Overview

overview

8

Static

static

3

composer.dat.exe

windows10-2004-x64

8

Resubmissions

09/08/2026, 19:53

260809-ymfjtscc258

09/08/2026, 19:53

260809-yl61dsxzfy8

Analysis

  • user interaction
    yes
  • max time kernel
    170s
  • max time network
    172s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/08/2026, 19:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    composer.dat.exe
  • Size 13.6MB
  • Sample260809-ymfjtscc25
  • SHA256 633af775e71f8752dc4ea4ec64bbbb79ded0004cc4ef13b074a54f1d7321096f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutioninstallerspywaretrojan

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 27 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Probable phishing domain 1 TTPs 1 IoCs
  • Drops file in Program Files directory 51 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 12 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 3 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\composer.dat.exe
    "C:\Users\Admin\AppData\Local\Temp\composer.dat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1304
    • C:\Users\Admin\AppData\Local\Temp\composer.dat.exe
      "C:\Users\Admin\AppData\Local\Temp\composer.dat.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4660
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
        3⤵
        • Executes a command shell one-liner
        PID:2888
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of AdjustPrivilegeToken
          PID:5640
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\cosojad'""
        3⤵
        • Executes a command shell one-liner
        PID:3836
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\cosojad'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of AdjustPrivilegeToken
          PID:5244
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
        3⤵
        • Executes a command shell one-liner
        PID:5708
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of AdjustPrivilegeToken
          PID:4144
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
        3⤵
        • Executes a command shell one-liner
        PID:4444
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of AdjustPrivilegeToken
          PID:4136
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
        3⤵
        • Executes a command shell one-liner
        PID:3292
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of AdjustPrivilegeToken
          PID:4376
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
        3⤵
        • Executes a command shell one-liner
        PID:6116
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of AdjustPrivilegeToken
          PID:3328
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
        3⤵
        • Executes a command shell one-liner
        PID:6072
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of AdjustPrivilegeToken
          PID:5532
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
        3⤵
        • Executes a command shell one-liner
        PID:896
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of AdjustPrivilegeToken
          PID:1148
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
        3⤵
        • Executes a command shell one-liner
        PID:556
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of AdjustPrivilegeToken
          PID:2172
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
        3⤵
        • Executes a command shell one-liner
        PID:1652
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of AdjustPrivilegeToken
          PID:1088
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
        3⤵
        • Executes a command shell one-liner
        PID:3380
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of AdjustPrivilegeToken
          PID:4232
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
        3⤵
        • Executes a command shell one-liner
        PID:5296
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of AdjustPrivilegeToken
          PID:4864
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1420
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch
      2⤵
      • Drops file in Program Files directory
      • Checks SCSI registry key(s)
      • Checks processor information in registry
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2176
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7ff80f7bc188,0x7ff80f7bc194,0x7ff80f7bc1a0
        3⤵
          PID:760
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,7658811366823635763,13654495803020359319,524288 --field-trial-handle=2332,i,7016001719399248240,15694896892503849455,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
          3⤵
          • Downloads MZ/PE file
          • System Time Discovery
          PID:3372
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1776,i,5201369340105016932,10183220077771006629,262144 --field-trial-handle=2332,i,7016001719399248240,15694896892503849455,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
          3⤵
            PID:3468
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2520,i,12139106194382500784,10902728661602464908,524288 --field-trial-handle=2332,i,7016001719399248240,15694896892503849455,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
            3⤵
              PID:1408
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,1586977885808306392,15898317464677673726,2097152 --field-trial-handle=2332,i,7016001719399248240,15694896892503849455,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
              3⤵
                PID:3804
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,957330420908315727,6687272560332799517,2097152 --field-trial-handle=2332,i,7016001719399248240,15694896892503849455,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
                3⤵
                  PID:5076
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,11418217817457104666,17037994338706918453,2097152 --field-trial-handle=2332,i,7016001719399248240,15694896892503849455,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
                  3⤵
                    PID:4024
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,7757880931246699891,6781069353060484465,2097152 --field-trial-handle=2332,i,7016001719399248240,15694896892503849455,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
                    3⤵
                      PID:3888
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,17271264005932176653,2465828467584214070,524288 --field-trial-handle=2332,i,7016001719399248240,15694896892503849455,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
                      3⤵
                        PID:4208
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,11848169053771298819,5980867604909475904,524288 --field-trial-handle=2332,i,7016001719399248240,15694896892503849455,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
                        3⤵
                          PID:1276
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,2838951950723205095,10620277249506306934,524288 --field-trial-handle=2332,i,7016001719399248240,15694896892503849455,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:8
                          3⤵
                            PID:1780
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,4463213161607924128,4959929240997826771,524288 --field-trial-handle=2332,i,7016001719399248240,15694896892503849455,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8
                            3⤵
                              PID:3380
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6028,i,15407722672281846734,11578030074317949002,2097152 --field-trial-handle=2332,i,7016001719399248240,15694896892503849455,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:1
                              3⤵
                                PID:1744
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6304,i,12496572289881280265,2911894304971248950,2097152 --field-trial-handle=2332,i,7016001719399248240,15694896892503849455,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:1
                                3⤵
                                  PID:3148
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6480,i,1634685452599833381,6991791203749203675,2097152 --field-trial-handle=2332,i,7016001719399248240,15694896892503849455,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:1
                                  3⤵
                                    PID:1808
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6648,i,3929356892445986525,15506815028658212755,2097152 --field-trial-handle=2332,i,7016001719399248240,15694896892503849455,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:1
                                    3⤵
                                      PID:556
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6784,i,12182940439471202117,17768027144453410086,2097152 --field-trial-handle=2332,i,7016001719399248240,15694896892503849455,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:1
                                      3⤵
                                        PID:5180
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,7259274721199444958,3817936193809104663,524288 --field-trial-handle=2332,i,7016001719399248240,15694896892503849455,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:8
                                        3⤵
                                          PID:5420
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6816,i,2237817565085137973,13892795296119954493,2097152 --field-trial-handle=2332,i,7016001719399248240,15694896892503849455,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:1
                                          3⤵
                                            PID:5436
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,7259274721199444958,3817936193809104663,524288 --field-trial-handle=2332,i,7016001719399248240,15694896892503849455,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:8
                                            3⤵
                                              PID:5444
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7388,i,5755914003116152994,7853758487659743206,524288 --field-trial-handle=2332,i,7016001719399248240,15694896892503849455,262144 --variations-seed-version --mojo-platform-channel-handle=7404 /prefetch:8
                                              3⤵
                                                PID:5824
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7376,i,2720316693012185262,9533539426153414398,524288 --field-trial-handle=2332,i,7016001719399248240,15694896892503849455,262144 --variations-seed-version --mojo-platform-channel-handle=7780 /prefetch:8
                                                3⤵
                                                  PID:5896
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7432,i,8150965910849700701,17017517692710677769,524288 --field-trial-handle=2332,i,7016001719399248240,15694896892503849455,262144 --variations-seed-version --mojo-platform-channel-handle=7180 /prefetch:8
                                                  3⤵
                                                    PID:5572
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7476,i,5101997006682343945,4745744780929530101,524288 --field-trial-handle=2332,i,7016001719399248240,15694896892503849455,262144 --variations-seed-version --mojo-platform-channel-handle=7740 /prefetch:8
                                                    3⤵
                                                      PID:5604
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3488,i,9277377818030498811,14888702947252331898,524288 --field-trial-handle=2332,i,7016001719399248240,15694896892503849455,262144 --variations-seed-version --mojo-platform-channel-handle=7424 /prefetch:8
                                                      3⤵
                                                        PID:1928
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6660,i,263768923000624208,17720504890622244628,2097152 --field-trial-handle=2332,i,7016001719399248240,15694896892503849455,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:1
                                                        3⤵
                                                          PID:4396
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7748,i,11017897689902519487,6316739559129724422,2097152 --field-trial-handle=2332,i,7016001719399248240,15694896892503849455,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:1
                                                          3⤵
                                                            PID:5608
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5348,i,9500533841611697403,2246699811697151900,2097152 --field-trial-handle=2332,i,7016001719399248240,15694896892503849455,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1
                                                            3⤵
                                                              PID:5332
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6900,i,664623434959890500,10450478518325687382,524288 --field-trial-handle=2332,i,7016001719399248240,15694896892503849455,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:8
                                                              3⤵
                                                                PID:628
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6912,i,15098441917088362190,18416007624169816571,2097152 --field-trial-handle=2332,i,7016001719399248240,15694896892503849455,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:1
                                                                3⤵
                                                                  PID:1724
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7120,i,7563636424984171366,11942775425989607968,524288 --field-trial-handle=2332,i,7016001719399248240,15694896892503849455,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:8
                                                                  3⤵
                                                                    PID:5616
                                                                  • C:\Users\Admin\Downloads\processhacker-2.39-setup.exe
                                                                    "C:\Users\Admin\Downloads\processhacker-2.39-setup.exe"
                                                                    3⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:5452
                                                                    • C:\Users\Admin\AppData\Local\Temp\is-8KBTB.tmp\processhacker-2.39-setup.tmp
                                                                      "C:\Users\Admin\AppData\Local\Temp\is-8KBTB.tmp\processhacker-2.39-setup.tmp" /SL5="$9011C,1874675,150016,C:\Users\Admin\Downloads\processhacker-2.39-setup.exe"
                                                                      4⤵
                                                                      • Executes dropped EXE
                                                                      • Drops file in Program Files directory
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of FindShellTrayWindow
                                                                      PID:5548
                                                                      • C:\Program Files\Process Hacker 2\ProcessHacker.exe
                                                                        "C:\Program Files\Process Hacker 2\ProcessHacker.exe"
                                                                        5⤵
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        • Checks processor information in registry
                                                                        • Modifies system certificate store
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious behavior: GetForegroundWindowSpam
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        • Suspicious use of FindShellTrayWindow
                                                                        • Suspicious use of SendNotifyMessage
                                                                        PID:5348
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,14389656890252360485,17300889185774673305,524288 --field-trial-handle=2332,i,7016001719399248240,15694896892503849455,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
                                                                    3⤵
                                                                      PID:5668
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,15687672755886369865,14909677094383489689,524288 --field-trial-handle=2332,i,7016001719399248240,15694896892503849455,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:8
                                                                      3⤵
                                                                        PID:5748
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,8633488378295429262,2692992643771039632,524288 --field-trial-handle=2332,i,7016001719399248240,15694896892503849455,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:8
                                                                        3⤵
                                                                          PID:5732
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,4084029682039447766,1414420573558163737,524288 --field-trial-handle=2332,i,7016001719399248240,15694896892503849455,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:8
                                                                          3⤵
                                                                            PID:3796
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7004,i,15149761049500091345,11842964608376530362,524288 --field-trial-handle=2332,i,7016001719399248240,15694896892503849455,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:8
                                                                            3⤵
                                                                              PID:5076
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1228,i,5467085790094723686,17532653052293237649,524288 --field-trial-handle=2332,i,7016001719399248240,15694896892503849455,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
                                                                              3⤵
                                                                                PID:5668
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7436,i,15772144857566734617,17656461940508661775,524288 --field-trial-handle=2332,i,7016001719399248240,15694896892503849455,262144 --variations-seed-version --mojo-platform-channel-handle=7472 /prefetch:8
                                                                                3⤵
                                                                                  PID:4484
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7076,i,8546305867136996772,11218316349545048908,262144 --field-trial-handle=2332,i,7016001719399248240,15694896892503849455,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
                                                                                  3⤵
                                                                                    PID:6112
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,4255439725916003128,11628787018646940117,524288 --field-trial-handle=2332,i,7016001719399248240,15694896892503849455,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
                                                                                    3⤵
                                                                                      PID:5880
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                  1⤵
                                                                                    PID:3776
                                                                                  • C:\Program Files\Process Hacker 2\kprocesshacker.sys
                                                                                    "C:\Program Files\Process Hacker 2\kprocesshacker.sys"
                                                                                    1⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:5212

                                                                                  Network

                                                                                        MITRE ATT&CK Enterprise v16

                                                                                        Replay Monitor

                                                                                        Loading Replay Monitor...

                                                                                        Downloads

                                                                                        ProcessHacker.exe
                                                                                        • Path C:\Program Files\Process Hacker 2\ProcessHacker.exe
                                                                                        • Size 1.6MB
                                                                                        • SHA256 bd2c2cf0631d881ed382817afcce2b093f4e412ffb170a719e2762f250abfea4
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        manifest.json
                                                                                        • Path C:\Program Files\chrome_Unpacker_BeginUnzipping2176_102172910\manifest.json
                                                                                        • Size 160B
                                                                                        • SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                        Submit Download

                                                                                        manifest.json
                                                                                        • Path C:\Program Files\chrome_Unpacker_BeginUnzipping2176_1024961991\manifest.json
                                                                                        • Size 165B
                                                                                        • SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                        Submit Download

                                                                                        manifest.json
                                                                                        • Path C:\Program Files\chrome_Unpacker_BeginUnzipping2176_1716612722\manifest.json
                                                                                        • Size 43B
                                                                                        • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        manifest.json
                                                                                        • Path C:\Program Files\chrome_Unpacker_BeginUnzipping2176_867595789\manifest.json
                                                                                        • Size 135B
                                                                                        • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                        Submit Download

                                                                                        blocklist
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                                        • Size 105KB
                                                                                        • SHA256 26374662fab280ef96eaa929fd16d9c29e3f74bff1e5cdf49f3940b212c74426
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        protocols.json
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
                                                                                        • Size 3KB
                                                                                        • SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                        Submit Download

                                                                                        settings.dat
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                        • Size 280B
                                                                                        • SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                        Submit Download

                                                                                        settings.dat
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                        • Size 280B
                                                                                        • SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                        Submit Download

                                                                                        BookmarkMergedSurfaceOrdering
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                        • Size 6B
                                                                                        • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        f_0000a9
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a9
                                                                                        • Size 24KB
                                                                                        • SHA256 f254eb93b015455a3c89aaf970631bc989fe2bd387f79e871b514992359651aa
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        f_0000ab
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ab
                                                                                        • Size 41KB
                                                                                        • SHA256 0e2e6d1994902577a3d3a7f0e37875dd22de26342bec8403ebe262f92f2eddd7
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        f_0000ad
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ad
                                                                                        • Size 24KB
                                                                                        • SHA256 a3cf4861c7d0c966f0ed6564f6aad6b28cbd3421a9ca4f60e2246848d249f196
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        f_0000ae
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ae
                                                                                        • Size 77KB
                                                                                        • SHA256 61062d5944196e9444b784c6a80652a8c1499b26c5fdbbe8f4be83ad72198972
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        the-real-index
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                        • Size 6KB
                                                                                        • SHA256 776364860b3b795373f5cbb8a5cbecf1fee4bbf7dc3b40cdda514a347275c3f0
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        the-real-index~RFe593975.TMP
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593975.TMP
                                                                                        • Size 3KB
                                                                                        • SHA256 9f25da07f44faef7ddc4998fef6be6e38172f4d737d6d07c2eb04a7d9996ce74
                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                        Submit Download

                                                                                        SiteList-Enterprise.json
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                        • Size 2B
                                                                                        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        Edge Profile.ico
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                        • Size 70KB
                                                                                        • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        Network Persistent State
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                        • Size 6KB
                                                                                        • SHA256 720b7a8188f7f1be981a7a33ff9496ac7efd3e25c31509043a513eb92a9d6c8f
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        Network Persistent State
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                        • Size 111B
                                                                                        • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                        Submit Download

                                                                                        SCT Auditing Pending Reports
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                        • Size 2B
                                                                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        Preferences
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                        • Size 16KB
                                                                                        • SHA256 1653be4ef197662ae5dd71c5100cb55299413d3bfaddf00b5e5d0e12578f2383
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        Preferences
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                        • Size 18KB
                                                                                        • SHA256 46b209fd0e24d3845247bb387888e15913c5f4dd5d208727180d812059f716dc
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        Preferences
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                        • Size 17KB
                                                                                        • SHA256 b48f25eb7ed2065aa58367937b5b06b563d12078b27b571353be24a30da26154
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        Secure Preferences
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                        • Size 30KB
                                                                                        • SHA256 aebae306c5e3a038af5c7f512d14dc1f45b7adab5efefd984b14a1445f1f504f
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        the-real-index
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
                                                                                        • Size 1KB
                                                                                        • SHA256 3b630db08128475689adc7c3327ddc402ca39c85e072c57d198837258cae5705
                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                        Submit Download

                                                                                        the-real-index~RFe583f56.TMP
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index~RFe583f56.TMP
                                                                                        • Size 1KB
                                                                                        • SHA256 0856c2d814960476320c877aa0541d83d437a01ff1cc84d821422b54cc5e0aa7
                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                        Submit Download

                                                                                        index.txt
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                        • Size 371B
                                                                                        • SHA256 2a0afe4d8c1725449da95ce96386564f383f355e2c2febce4057c63b82a195db
                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                        Submit Download

                                                                                        the-real-index
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
                                                                                        • Size 72B
                                                                                        • SHA256 cc836ddc92d473e0945f9dfdb70fc18c069e218da56b5b87ad4bcc25e14dca66
                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                        Submit Download

                                                                                        sync_diagnostic.log
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                        • Size 4KB
                                                                                        • SHA256 f4ed37a88d7198c06bbe3923b6bf5c23189bfb26d2cbdc05744332b222234c33
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        a1f4d40b-0f27-479a-af16-7a94732cda0e.tmp
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a1f4d40b-0f27-479a-af16-7a94732cda0e.tmp
                                                                                        • Size 22KB
                                                                                        • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        office_endpoints_list.json
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
                                                                                        • Size 9KB
                                                                                        • SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        Local State
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                        • Size 8KB
                                                                                        • SHA256 51921850c1cec0006b7f545b2f87e9e881be3548f8356bb7684d4e0573fc2886
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        Local State
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                        • Size 15KB
                                                                                        • SHA256 3d97229e415b5c4219b18682cb3d615ca04494b06ca03951f3ebab954e7e867c
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        Local State
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                        • Size 15KB
                                                                                        • SHA256 660dd4a94edc0234fb66ca63731eae16db6ba4cd452a91795693da8985f3996d
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        Local State
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                        • Size 9KB
                                                                                        • SHA256 2a41ba531ae260c024ee9d30736df9a29bfdde2f1854cef4e3ee4b1e3c619a84
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        Local State
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                        • Size 21KB
                                                                                        • SHA256 9b657b86d3c360642ed379b5e15ca108a71b200a8886401f26c32c7f3bb1c2fa
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        RevisitationBloomfilter
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                        • Size 392B
                                                                                        • SHA256 2a1a6fef0ba21ce0b8f08c59cb7fe7ba37617986683e9ac9da5267c6c73633ca
                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                        Submit Download

                                                                                        RevisitationBloomfilter
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                        • Size 392B
                                                                                        • SHA256 82b159fa17d736f9ee466f4cdaa4351d9fafb14e742472f04859a51796f03272
                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                        Submit Download

                                                                                        RevisitationBloomfilter~RFe58d424.TMP
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58d424.TMP
                                                                                        • Size 392B
                                                                                        • SHA256 39748ccfd611afbd70197d99ac260a581e02b094f458a90fd9e9f5a1d99a2960
                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                        Submit Download

                                                                                        nav_config.json
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
                                                                                        • Size 2KB
                                                                                        • SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                        Submit Download

                                                                                        metadata.json
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                        • Size 132B
                                                                                        • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                        Submit Download

                                                                                        metadata.json
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                        • Size 252B
                                                                                        • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                        Submit Download

                                                                                        metadata.json
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                        • Size 372B
                                                                                        • SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                        Submit Download

                                                                                        metadata.json
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                        • Size 492B
                                                                                        • SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                        Submit Download

                                                                                        7bc6cc59-11cc-49e2-b933-558c387c55d9.tmp
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7bc6cc59-11cc-49e2-b933-558c387c55d9.tmp
                                                                                        • Size 13B
                                                                                        • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                        • Size 2KB
                                                                                        • SHA256 7965d4649e23cf91947e973160b389bba9094a0cdece82442d62d4c29ddb395d
                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                        Submit Download

                                                                                        9362ef1b-9880-46a5-9f17-4631663461e7.tmp
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\9362ef1b-9880-46a5-9f17-4631663461e7.tmp
                                                                                        • Size 1B
                                                                                        • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        VCRUNTIME140.dll
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13042\VCRUNTIME140.dll
                                                                                        • Size 117KB
                                                                                        • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        VCRUNTIME140_1.dll
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13042\VCRUNTIME140_1.dll
                                                                                        • Size 48KB
                                                                                        • SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        _bz2.pyd
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13042\_bz2.pyd
                                                                                        • Size 82KB
                                                                                        • SHA256 fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        _ctypes.pyd
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13042\_ctypes.pyd
                                                                                        • Size 128KB
                                                                                        • SHA256 f63c6c7e71c342084d8f1a108786ca6975a52cefef8be32cc2589e6e2fe060c8
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        _decimal.pyd
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13042\_decimal.pyd
                                                                                        • Size 271KB
                                                                                        • SHA256 b715d1c18e9a9c1531f21c02003b4c6726742d1a2441a1893bc3d79d7bb50e91
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        _hashlib.pyd
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13042\_hashlib.pyd
                                                                                        • Size 62KB
                                                                                        • SHA256 838d5c8b7c3212c8429baf612623abbbc20a9023eec41e34e5461b76a285b86c
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        _lzma.pyd
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13042\_lzma.pyd
                                                                                        • Size 154KB
                                                                                        • SHA256 d080eabd015a3569813a220fd4ea74dff34ed2a8519a10473eb37e22b1118a06
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        _matlab.py
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13042\_matlab.py
                                                                                        • Size 499KB
                                                                                        • SHA256 be2f6e59a7a7d3fe8f2b2db55432d368560a6d87c4ea39c4e5b0c022c262dedf
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        _socket.pyd
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13042\_socket.pyd
                                                                                        • Size 81KB
                                                                                        • SHA256 35246b04c6c7001ca448554246445a845ce116814a29b18b617ea38752e4659b
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        _uuid.pyd
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13042\_uuid.pyd
                                                                                        • Size 25KB
                                                                                        • SHA256 f9d5008f0772aa0720bc056a6ecd5a2a3f24965e4b470b022d88627a436c1ffe
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        _wmi.pyd
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13042\_wmi.pyd
                                                                                        • Size 37KB
                                                                                        • SHA256 6435c679a3a3ff4f16708ebc43f7ca62456c110ac1ea94f617d8052c90c143c7
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        base_library.zip
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13042\base_library.zip
                                                                                        • Size 1.3MB
                                                                                        • SHA256 34173b55d6603ecc22d226b937ded994d4add3c613ac3deb4fbfad41c50e77ee
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        libcrypto-3.dll
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13042\libcrypto-3.dll
                                                                                        • Size 5.0MB
                                                                                        • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        libffi-8.dll
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13042\libffi-8.dll
                                                                                        • Size 38KB
                                                                                        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        _psutil_windows.pyd
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13042\psutil\_psutil_windows.pyd
                                                                                        • Size 69KB
                                                                                        • SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        pyarmor_runtime.pyd
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13042\pyarmor_runtime_000000\pyarmor_runtime.pyd
                                                                                        • Size 625KB
                                                                                        • SHA256 cecef9ba5bd95705698de00e9f36e9dc74bf89671838b5d49a4544cdea7ade0e
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        python3.dll
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13042\python3.dll
                                                                                        • Size 68KB
                                                                                        • SHA256 a5c6a329698490a035133433928d04368ce6285bb91a9d074fc285de4c9a32a4
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        python313.dll
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13042\python313.dll
                                                                                        • Size 5.8MB
                                                                                        • SHA256 0c0a66505093b6a4bb3475f716bd3d9552095776f6a124709c13b3f9552c7d99
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        select.pyd
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13042\select.pyd
                                                                                        • Size 30KB
                                                                                        • SHA256 78e5994c29d8851f28b5b12d59d742d876683aea58eceea1fb895b2036cdcdeb
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        unicodedata.pyd
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13042\unicodedata.pyd
                                                                                        • Size 693KB
                                                                                        • SHA256 2693c7ee4fba55dc548f641c0cb94485d0e18596ffef16541bd43a5104c28b20
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        __PSScriptPolicyTest_ouhthbpu.nhk.ps1
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ouhthbpu.nhk.ps1
                                                                                        • Size 60B
                                                                                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                        Submit Download

                                                                                        d62bf66f-2710-4ad0-9035-ffcca6fdee17.tmp
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\d62bf66f-2710-4ad0-9035-ffcca6fdee17.tmp
                                                                                        • Size 153KB
                                                                                        • SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        ed8c53fc-dc47-4b54-9d5b-37f5d2015a39.tmp
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\ed8c53fc-dc47-4b54-9d5b-37f5d2015a39.tmp
                                                                                        • Size 10KB
                                                                                        • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        content_new.js
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2176_124357937\CRX_INSTALL\content_new.js
                                                                                        • Size 10KB
                                                                                        • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        processhacker-2.39-setup.exe.crdownload
                                                                                        • Path C:\Users\Admin\Downloads\processhacker-2.39-setup.exe.crdownload
                                                                                        • Size 2.2MB
                                                                                        • SHA256 28042dd4a92a0033b8f1d419b9e989c5b8e32d1d2d881f5c8251d58ce35b9063
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        memory/4660-180-0x0000000070180000-0x000000007022B000-memory.dmp
                                                                                        Download

                                                                                        memory/4660-1356-0x0000000070180000-0x000000007022B000-memory.dmp
                                                                                        Download

                                                                                        memory/5212-1027-0x0000000000010000-0x000000000001B000-memory.dmp
                                                                                        Download

                                                                                        memory/5452-912-0x0000000000400000-0x000000000042B000-memory.dmp
                                                                                        Download

                                                                                        memory/5452-1018-0x0000000000400000-0x000000000042B000-memory.dmp
                                                                                        Download

                                                                                        memory/5548-1017-0x0000000000400000-0x00000000004D4000-memory.dmp
                                                                                        Download

                                                                                        memory/5640-1246-0x000001F0514F0000-0x000001F051512000-memory.dmp
                                                                                        Download