d2ebabb52204a132132ee6e1bf5de7624c6886bb8b4afbca2
TLSH
T167E086AA358AC16D146880A71774775DC6F1B908EBECE9121701E548338692566D0BA4
MD5 SHA1 SHA512 TLSH

Submit Download

81c2ebeea22efd64_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\81c2ebeea22efd64_0
Size 63KB
SHA256 a41aa641b9b978bba7753d0eadc25a1ba243af0ccd15dacaddeca97cbbdd542d
MD5 a4dcc61b337fd4a36b627199e29b2077
SHA1 9a41dffa6ca6a66e7927350bd99a27950c3cdb0e
SHA512 f0eeb7b51dc82245dc8174dad03347520a769ff8a3bf35552bdc3ff60919295cbc268cfabf9383a7cca82ae0cffa418e2e12f9d8b8fc0ce675cff7073bf19a8d
SSDEEP 1536:A8k3vI6lZbRXxyqxn4Y473+KrYF03iRNjkv:A8k3vFpxh4Y473qW
TLSH
T1B0536BA6337178B3427BA1B1906F130B713EE1A7F40484F8A198EDF45E54A960267F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 120B
SHA256 a068a9f4f749be8f1e478124598daf84041189642eb075eaaf0294981be136f0
MD5 123b8de6b13464299bcff3a686b25174
SHA1 2c2ec7bce58c9a638a0e6ff10c65a5b1c6465f03
SHA512 14232cea6520bc4fa3a754d36dae05eddf49bae2d19a62c84b1c1802c209fb94763d3a2f18a27f6f401bd207548e2fe924d07e538e151f706ccf113f229bc889
TLSH
T14EB012B333485D35C900037842C008203701541006C1430368F544444A09488C25ED00
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 5cae68c4c4ff6fb11e9fd9adce9842b129550c79544cb1e0c4757b4c29dca2a3
MD5 b589ad9733e4ba7ecf2f803315716473
SHA1 12f5ef0f9cbab648a06456b262d858fe99babf9a
SHA512 78baaca6a94d5a3711d98208874933dc50e29209bd0313104208c9f33f1a3895492079b07c0ff8e4e9f438c2ab4618fe56c2a4f57784ddf760ae0542ed8bb666
TLSH
T1ADB001AA32445A22CA0553BC51C1A96932237C105AC24262B8B991699512A54E2A9D84
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 345B
SHA256 86a932395c0531c7a6345067af0d12b50bf916258ffbb0c37e37d8927e44c9dd
MD5 44b64d5ad1b6a601e016764949d5a96c
SHA1 990ddd8e69de51d5d60b3ceb60199b497a1a0d56
SHA512 cb4aa3ef8506b7c8a9076551cd854bd94c14f508a0b786a7addc3883a9eb82081ab526ec67d2da11c60dcd66a3da137168657f429a210514509a88b1576a7e64
TLSH
T100E0D87926C98A6F504DD05763A4F30DC5F27808DBED95211F04B548A3C5804B5C1760
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 321B
SHA256 5acdbe67921fe8d40a4766087a55aac7077ea4ba02df800930d17e562157c821
MD5 2f77b4658b797e3f0e8b144a81fa19db
SHA1 3dea8adb72b09a6fb3cce74d5e9dcaaf8b585922
SHA512 5eec9f07ed263203f6cdcd1c49f31943a76c139cdbf8ad28c9941bd7eb152d7a735991317e423e010d55c11eeedda08efe97e72b482df81753e258b3e935a48a
TLSH
T1CDE086B966C9CA7D944CC06357B4B70EC6F07C0D9BC9F6565B097488B38190866E1BF4
MD5 SHA1 SHA512 TLSH

Submit Download

QuotaManager

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager
Size 40KB
SHA256 3654583ccc88146dc0393165790feb17c0a8067c14cc80984b13198c169fdadd
MD5 f23978542c63e8438dc8bb14291e74c1
SHA1 4c09c628f3253cd3caef71866d64fdada7b2a2ee
SHA512 392044090eb5d822270a1c6258cd0c4e4f641158a0af4414a55a7d572c8e981b0bbfce2126dad461a825b0007a5c141bf765aa5aeae74b045275ff5141da9190
SSDEEP 96:f7doKsKuKZKlZNmu46yjUKVXwX4l+XvXw:7ZT0nzXggzfg
TLSH
T17A034F8F662840F3D0B6C13EEED245E6FC7C160CA32379D419E907754DAC03390686AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal
Size 8KB
SHA256 8292b77a87c6e8465a1321a9c1cad25a224e28be42c4895e52f3d85fee01fd47
MD5 8c34339daa4683d9eab6303b90440101
SHA1 4334f718f8f4b338c2ec23be3498026fb1e49ce0
SHA512 608902d3f1a658c3a6047c21bc7c229b69d708929d8037691b5d8aa6dad07ee7838d40c0c916edd7dd5e239bcd5b3ae2b172594b10ca91def84e2dfc737e3e93
SSDEEP 6:/qVkHS7az+Bcc/XKuqHKu42nIyCc/mLEJOgLEJLLn:/qVkd+BXXwX4ymLULILn
TLSH
T1EE02268FB506488BD824003DD6BEA8A26E2B4DA83B93B51928E94A082CBC147C054387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
Size 22KB
SHA256 a522927b2290c9ab298cf3e4d800dcdeebc118bbcdf0a1a465b29f0244c710b4
MD5 aa927303d50181243891cd92c401755c
SHA1 30726cb5fc9387cf9bdd67dfe50765db1a6e1094
SHA512 00a4d43aa1d647516dc9adefe85aa8e55fc1485a68b0b95c45c2df01e7c3eeb1d4b0534fa98f90f200e20e01754328df58cdb8fe7309fdf7699dda5b5bf1f02d
SSDEEP 384:L6xoHsdGP0PQXIIImbGMIMNBFJnVlsdGj0ZWssdGQhRvksdGlK:D0PQbLr0K
TLSH
T138A209AAA3B21BC6FCDF93FFB855CC6E4773DC89445A0001A09196EE2873E074985797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 320B
SHA256 457b6b34b3cc17419ee6483b9707fde43197d34a684633712382966dc41fd347
MD5 5cf34423465098e1860f13dd274ccc76
SHA1 8f547dfce6f5c03e7c6f4685763ada71d50fc3fc
SHA512 e79bc5ac08185c76444f516337ac891fa7d4efee3bf0454af910a96fdd2a9ed39c9771162660a342fd66a13d910fc2a90b1fabb84870618ac1676c5e23116422
TLSH
T18DE026D978C8C7AEA42C804B2374730DC7E67C09EFD994064F00E04C72C48046EC0761
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 c3f21eb137ebe903c4f777e394954838687e0bfeff71e01fc80417c7a9047827
MD5 be37b98ef3ab6d6cd61b4da209502ff5
SHA1 9f176dccb0faebdae51b2b624334b8f975ba6d98
SHA512 2ed0a3dc83bead159237ef3e6929ecccbc7ee56ce074bd6dccd4fa69cf20bb631462dfe27e7d8d84ed2baaa98867f3416cdc1cfde89073ea2766d74fba6b99e6
TLSH
T147212896F331C148C54A46BA613EAB251774C8629FF8ED0F14B534683E73E040D4B2E1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
Size 338B
SHA256 61383bb11ebf9941c268a8c093a2782a94e4e4eca1803460555aeff4d7c9999d
MD5 ccb26b4be30557699794142efb3b6102
SHA1 54463792272c9093978b1e244c4945ebe119cc79
SHA512 a7ab589aeaea063125cd58d445da6e881a45305dd5b36729571f693892665b3e6c7220fbd02481b12a76d785e8dd0264df1fb1407913322f93bd30d04c53d61b
TLSH
T18EE0DFA578C887AF9058805312B4B34EC6E63C09EF98AE028F00994C62C58057DC5661
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 405cbbc0d693168b74da00c11124bd1e91a4ce12c564ab90057f4e8d4e98e31c
MD5 cb2ffc29177133fb9448a4cc3cd39c40
SHA1 bd553f713616b818c7b6d1024c6b89377b3fe611
SHA512 4575c33a211f2b54d67eb2ce2418a42c1d83407cfa89052aa2bbcab533ebc2188bfa520475429bffcd3758baf5bca0e6a2104943d0675a6d3876042130a8963f
SSDEEP 3072:W0XQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzIZ:ohxNPRW2PYddqmY7U52F+
TLSH
T14BC3120078F96A78484EEC5C328B3C2EAEF6DED860D83EC1D9A59F0F155BC616263954
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 8d5640651270e31afb266b5fc988d3d88ef702d5a612c30aaa094aad7f596557
MD5 33603326a28cb75829cc50c9a4d3d475
SHA1 30f5d9ba95272359cd7f97888adbf98683927855
SHA512 932cd775d261794a5b6573ccb2f6f557d24bcce859db8bce1e7f9a470c84f21d4d540032d3d95e24133014069328821bef50a99a9eb03e858dd91cbc864b9b73
SSDEEP 3072:q5XQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzIZ:qShxNPRW2PYddqmY7U52F+
TLSH
T12AC312307CF96AB8085EEC4C324A3C2E6EE5DEDEA4D43EC9D8609F0B145F8206663D54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 1de1902184e6f7cb8b876c9199e43ca90679e2e4e9d34002dea16ad197f6785c
MD5 2007395baebb69cdf87e2d3e3474a712
SHA1 8aaabf18688a0fc9a2dd448239f76894f304c912
SHA512 f13a78d36bb276782e936c4a15cfde0d8ab477b4052a6369e9d8fd69f6040b962a89cc3fc1245607479476af3e6257765cba559fe800ba4abc460bf25c62c6c2
SSDEEP 1536:6XyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:Mqfd7NtZL8cHQRZEQ6Sps9
TLSH
T17AC30237EBC25F335D82CB647A534FD6A7B644A99030D301AABD3BFB6C93451644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 8271a5dd67f6a2c8326bf43dabc15f63566f196ed57c9afc6e2e9b8ae38c554a
MD5 5e743a64bbc8826898ef7fda02fde81f
SHA1 8d2ecf06fc95515272e13bbcc31d7402a26d17ac
SHA512 785fffb0bb7a08cd55161a75d04d0393c09dda16084b75a27113e80368873b04d25535f386508c6320ea150786914aa9f9b65f779f5f26f54b535206fd79f0c1
SSDEEP 3072:NKxXQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzIZ:UahxNPRW2PYddqmY7U52F+
TLSH
T149C312317CF96AB80C5EEC8C324B3D2A6EE5DADE64D43EC9D8609F0B055F8216163D64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 fa5cc29bc2942eb00392e2d98b30bbe70dd8e06171dcd5bb9e24b8d38fdb19ef
MD5 f422304142593f8027c6c433259bf9fc
SHA1 9c1858a474cd369f4da74ed732de94cb7dccd3f3
SHA512 91459a572758dcf4114035d88a082fa95f0f760373e951898b80cf0dda30a746c12919f4df1c641399ae89b5925399ee134dd3091b81aa9014737d5927021add
SSDEEP 3072:JdXQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzIZ:JOhxNPRW2PYddqmY7U52F+
TLSH
T12EC312307CF56AB8085EEC4C324A3D2E6EE5DEDE64D43EC9D8609F0B155F8206563D64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 b9eaccd400da6f0b7fcabba978412ca670abbd503a13fae273b1565ae86314fa
MD5 f70574cbbccbfa62b4961f13704ae115
SHA1 2f575c5e3d13e200d3056d2be4e83f2030538e1f
SHA512 a4bc613e8c9fe13c9f79dc199059a744d1628f5e82e824648d945f3cb2cfcb6b50516751ffec2dc16fc9ad3d727ea2d10f09faf24f7887e54fd5a98ac9f658a4
SSDEEP 3072:IxXQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzI0qfd7NtZL8cHQRZEQ6Spsm:/hxNPRW2PYddqmY7U52FbqZ/ZLW3Exm
TLSH
T144342331BFD22F354C86DE6836432D2E6FF689D860F4A781EA696F4F2843C51645389C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 1bc05d7c3fc5c46a422f752118806d7d654763b99c13fd5b288d4165714f18b6
MD5 29b448d4feccfa9dd3568b5f27a3bf55
SHA1 c025f3755cb28dc986bbcee1af81edf8367e0a04
SHA512 5ea90b5288e70863cea821d85c978eb6a430e179cc332ed6327053c3c493eb809bed194879f3b03b7cd59d8e6cc919d994585667498466286fe1f886501de51a
SSDEEP 3072:UPXQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzIt:lhxNPRW2PYddqmY7U52FW
TLSH
T1A8C3120078F96A78084EEC5C328B3C2EAFE6DED864D83FC1D9A19F0B155BC616263954
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 6b8e6a432b6dccc4f511c123256e93354ceb222bd55e911dd8b573fa3cc1cd34
MD5 34f55f46aaa14c1945940123e97f39dd
SHA1 6b4cc9b7600bf8faa7c7e63991e43948abf20886
SHA512 0975a8d7a67d988ed208b7535778610feca663c182682c22c76b1e5237f40b901a0379f4ffe15f2d0a28a7dbbdb42a4d7d4bc17f679d303265a630fdf452e0a2
SSDEEP 3072:vEXQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzIZ:v/hxNPRW2PYddqmY7U52F+
TLSH
T169C3123078F96AB8085EEC4C324B3D2EAEE6DEDE64D43EC9D8609F0B155F8206563D54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 639a6cc316acb24a67fe21956027733f2c4b63004cd5d74959fe5547ff1d7026
MD5 efea575b2d4dd25635d051cfd59b00e2
SHA1 4933f319ffc78659e8baf3b9425c9b9bdce3a32d
SHA512 b1854e743b6c8818903c920f0e45d0e41cab925cf21ba3c3197f2eaa75e0c94b2bb85d44b85b55ac9a3547c55dd6a3cedf6b27672e0d0ff4f628432e4981e5c4
SSDEEP 3072:o5XQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzIZ:oShxNPRW2PYddqmY7U52F+
TLSH
T164C312307CF96AB8085EEC4C324A3C2E6EE5DEDEA4D43EC9D8609F0B145F8206563D54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 9d0d46a24e8363c12c6be6f008a0c35fe734a8ffa075489d7f0e234531f78922
MD5 035a83fe38bd5230c74ca44072e82366
SHA1 5d4911d85637d41ad746b15b6c6b9a4d113a24f4
SHA512 3554b0cbfc4480fce9716bfab5fa6b2519f7a92ad6a5fc125c7af2ff0a4cf9fb2e15c288f091401811aa061b48de6bca6b9108aea1ced9703967c60d618da0ca
SSDEEP 3072:J0XQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzIZ:BhxNPRW2PYddqmY7U52F+
TLSH
T1F0C3120078F96A78484EEC5C328B3C2EAEF6DED860D83FC1D9A59F0F155BC616263954
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ed54168e9bd9b049b307ad0198c8ff96fedc239690683bbbe954b5b6ccc78d1e
MD5 e13f095bcb4b9c0f4556bd8310cd4c8b
SHA1 6f2ae1857ed820a530bece8a02541eb1eb26db43
SHA512 391fa95533bb7b534e5cf1ef628f7178db1ff4a768c5f98f0211d091434bef89f8aadb2e77a3b24168c58577d469227622dd559bec9b2751e416ce9e380714f1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7N:fwUQC5VwBIiElEd2K57P7N
TLSH
T123B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2025.9.4\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 f27d3cd7b8852d483afbc1fe69ba5bd3c3f9adc92badfa616484b45627ba297f
MD5 1330b1b65cce7426c65c2f7ede5a5e2f
SHA1 d647ec7f4fc6fc7ac0ea0cba235c4b164edb3b54
SHA512 453b8db2286921c663d76d8aa4b449f5292f4c63b75082744933923f82230d250f2f61294ce60af41809b0c0f6b05de5d07538a57c1f0a1aeb1ba13d4026b0a7
SSDEEP 192:njEmZZZZZZZZUUCCCCCCCpppppppppppppTLO:njEmZZZZZZZZUUCCCCCCCppppppppppo
TLSH
T1FBE14C4B82E4C6DA8F0950CB4DA4625C90B23B0DEFDCD508175DDEDD314E99BF8E1AA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 23f9e2cbaf23ec9f802a71d2b4f9d4a5653a87aee8934808fbeb99566ebe8dbb
MD5 a33e8f62d7c653cf19f0e03d7311161c
SHA1 a6de962fa27f7eb7b6ec953159ec46c396f49daf
SHA512 0f9c7ee62151f975c4e9c9daaf16bd5b0895c605b4b89a736d839ac97b25ad42c1b75ffca2eea2a87cd31733a16e9538c71d1334b8b9ebf47734cc12d52987b2
TLSH
T15D613A0A87534CE1F3701173F0AE42463BB1C159FBB78E10A1E484BD772CB6D812652B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5967b9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5967b9.TMP
Size 3KB
SHA256 77af6403b42514b2dc670e03b4c4450838e5ebbd447c69d44de869c85d6e4d22
MD5 aea436313bfa957ff45c357390c233b7
SHA1 3df7ef522dc6f1732ba1922223ba3b3c0a8151be
SHA512 e0c6003beacc4535c176d00cf6dc0d644a3108d28cd37482da384c9594db0107a27f3fd8885a16eb58e3b1b0e5e2c6da8071db35afb6787ae3c56bf787d0b626
TLSH
T165612A0A87534CE1F3701173F4AE42463B71C199FBB79E10A4E484BDB72DB6D816652B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 eeb797cb06f3c42463c55256e29434b7dfa2886ced0ce1b3bd3f517d2241ce92
MD5 eb94a4baae6aeee6232742e8d8db8fbd
SHA1 38d19715a522d470ba44ea25f5c4b4b255363392
SHA512 2048efacccd0e77e4400bd4b12da0db20b108e22977b9afc85cb58d841c71ff905b6b83385752dc935b92d8fa5b275766412008a70197d2d69bdf94c39a90e51
TLSH
T1CE31AFF3C3E8866E894156F0A6187E1BCE1D0914532C3D9AC8E4EF1F97E29B1E14159F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 6c6844b0275e9c946924b6a3202775715152b66d59e50c6edf3c5229b6a0e0cc
MD5 1c0e56f63f8f9dbc09569a2fa3942dcf
SHA1 579cb8206ca637d7fcdb1489c6b94eb76f11ac3d
SHA512 ccf3b94bc4155dc0803917a0f971e9dbd0d37956227b1328c7d72893eb13cb9b347fb8493e6df6b221a9619c52371bf26bb3e91a1c5a86bb9af2a797512ca036
TLSH
T18731D0F3C3E8866EC90192F0AA187E2BCE2D0914432C3D9AC4E4EF1B93E2571E14159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7c5afe0ecb763eb516fef132d15148942b0e2266ea2f3d7b1397766a904aa32c
MD5 30bda86020175334e7807566692f3ef6
SHA1 7b26e2d792a75860036cc395ec62411a93cd033b
SHA512 7746ff248646f32dbbb564d37287d8d5bc42bfc922f1b48aace0ccadde1b63ddc95ee1e205aa457dc921f9130e898da676a697d99b0edc3ca4510b9980dc20ae
SSDEEP 192:sxZbyRQyM/jK1Ml8MmSu/fypsA5S5/jIdpJHW6+WNGYLlHj+ZIg4J:sxZbyquSu/fypsA5S5/8JHbGosc
TLSH
T16A42E8116B349977CCCBD20DBA55BB93D6F50473A2901D58A9FCCA1C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9ed47b525f20e9d927d28971c2a8956273aac6b4049a597267e1a8510eeb8277
MD5 7ec81e4c546d92030f2fbb606e3f516f
SHA1 9f3b0a99ae192a87c3beaef32699a8a28c05d66c
SHA512 3e24d0d4751769a16b3c04f8988e66f9ebeea45cbe6dc67ab86930eb99e54f59833cfbee408c612db7e838bbdbc9d6a596dc03c3a8aaea489a71ba27250db886
SSDEEP 192:sxZzyRQyM/jK1Ml8MjSu/fypsg5G5r/jIdpJHW6+WNGYLeWj+ZIg5UJ:sxZzyqbSu/fypsg5G5T8JHbGEsa
TLSH
T1CF520915AA349977CCDBD20DBA557F93E6F50473A2500D489AFCCA1C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a07fdfb276b4605e9ebd4e0f4f4c9dea82898f14c4252aa7fc729d6ada448987
MD5 9d3a386824765a21ccbc218594a7e733
SHA1 31c92adb1b26361bfe67c6ad43d5f45ff23b1d61
SHA512 31e3115df51214a6186b722c1ee57ff188a0ef1f76b3151ccb61b08ba672650b8f45fbc9c5df3cac7d71df3b89ade1c91412ba33c72ef27e4cdd5f79d16e3816
SSDEEP 192:sxZzyRQyM/jK1Ml8MmSu/fypsg5S5/jIdpJHW6+WNGYLlEj+ZIg5iJ:sxZzyquSu/fypsg5S5/8JHbG1s8
TLSH
T18352F9116B349977CCCBD20DBA557B93E6F90473A2501E58A9FCDA1C04E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c40e01c0694d63a96e7f090a5b555c259191dabb68b55038ed43bdd3280e443e
MD5 ad0b60ac3e92ac0c78db6f19e0f31a4f
SHA1 c6764f0ccc308c2956c21bd7f714def684ef3e53
SHA512 8eafce16a3166626767150c7d2de9ca75376265ab981420271960d9be834e01d2ad1aa2abf165d0171a5adca3a6e5d1e225ef028c0c8d17c971ccf056cdabc74
SSDEEP 192:sxZzyRQyM/jK1Ml8UQCjSu/fypsg5G5r/jIdpLHW6+WNGYLEhA+ZIg5UJ:sxZzyqqaSu/fypsg5G5T8LHbG0sa
TLSH
T1A052F815AA349977CCDBD20DBA557F93E6F50473A2500E48A9FCCA1C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 31e5e07c095f84776f82cc4e4a593291420c0dcc5adba0b1f09dc45879bc57e1
MD5 45c29c4a7a6df2c5e178232b901a1832
SHA1 f8891fa253b5bb7e3f2ebe631e2438b1b2c72559
SHA512 fec27cefb6972e37a2aa5a8f919e11bd50ca3114b5151bd8a5da36d8fce8ddfcd0f8087fd09fea6d7b07d19a1421016ea94cb226daaa4070cccc95f62085b490
SSDEEP 768:ics6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNZrozAa:ics6pD1WvxzWju1jahILIsNSzAa
TLSH
T128D2FA3B680CCB7E4F844E5CAC2AAF967DD801CBAB98895447FA444C03C77EA51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 ee2a8fe1bc553f308a8b02869d88ae8fa23e4398b9cd79d4a07061d6bacf565c
MD5 73eebc35045d071e2271f32681adbea2
SHA1 bb5c6b3b5616c11b48b322a6c1928e72262ff527
SHA512 97ec809ee97113cd3cb9d9cd3188e6934b63a9fd219917116f94c96cce813ee2ba5e7766dd542d4712d985ac2e9de5f6bcbb609ddef9c0048caa2c3b1330c5b5
SSDEEP 96:KUAAKtePGhOKy46CK8K/aMHeKIoWKqsKHq/:ii1Z3CN/Y
TLSH
T109E17B4272BB02123C7E690C929987675F8277633514E42B7BA840F24E7AE341DFD9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a0224.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a0224.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 3894b6c4fc7c07cedd918f1c3795725aa3fc600e3fdecee4cc53613a39814032
MD5 52ef367d57244e13eca3e0883e296ead
SHA1 0f192960874004488bc086f3ad2f8dc619aa80fe
SHA512 46205dc37379973d32137f36c6024769e44022da8a8dfdf137a9ab64dc2460088bf491b6476ab627fc1e59c9b149559dc05ff829ff09d907f6f344a6d6478843
SSDEEP 384:nK7iFAZcIgPAsN48TUNTUlIlvsSxJdyxc29DfQK9pd1HgnTKwBODNZOCs5q:lF+DlwguctKb/gnewBKZObq
TLSH
T100C24A36DCA8DD7BADE29785F64A32478EF041A389D96AD4DADDAE0C00D75DC130BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 4b03e7291ba9defa4bb9adc25d0c5798cd46da51e9204c6ced7dbfc1b501d244
MD5 117e0c07258968d139cbe8bac66f2548
SHA1 2fa6606130b7dce46c76ae46c3f193b49fbc15f6
SHA512 5499bd71258f76c547a0466fe121516aeb2a7814e19f75c8485e1e38240211db6abf5441d92cf51ab1e88c8d7161d186fb38ff976a1721bc5bbcce13d8546ab0
SSDEEP 384:naZcIZAsNDUvsSxJdyxc2a9pd1ignTKwBODNZOCs5q:YqIc3bqgnewBKZObq
TLSH
T1EC928C316C386C7759E2B145F94B32078EB8C1B7E9992F58D6EDAF1C00DB9982307D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 140f84efc68aaa156e4fa68f73b645f12e3b30a896e26c7149d735b2e6672d8e
MD5 a8f90b542ca5c4c74bf3baab40399b56
SHA1 9454b925a7a230ce17aa9251877ea9795a1b8eca
SHA512 b24c38d8b8a864f3018df94309130b07f87d07df77fd3ab7b744e2db448e3420f109d1fb890ac92e07415aefbf2ff9d86b8a340f9ef41dcea8b35a41caf30524
SSDEEP 192:qON66O7+3hQmiUyUiGttb0/+Fd1DgG3iU6:qON661eGt9pd1HyU6
TLSH
T19402E63968782CB78AF2AD49F68737175FA5117BE9A62F40DAE85E0C00D765C2343827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2b528a9831cc6da25027e7680349576768f4281ce13174e86d19eaeec28ef7b4
MD5 9ee67cd04b830974e3e0d63616f2080a
SHA1 d64607359e27905e8a0d741955caa026f1a28c3b
SHA512 dede32e63255356aa6b21d70137346f8d5cda3a063985308e3bea34e5161db52e5bd4e7f50e4cc2ef24269dcb9a618a9e6a4969311e82e907778cb2fb33da915
SSDEEP 192:QONR6O7+3HQmiUySi5ttb0/+Fd15GScNrqwqU6:QONR6ve5t9pd1OgU6
TLSH
T1C01219356878AC775EA2A445F58731179FA581B7DE8A7F80D5EC6E0C00DF9AC2306C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 60f95c35dc657a832cf7723b09c84e8b6fa7632b939f88a92f87b065f89dcd25
MD5 2adcbf8efc2263c469ca686d987ff512
SHA1 121ff19294cfc2746bfaa0055b496476c2e18e83
SHA512 77fbe9c7f95b18ffccb69aa57c3ce86ad428df7f632262eb7dc0f62b1b0723d0c68e15efe94a8db846cd2068b6693843f761936d777acb1ac6554767871a9a1f
SSDEEP 192:zCnsNDU9QZD2yYxi7+3vdqGxQmiU1hek4atb0/+Fd15GFLMrqwqU8:z4sNDU9sSxJd76ba9pd19gU8
TLSH
T16C323A366878AC775AE2A144F54B36039FB481B7D98A3F84D5EC9F1C00DB9AC2317917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 45f6e08488d3df2761a1b6584fd61b01c67c69f50a3ce7a3fe8ccc1a25ff14f5
MD5 548b12c20551b9e3d2584857bbebc7bd
SHA1 ee719812972e144193c68596a0d7fb4cc1fd127d
SHA512 affd55ba15503ee2776ae6ea340831aad9f842596b6275fe029f640ac5fdae52c9a5eaccfb8d38aa6c7a56557f7f7bae9459f33ff18ef593f0efa26793a2fb2f
SSDEEP 192:uuCZAsNDUYqQZD2yYxi7+3vdqjQmiU1sec8Batb0/+Fd15GkLMrqwqU8:nWAsNDUxsSxJdyxc2a9pd1igU8
TLSH
T14C422A366C78AC7759A3A144F54B36039FB481B7D98A3F84D6EC9F1C00DBAAC2316917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c28d0e31e8acdb94842f206ae976a67afcf3b59a968dbdcb8130e5cf2834f292
MD5 951fe54202fd8b543e308f94ade3f2c4
SHA1 d763897819f7b107486c0dfc825be9283baaa033
SHA512 e11b688301ff4bec77b6da11aef4859356407403bef8f9c4bb4644a8eb1108eaeb94ea375c6f914d46a70cfd8351c1ec1ebba2604c7d86ae845831efbdfaf9df
SSDEEP 192:uuzZAsNDUYdQZD2yYxi7+3vdqjQmiU1sec8Batb0/+Fd15GkLMrqwqU8:ndAsNDUIsSxJdyxc2a9pd1igU8
TLSH
T1D0422A366C78AC7759A3A144F14B36039FB481B7D98A2F84D6EC9F1C00DBAAC2317917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 e5b9006304831e59aaade78cc2d6bb690f57196122be7c4c2e226932267c1912
MD5 b8d0dc5c9d637faafdf8ced73b86878e
SHA1 2de825f98c57846772c11cd1365d21fc67aa693c
SHA512 2dd4d7e19cac2895a6f6a49f5c45536f8a83981eae9898ca2f87fd439c025b679da92dc848493153ea7b115fa471edb028aaa469d213454bdc2f386bf1af0770
SSDEEP 192:zCWsNDU9QZD2yYxi7+3vdq4QmiU1zec8Batb0/+Fd15GFLMrqwqU8:z1sNDU9sSxJdTUc2a9pd19gU8
TLSH
T1E7323B366878AC775AE2A144F54B36039FB481B7D98A3F84D5EC9F1C00DB9AC2317917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.8.3.1\keys.json
Size 8KB
SHA256 3d6c659801f1686ff3ac64bc3b24b1d0ae76ffdd5f0e9c399ba37d1354a15ab4
MD5 ee666d1b2290efa6cdbc89ea3d317333
SHA1 a8bdd2c1d7e76fef48a735a80524243cd453e0bc
SHA512 7b2b577c9a168f626a687ee158cc20fa0ad0f816fb0583abfe45f89222d1762eb4fc619e029856618479fb6096a02eb2f9934cb46334fa781cea5cbcec992ee9
SSDEEP 192:uNtGbR0m0GflPAyR9Pm4lOvMwkoR9PuGMXcy:O7mZpKjA
TLSH
T17F02B6BF14A41182CE7FC16D9F0774B78FB03C066BCA3A83925BEA49484196D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 cc631188ae4a22c0621e596be3d4335218373ee3aafe98bb7b213069a0dc3b70
MD5 1a8162cc03c34509f59ea81728419884
SHA1 459f726ff17ed37a212bf5291cc592b4745c3c06
SHA512 129393fb77432dda8e2c4181dc778f609f56572e69213f9f8cffc544b845119929242d41078170b2dc72a678116df340544edb181c2aff069f8cd4ac2a541083
TLSH
T1E8011ED14C7E1AC7CABE0EAEA0872BEC44D86522B098347818CCF864917940E3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 4d2b47e594a4d5d9d0c079c2ff5fac0e47e26ffad46c371ad51e472b3dcd0669
MD5 54b0cf5610d4cbeadf10f35941bea007
SHA1 8bcec79787775ec6c2625b88611eb0de385e393b
SHA512 3f6d82da490f1b52647d9f376be4aa3159f57072ad2b52a048895bf7f53255d860bc12cc4b5af53cf9d9ce8c76cfab722e47cef3b58fa776a8ffd7e991630253
TLSH
T1841184D00C7F1AC7C6BE0E6FA0872AED40C8A622F09830381CCCF964917901D3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 68dd4a6a0b1711003690c2995fd0b77ba3c9ae6c27dd853ff492b52bd7701bc5
MD5 bc900814bda342e30ca622ecf6edf1a1
SHA1 58549077a989da91156012baf9dbfc98ecfe429d
SHA512 c918bfea1c94a06e69e13a1edffa87e69fd698fc8ddf310fc5545d1e2a80613e7617e19110e5496fa91c8e8037bc67a81e300b571bebefb407ab16a384d97fa1
TLSH
T124111FD11C7E1AC6C6BE0E6FA4833AFD40D8A622F4E8307818C8E964927951E2451C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
MD5 87299a8105078d6252386ba9d333ff05
SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
TLSH
T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
MD5 SHA1 SHA512 TLSH

Submit Download

2026b776-887c-417f-9c2a-262894cbb24e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2026b776-887c-417f-9c2a-262894cbb24e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

35f49dc6-01c4-4a4a-ab6a-aeb79989af1d.tmp

Path C:\Users\Admin\AppData\Local\Temp\35f49dc6-01c4-4a4a-ab6a-aeb79989af1d.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7927749b-ade5-4929-96d1-5cf55228b28b.tmp

Path C:\Users\Admin\AppData\Local\Temp\7927749b-ade5-4929-96d1-5cf55228b28b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

AutoIt3.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\AutoIt3.exe
Size 1.0MB
SHA256 92c6531a09180fae8b2aae7384b4cea9986762f0c271b35da09b4d0e733f9f45
MD5 8fa52f316c393496f272357191db6deb
SHA1 b1ff3d48a3946ca7786a84e4a832617cd66fa3b9
SHA512 c81da97d6980d6a5aa612070477950a1386239bb919e762f7870bccd459a03da48f8f169910b91f3827c6cfef50471569c9e0c9ff2ceb897904d81840c087d51
SSDEEP 24576:5TC6Rb6qu1PyC+NRLtpScpzbtT7pyOolKL8Sq/jrc5xaNIBB:5+6AqSPyC+NltpScpzbtvpJoMQSq/jre
TLSH
T1FC357D0A23A4419EFEA7F176D617C60BD7B1784A0376962F02A46B726F337711A1E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Exists.a3x

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Exists.a3x
Size 1.0MB
SHA256 1e9f2e28ede5c8f897cd827fbdec5770ae0365328d2473e9a003f3efaba5efc6
MD5 f7016faf30f56ea94afb21854905c071
SHA1 2efe0b45a49ae2fb1b561e18f2383e2b5a21002a
SHA512 cf11ebafa46379b7174417c581fb857cb6e3c4d9eb4d75a1810bcee9d854f6281c93479affc69ad3a628b12f81874fcc710b087a778ef6df18125c13e576a276
SSDEEP 24576:g+M8piSledONv4Ws0IxSdWy/1yOsNtjoWkxZIdmZif/3dVOvg9u:xpFe2gcoSsy/1yOsNtjoPICifyvg9u
TLSH
T167353317321165A88156FEE2F1BF042A314F0ECC10D9153A3ADBDE5E364E69B50AFAC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba50c69c-ecd5-47fc-a7cb-77f4a924d664.tmp

Path C:\Users\Admin\AppData\Local\Temp\ba50c69c-ecd5-47fc-a7cb-77f4a924d664.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir348_1122741766\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resource_53.bin

Path C:\Users\Admin\Downloads\resource_53.bin
Size 578KB
SHA256 72fd906603d88838c343ead5d3bcf0e143eeb08a628659e263fbf647f43e30de
MD5 4e87d50d712d2c036959de7083faf006
SHA1 b64fb9d990b9d782663a66c0fa4c53754efc62ed
SHA512 99111e296a412f944d46bf70b14528dd78c73da4720233b0e28c79a058a9a476bdaa5463a16c8f90b3bc53131ca47b3c107d85aa410244cac7d94eccb9b6b6db
SSDEEP 12288:oj40Fvs1bERqIB5SoWxzpflHRhiHCTa2TlVfKGl/Vj63SeXIe:T0Fvs1bERqIB8zxluCThxVf7d63Sex
TLSH
T10DC433A4A4D92FD509C52972C736342B7DC9F617E25D222323AB7F34D92A270B2FB405
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/632-1755-0x0000024CED560000-0x0000024CED5B2000-memory.dmp

Download

memory/632-1754-0x0000024CED560000-0x0000024CED5B2000-memory.dmp

Download

memory/740-1846-0x00007FF92D5D0000-0x00007FF92D7C5000-memory.dmp

Download

memory/744-1819-0x0000025B28A70000-0x0000025B28AC2000-memory.dmp

Download

memory/744-1820-0x0000025B28A70000-0x0000025B28AC2000-memory.dmp

Download

memory/2616-1662-0x00007FF92D5D0000-0x00007FF92D7C5000-memory.dmp

Download

memory/2616-1688-0x000002147C480000-0x000002147C481000-memory.dmp

Download

memory/2656-2953-0x000001D1754C0000-0x000001D175512000-memory.dmp

Download

memory/2656-2954-0x000001D1754C0000-0x000001D175512000-memory.dmp

Download

memory/3048-1798-0x00007FF92D5D0000-0x00007FF92D7C5000-memory.dmp

Download

memory/3412-2952-0x00000165B6AB0000-0x00000165B6B02000-memory.dmp

Download

memory/3412-2951-0x00000165B6AB0000-0x00000165B6B02000-memory.dmp

Download

memory/4172-1867-0x000001F164620000-0x000001F164672000-memory.dmp

Download

memory/4172-1866-0x000001F164620000-0x000001F164672000-memory.dmp

Download

memory/4512-1812-0x00007FF92D5D0000-0x00007FF92D7C5000-memory.dmp

Download

memory/4616-1839-0x000001F3D9E50000-0x000001F3D9EA2000-memory.dmp

Download

memory/4616-1840-0x000001F3D9E50000-0x000001F3D9EA2000-memory.dmp

Download

memory/4720-2930-0x00007FF92D5D0000-0x00007FF92D7C5000-memory.dmp

Download

memory/4884-2936-0x00007FF92D5D0000-0x00007FF92D7C5000-memory.dmp

Download

memory/5084-1695-0x000002152E310000-0x000002152E362000-memory.dmp

Download

memory/5084-1689-0x000002152E310000-0x000002152E362000-memory.dmp

Download

memory/5084-1694-0x000002152E310000-0x000002152E362000-memory.dmp

Download

memory/5084-1697-0x000002152E310000-0x000002152E362000-memory.dmp

Download

memory/5380-1760-0x00000232F6CF0000-0x00000232F6D42000-memory.dmp

Download

memory/5380-1759-0x00000232F6CF0000-0x00000232F6D42000-memory.dmp

Download

memory/5748-1719-0x00007FF92D5D0000-0x00007FF92D7C5000-memory.dmp

Download

memory/6060-1725-0x00007FF92D5D0000-0x00007FF92D7C5000-memory.dmp

Download