Overview

overview

8

Static

static

1

URLScan

urlscan

1

http://roblox.com

windows11-21h2-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    449s
  • max time network
    438s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    15/08/2026, 04:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    http://roblox.com
  • Sample260815-e7qqradh39
Score
8/10
adwaredefense_evasiondiscoverypersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 1 IoCs
  • Drops file in Drivers directory 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 24 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 15 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 41 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 3 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 11 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 48 IoCs
  • Modifies registry class 48 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 31 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://roblox.com
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3820
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffc21bac188,0x7ffc21bac194,0x7ffc21bac1a0
      2⤵
        PID:3048
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,14779312710904779986,6990343213383092311,262144 --field-trial-handle=2912,i,5224573876188795073,15003133873196790126,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:2
        2⤵
          PID:2808
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,15265315849346250722,771845152660129725,524288 --field-trial-handle=2912,i,5224573876188795073,15003133873196790126,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:11
          2⤵
          • System Time Discovery
          PID:4708
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2236,i,251247163458201957,14335659707661223431,524288 --field-trial-handle=2912,i,5224573876188795073,15003133873196790126,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:13
          2⤵
            PID:772
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,6189236725395805211,10544109470423441241,2097152 --field-trial-handle=2912,i,5224573876188795073,15003133873196790126,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
            2⤵
              PID:4072
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,9597284440244116931,13177125464850634669,2097152 --field-trial-handle=2912,i,5224573876188795073,15003133873196790126,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
              2⤵
                PID:1136
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,17470481314522182406,16261972311105625972,2097152 --field-trial-handle=2912,i,5224573876188795073,15003133873196790126,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
                2⤵
                  PID:2612
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,9204113981692623537,8411880017456059808,2097152 --field-trial-handle=2912,i,5224573876188795073,15003133873196790126,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:9
                  2⤵
                    PID:3952
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4288,i,2946629952173626390,6897186792690148208,2097152 --field-trial-handle=2912,i,5224573876188795073,15003133873196790126,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:1
                    2⤵
                      PID:3284
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4336,i,2499619774842527415,4931306595488076973,2097152 --field-trial-handle=2912,i,5224573876188795073,15003133873196790126,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:9
                      2⤵
                        PID:3860
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4380,i,14712415873339306254,5062299135582727774,2097152 --field-trial-handle=2912,i,5224573876188795073,15003133873196790126,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:1
                        2⤵
                          PID:3112
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,4455557840731004157,6360279263713635653,524288 --field-trial-handle=2912,i,5224573876188795073,15003133873196790126,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:14
                          2⤵
                            PID:3168
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,4507365318897499591,4849139064445754439,524288 --field-trial-handle=2912,i,5224573876188795073,15003133873196790126,262144 --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:14
                            2⤵
                              PID:3360
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,1907682957514691571,16475490199636047504,524288 --field-trial-handle=2912,i,5224573876188795073,15003133873196790126,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4100
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                cookie_exporter.exe --cookie-json=1140
                                3⤵
                                  PID:4924
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,12919073586185337275,7990149513806279176,524288 --field-trial-handle=2912,i,5224573876188795073,15003133873196790126,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14
                                2⤵
                                  PID:1776
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,12919073586185337275,7990149513806279176,524288 --field-trial-handle=2912,i,5224573876188795073,15003133873196790126,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14
                                  2⤵
                                    PID:1256
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                  1⤵
                                    PID:3268
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                                    1⤵
                                      PID:2816
                                    • C:\Windows\System32\oobe\UserOOBEBroker.exe
                                      C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
                                      1⤵
                                      • Drops file in Windows directory
                                      PID:4492
                                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
                                      C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
                                      1⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:3736
                                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
                                      C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
                                      1⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:776
                                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
                                      C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
                                      1⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:3132
                                    • C:\Windows\system32\CredentialEnrollmentManager.exe
                                      C:\Windows\system32\CredentialEnrollmentManager.exe
                                      1⤵
                                        PID:4104
                                      • C:\Windows\system32\CredentialEnrollmentManager.exe
                                        C:\Windows\system32\CredentialEnrollmentManager.exe
                                        1⤵
                                          PID:4172
                                        • C:\Windows\system32\CredentialEnrollmentManager.exe
                                          C:\Windows\system32\CredentialEnrollmentManager.exe
                                          1⤵
                                            PID:1712
                                          • C:\Windows\system32\CredentialEnrollmentManager.exe
                                            C:\Windows\system32\CredentialEnrollmentManager.exe
                                            1⤵
                                              PID:2788
                                            • C:\Windows\system32\CredentialEnrollmentManager.exe
                                              C:\Windows\system32\CredentialEnrollmentManager.exe
                                              1⤵
                                                PID:2704
                                              • C:\Windows\system32\CredentialEnrollmentManager.exe
                                                C:\Windows\system32\CredentialEnrollmentManager.exe
                                                1⤵
                                                  PID:3032
                                                • C:\Windows\system32\OpenWith.exe
                                                  C:\Windows\system32\OpenWith.exe -Embedding
                                                  1⤵
                                                  • Modifies registry class
                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                  • Suspicious use of SetWindowsHookEx
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:1884
                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Desktop\StepSet.sys"
                                                    2⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Checks processor information in registry
                                                    • Modifies Internet Explorer settings
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of FindShellTrayWindow
                                                    • Suspicious use of SetWindowsHookEx
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:1176
                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
                                                      3⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1292
                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2D055E539C32951760E481CF4D0EFEB7 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                        4⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:2248
                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4F502A48C9C67BECAD2CA14548CF1550 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4F502A48C9C67BECAD2CA14548CF1550 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
                                                        4⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:4752
                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=108002C9251F38FF35C39019A1488495 --mojo-platform-channel-handle=2340 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                        4⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:2188
                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6BA7B20965D401DE1700E8A012A24DC3 --mojo-platform-channel-handle=1940 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                        4⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:2692
                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CA37638D62F897654E727A60023B920D --mojo-platform-channel-handle=2496 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                        4⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:2992
                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=61D402EF41B59112838639C5CCD483DD --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=61D402EF41B59112838639C5CCD483DD --renderer-client-id=8 --mojo-platform-channel-handle=2536 --allow-no-sandbox-job /prefetch:1
                                                        4⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:2004
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                  1⤵
                                                  • Enumerates system info in registry
                                                  • Modifies data under HKEY_USERS
                                                  • Modifies registry class
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • Suspicious use of FindShellTrayWindow
                                                  • Suspicious use of SendNotifyMessage
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:5088
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc2135c728,0x7ffc2135c734,0x7ffc2135c740
                                                    2⤵
                                                      PID:4648
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2004,i,16662489076799670852,6931994683842144900,524288 --field-trial-handle=2080,i,7999478187993874516,17364564864103337507,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2112 /prefetch:11
                                                      2⤵
                                                      • Downloads MZ/PE file
                                                      • System Time Discovery
                                                      PID:3928
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1648,i,7520980837463959548,15952695580770563386,262144 --field-trial-handle=2080,i,7999478187993874516,17364564864103337507,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2076 /prefetch:2
                                                      2⤵
                                                        PID:2844
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,10851466839442656498,3862701935373992107,524288 --field-trial-handle=2080,i,7999478187993874516,17364564864103337507,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1652 /prefetch:13
                                                        2⤵
                                                          PID:228
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,372527546803921986,10731421581374185012,2097152 --field-trial-handle=2080,i,7999478187993874516,17364564864103337507,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3236 /prefetch:1
                                                          2⤵
                                                            PID:2248
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,15386601887818131730,18150486756747876860,2097152 --field-trial-handle=2080,i,7999478187993874516,17364564864103337507,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:1
                                                            2⤵
                                                              PID:3704
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4280,i,5608147230153678233,13948334465924276835,2097152 --field-trial-handle=2080,i,7999478187993874516,17364564864103337507,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3924 /prefetch:9
                                                              2⤵
                                                                PID:2080
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4676,i,4075340577400825309,10767821925917197155,2097152 --field-trial-handle=2080,i,7999478187993874516,17364564864103337507,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4652 /prefetch:1
                                                                2⤵
                                                                  PID:2088
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,2325868364691856657,14184879358825509483,524288 --field-trial-handle=2080,i,7999478187993874516,17364564864103337507,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5516 /prefetch:14
                                                                  2⤵
                                                                    PID:3852
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5876,i,11120845063971520386,10715824719298799935,2097152 --field-trial-handle=2080,i,7999478187993874516,17364564864103337507,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5872 /prefetch:1
                                                                    2⤵
                                                                      PID:4532
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3448,i,4036522786360214630,8074988281410494839,2097152 --field-trial-handle=2080,i,7999478187993874516,17364564864103337507,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:1
                                                                      2⤵
                                                                        PID:3136
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3452,i,14920022232829957605,8471156641542759691,524288 --field-trial-handle=2080,i,7999478187993874516,17364564864103337507,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3236 /prefetch:12
                                                                        2⤵
                                                                          PID:2904
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3912,i,9404777693232293383,7120062057578767233,524288 --field-trial-handle=2080,i,7999478187993874516,17364564864103337507,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3224 /prefetch:14
                                                                          2⤵
                                                                          • Modifies registry class
                                                                          PID:4732
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5596,i,3520037048869898677,17894775925744967916,2097152 --field-trial-handle=2080,i,7999478187993874516,17364564864103337507,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5904 /prefetch:1
                                                                          2⤵
                                                                            PID:2980
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6192,i,6898844808060859980,11728255267568963632,524288 --field-trial-handle=2080,i,7999478187993874516,17364564864103337507,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6220 /prefetch:14
                                                                            2⤵
                                                                              PID:5060
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6164,i,7441321237735418644,4197608215969548705,524288 --field-trial-handle=2080,i,7999478187993874516,17364564864103337507,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6132 /prefetch:14
                                                                              2⤵
                                                                                PID:2148
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6152,i,12344189620584520194,3884814122132195949,524288 --field-trial-handle=2080,i,7999478187993874516,17364564864103337507,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6444 /prefetch:14
                                                                                2⤵
                                                                                  PID:4828
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6116,i,3764572964014306595,16388780096994952552,524288 --field-trial-handle=2080,i,7999478187993874516,17364564864103337507,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6484 /prefetch:14
                                                                                  2⤵
                                                                                    PID:4336
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6224,i,13552072891580674367,7554690068709841537,524288 --field-trial-handle=2080,i,7999478187993874516,17364564864103337507,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4268 /prefetch:14
                                                                                    2⤵
                                                                                    • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                                                    • NTFS ADS
                                                                                    PID:3420
                                                                                  • C:\Users\Admin\Downloads\VirtualBox-7.2.14-174565-Win.exe
                                                                                    "C:\Users\Admin\Downloads\VirtualBox-7.2.14-174565-Win.exe"
                                                                                    2⤵
                                                                                    • Executes dropped EXE
                                                                                    • Enumerates connected drives
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:4552
                                                                                • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                  1⤵
                                                                                    PID:2120
                                                                                  • C:\Windows\system32\svchost.exe
                                                                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                    1⤵
                                                                                      PID:1756
                                                                                    • C:\Windows\system32\msiexec.exe
                                                                                      C:\Windows\system32\msiexec.exe /V
                                                                                      1⤵
                                                                                      • Enumerates connected drives
                                                                                      • Drops file in Program Files directory
                                                                                      • Drops file in Windows directory
                                                                                      • Modifies data under HKEY_USERS
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      PID:1668
                                                                                      • C:\Windows\System32\MsiExec.exe
                                                                                        C:\Windows\System32\MsiExec.exe -Embedding 0FCA749DFCF863CFE8B02D221C5B996D C
                                                                                        2⤵
                                                                                        • Loads dropped DLL
                                                                                        PID:1600
                                                                                      • C:\Windows\system32\srtasks.exe
                                                                                        C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                                                                                        2⤵
                                                                                          PID:2912
                                                                                        • C:\Windows\System32\MsiExec.exe
                                                                                          C:\Windows\System32\MsiExec.exe -Embedding 5221520491AA157E3574D7F16CFA02C8
                                                                                          2⤵
                                                                                          • Loads dropped DLL
                                                                                          PID:4112
                                                                                        • C:\Windows\System32\MsiExec.exe
                                                                                          C:\Windows\System32\MsiExec.exe -Embedding C9D3C7AC14D0405968222B272370F644 E Global\MSI0000
                                                                                          2⤵
                                                                                          • Drops file in Drivers directory
                                                                                          • Loads dropped DLL
                                                                                          • Drops file in Windows directory
                                                                                          PID:1084
                                                                                      • C:\Windows\system32\vssvc.exe
                                                                                        C:\Windows\system32\vssvc.exe
                                                                                        1⤵
                                                                                        • Checks SCSI registry key(s)
                                                                                        PID:2080
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                                                        1⤵
                                                                                        • Drops file in Windows directory
                                                                                        • Checks SCSI registry key(s)
                                                                                        PID:1940
                                                                                        • C:\Windows\system32\DrvInst.exe
                                                                                          DrvInst.exe "4" "9" "C:\Program Files\Oracle\VirtualBox\drivers\vboxsup\VBoxSup.inf" "9" "4ff1aec5b" "0000000000000160" "WinSta0\Default" "0000000000000170" "208" "C:\Program Files\Oracle\VirtualBox\drivers\vboxsup"
                                                                                          2⤵
                                                                                          • Drops file in System32 directory
                                                                                          • Drops file in Windows directory
                                                                                          • Checks SCSI registry key(s)
                                                                                          • Modifies data under HKEY_USERS
                                                                                          PID:2436
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                        1⤵
                                                                                        • Enumerates system info in registry
                                                                                        • Modifies data under HKEY_USERS
                                                                                        • Modifies registry class
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                        • Suspicious use of SendNotifyMessage
                                                                                        PID:1204
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc2135c728,0x7ffc2135c734,0x7ffc2135c740
                                                                                          2⤵
                                                                                            PID:676
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1572,i,7906722416679671565,8528623014899029533,262144 --field-trial-handle=1880,i,3815832924540632836,12044207503742668957,262144 --variations-seed-version=20260814-170108.769000-production --mojo-platform-channel-handle=1876 /prefetch:2
                                                                                            2⤵
                                                                                              PID:4036
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2220,i,13511973410127686517,10115784552213395207,524288 --field-trial-handle=1880,i,3815832924540632836,12044207503742668957,262144 --variations-seed-version=20260814-170108.769000-production --mojo-platform-channel-handle=2244 /prefetch:11
                                                                                              2⤵
                                                                                              • System Time Discovery
                                                                                              PID:2144
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2340,i,4489679833724275118,11877069239623990288,524288 --field-trial-handle=1880,i,3815832924540632836,12044207503742668957,262144 --variations-seed-version=20260814-170108.769000-production --mojo-platform-channel-handle=2348 /prefetch:13
                                                                                              2⤵
                                                                                                PID:3864
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3188,i,1028765257679921105,7281046683982331296,2097152 --field-trial-handle=1880,i,3815832924540632836,12044207503742668957,262144 --variations-seed-version=20260814-170108.769000-production --mojo-platform-channel-handle=3408 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:2148
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3204,i,12826085303756297595,13363261671843978864,2097152 --field-trial-handle=1880,i,3815832924540632836,12044207503742668957,262144 --variations-seed-version=20260814-170108.769000-production --mojo-platform-channel-handle=3468 /prefetch:1
                                                                                                  2⤵
                                                                                                    PID:1840
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4520,i,12043744189456579009,13457421145747041000,2097152 --field-trial-handle=1880,i,3815832924540632836,12044207503742668957,262144 --variations-seed-version=20260814-170108.769000-production --mojo-platform-channel-handle=4524 /prefetch:1
                                                                                                    2⤵
                                                                                                      PID:3428
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5268,i,18235078738394048190,7149260587702766966,524288 --field-trial-handle=1880,i,3815832924540632836,12044207503742668957,262144 --variations-seed-version=20260814-170108.769000-production --mojo-platform-channel-handle=5276 /prefetch:14
                                                                                                      2⤵
                                                                                                        PID:3964
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5568,i,13862361423767748681,8763275092454074718,2097152 --field-trial-handle=1880,i,3815832924540632836,12044207503742668957,262144 --variations-seed-version=20260814-170108.769000-production --mojo-platform-channel-handle=5516 /prefetch:1
                                                                                                        2⤵
                                                                                                          PID:2168
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3416,i,7457328477550271640,1190330324520509316,2097152 --field-trial-handle=1880,i,3815832924540632836,12044207503742668957,262144 --variations-seed-version=20260814-170108.769000-production --mojo-platform-channel-handle=3516 /prefetch:1
                                                                                                          2⤵
                                                                                                            PID:1664
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3280,i,9447951780344339215,8591633838955440675,2097152 --field-trial-handle=1880,i,3815832924540632836,12044207503742668957,262144 --variations-seed-version=20260814-170108.769000-production --mojo-platform-channel-handle=3520 /prefetch:1
                                                                                                            2⤵
                                                                                                              PID:1720
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5760,i,1672106582730858155,14537524080093213625,524288 --field-trial-handle=1880,i,3815832924540632836,12044207503742668957,262144 --variations-seed-version=20260814-170108.769000-production --mojo-platform-channel-handle=5704 /prefetch:14
                                                                                                              2⤵
                                                                                                              • Modifies registry class
                                                                                                              PID:4916
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3676,i,14653070747097705843,10486272983745050268,524288 --field-trial-handle=1880,i,3815832924540632836,12044207503742668957,262144 --variations-seed-version=20260814-170108.769000-production --mojo-platform-channel-handle=5264 /prefetch:12
                                                                                                              2⤵
                                                                                                                PID:2952
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5920,i,5939870364919422070,8039082074786445300,2097152 --field-trial-handle=1880,i,3815832924540632836,12044207503742668957,262144 --variations-seed-version=20260814-170108.769000-production --mojo-platform-channel-handle=5956 /prefetch:1
                                                                                                                2⤵
                                                                                                                  PID:1552
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5640,i,17196315530767440822,13559816497441870468,524288 --field-trial-handle=1880,i,3815832924540632836,12044207503742668957,262144 --variations-seed-version=20260814-170108.769000-production --mojo-platform-channel-handle=5584 /prefetch:14
                                                                                                                  2⤵
                                                                                                                    PID:1856
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6308,i,8802248617606765747,1610126141038939050,524288 --field-trial-handle=1880,i,3815832924540632836,12044207503742668957,262144 --variations-seed-version=20260814-170108.769000-production --mojo-platform-channel-handle=6380 /prefetch:14
                                                                                                                    2⤵
                                                                                                                      PID:5760
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6136,i,8611652457391332892,17736128335027309927,524288 --field-trial-handle=1880,i,3815832924540632836,12044207503742668957,262144 --variations-seed-version=20260814-170108.769000-production --mojo-platform-channel-handle=4676 /prefetch:14
                                                                                                                      2⤵
                                                                                                                        PID:5836
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3900,i,17638797533960806847,15910599753700507569,524288 --field-trial-handle=1880,i,3815832924540632836,12044207503742668957,262144 --variations-seed-version=20260814-170108.769000-production --mojo-platform-channel-handle=5608 /prefetch:14
                                                                                                                        2⤵
                                                                                                                          PID:5780
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6320,i,4588821780165063243,4611816887799057119,2097152 --field-trial-handle=1880,i,3815832924540632836,12044207503742668957,262144 --variations-seed-version=20260814-170108.769000-production --mojo-platform-channel-handle=5288 /prefetch:1
                                                                                                                          2⤵
                                                                                                                            PID:6060
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5608,i,12747513336842174128,10367650778085872573,2097152 --field-trial-handle=1880,i,3815832924540632836,12044207503742668957,262144 --variations-seed-version=20260814-170108.769000-production --mojo-platform-channel-handle=5548 /prefetch:1
                                                                                                                            2⤵
                                                                                                                              PID:5260
                                                                                                                          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                            1⤵
                                                                                                                              PID:1916
                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                                              1⤵
                                                                                                                                PID:228
                                                                                                                              • C:\Windows\system32\sihost.exe
                                                                                                                                sihost.exe
                                                                                                                                1⤵
                                                                                                                                  PID:5716
                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                    explorer.exe /LOADSAVEDWINDOWS
                                                                                                                                    2⤵
                                                                                                                                    • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                    • Enumerates connected drives
                                                                                                                                    • Checks SCSI registry key(s)
                                                                                                                                    • Modifies registry class
                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                    PID:1028
                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                  1⤵
                                                                                                                                  • Modifies registry class
                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                  PID:6048
                                                                                                                                • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                                  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                                  1⤵
                                                                                                                                  • Enumerates system info in registry
                                                                                                                                  • Modifies registry class
                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                  PID:5456

                                                                                                                                Network

                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                      Replay Monitor

                                                                                                                                      Loading Replay Monitor...

                                                                                                                                      Downloads

                                                                                                                                      698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                                                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                                                                                      • Size 471B
                                                                                                                                      • SHA256 40f2e6183442f3aa91734abe73da552d7405cd6c761f16cac5f9abdc9292079d
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      8EC9B1D0ABBD7F98B401D425828828CE_0D89C5EAD59EC1C2BC9790314666F3D2
                                                                                                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_0D89C5EAD59EC1C2BC9790314666F3D2
                                                                                                                                      • Size 727B
                                                                                                                                      • SHA256 74be706d2842a659a09fa76d732aa7a0a7658b7a8f92aa19ba1dbb7a462690a7
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                                                                      • Size 727B
                                                                                                                                      • SHA256 6fded71460d49382a60ce519f3fe79e6f1c712f3d073af1c5cf4a98fea9a0617
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                                                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                                                                                      • Size 400B
                                                                                                                                      • SHA256 9d57fe126f00251be53e29f3a2a20c6916c2162d6c073d89242a16579d00c3c8
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      8EC9B1D0ABBD7F98B401D425828828CE_0D89C5EAD59EC1C2BC9790314666F3D2
                                                                                                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_0D89C5EAD59EC1C2BC9790314666F3D2
                                                                                                                                      • Size 408B
                                                                                                                                      • SHA256 50a44e1f4fbd70ebfe9bbfd6a2013d9f92506bbc88aa5d6ca0f60962f336f8d6
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                                                                      • Size 412B
                                                                                                                                      • SHA256 0fc2d5ed3e8c9bceee38709976cbc8e0d745dd1c7e8d187e750a5f47f8286a35
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      settings.dat
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                                                                                                      • Size 40B
                                                                                                                                      • SHA256 db1c0ac2d59dc903b3d97110c1e0a55b6f2d9bb2b48309e4b410d61dcc8aa42c
                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                      Submit Download

                                                                                                                                      443b79ad-2385-4fef-8f37-20dea6ee766c.tmp
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\443b79ad-2385-4fef-8f37-20dea6ee766c.tmp
                                                                                                                                      • Size 15KB
                                                                                                                                      • SHA256 134b187e474a89929967e135d2bfc3664f9cec37f9f7ef690ed852770c864972
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      BrowsingTopicsState
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                                                                      • Size 414B
                                                                                                                                      • SHA256 36fb65e94538136bda2f6245e03d3a9b859ae03b7cb12d5358455ff37003c60b
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      f_000038
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000038
                                                                                                                                      • Size 56KB
                                                                                                                                      • SHA256 e5a5b08d10282d3bb102ea60da50511d94b7b5df75c6975bbcb52b8e67a1a66e
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      f_000039
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000039
                                                                                                                                      • Size 673KB
                                                                                                                                      • SHA256 1a2c8901dfefd789a0171c0cbeb36d2bf3fc5b9fc04453bbce723cebf001c278
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      f_00003a
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003a
                                                                                                                                      • Size 22KB
                                                                                                                                      • SHA256 e7117ea5da69ba8f1b014559bd9ac8ade5d62997b6d1fe849ee9104a16796319
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      f_00003b
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003b
                                                                                                                                      • Size 34KB
                                                                                                                                      • SHA256 29777225e76232b1615d08eb7058e82f04ae3cde70dd7b507eb07aabfe737497
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      f_00003c
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003c
                                                                                                                                      • Size 284KB
                                                                                                                                      • SHA256 9b0dfe6beaf6a20afa2a5d4e520c67dab3dc578e0d0e2c455469c237cc252238
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      f_000047
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000047
                                                                                                                                      • Size 27KB
                                                                                                                                      • SHA256 e4d03228114c7c4ccb35863ccc8e4bb3a6763f3713b4f76687f2fe652c0fe4e6
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      f_00005a
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005a
                                                                                                                                      • Size 39KB
                                                                                                                                      • SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      the-real-index
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                      • Size 1KB
                                                                                                                                      • SHA256 a72a36d45d3dc2d12be58dfbb22c3656d01216272a9dfe0c4a3e1c5d953c21a1
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      the-real-index
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                      • Size 2KB
                                                                                                                                      • SHA256 df0b86a49e366cd15d99fab9be590d6dd28aabae48ea462500088a2c33e909d4
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      000017.ldb
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000017.ldb
                                                                                                                                      • Size 20KB
                                                                                                                                      • SHA256 16e18234608f5c4ce0eb6b2eaf2e2d9098fe2611c56c6e2da6c09c7cc7b26109
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      000018.log
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000018.log
                                                                                                                                      • Size 211KB
                                                                                                                                      • SHA256 ae9e21346419806574ea107d80dd882ab0c48c2b82d4e102808430d18fcd6259
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      000020.ldb
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000020.ldb
                                                                                                                                      • Size 20KB
                                                                                                                                      • SHA256 8f9dc420c683fbd49fd0e93a729cd7f1bc8bcc392286d9f5c4f58a06f37a6902
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      LOG
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
                                                                                                                                      • Size 6KB
                                                                                                                                      • SHA256 3dfa0b29617e777d88c7b9d9876473eabb742f210daf09185c85639abc57ef40
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      MANIFEST-000001
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
                                                                                                                                      • Size 1KB
                                                                                                                                      • SHA256 544ce5c638180b4938c644a0e086cdb7a0c31a6a7ec98ec34aa9876c2580975d
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Network Persistent State
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                      • Size 19KB
                                                                                                                                      • SHA256 403b8252389f91627f9c62394484608f0833164ce3a2e8a99cbf8951c993b147
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Network Persistent State
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                      • Size 6KB
                                                                                                                                      • SHA256 ae0d541ea71e1a3a2edc22275c6d2213d05ade98eda8d3978a05929bcda49032
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      TransportSecurity
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                      • Size 685B
                                                                                                                                      • SHA256 63363602e3e4953e26576aae0013b63dc6604862f439e7236df0751dffa564bc
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      TransportSecurity
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                      • Size 1KB
                                                                                                                                      • SHA256 bb6a9485c5fcb64323910356c73da7e95cf3c9568f01ee09bdb43376c3f9e0d0
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Preferences
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                      • Size 13KB
                                                                                                                                      • SHA256 2e1633549f2b8d07bd18ffab5aeab1c89c986eda29b57070b3cf7c7f14f78f8b
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Preferences
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                      • Size 15KB
                                                                                                                                      • SHA256 bb1f29c7f0ba7091483be00c818fa966918596bd20ec1402a6f416cd267bd424
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Preferences
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                      • Size 12KB
                                                                                                                                      • SHA256 5801446555b05c31dfbb7a3a50c19f0a9133259c3db304d57c96d4882426e3d1
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Preferences
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                      • Size 14KB
                                                                                                                                      • SHA256 243889db0add42cbe5ceab8ec5878e9993dd139eb2fade48a4ac3e6dfabdcc8e
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Preferences
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                      • Size 15KB
                                                                                                                                      • SHA256 d9dab12b0bf8b8c3eb22164ec3eed8788a2271fdc0a37438787b22be6f70a3a1
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Preferences
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                      • Size 13KB
                                                                                                                                      • SHA256 994efd9121cef4cf7c145f4bc2b890c7b4852a0f0bd4d43066add77a37f61980
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Secure Preferences
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                      • Size 17KB
                                                                                                                                      • SHA256 86a708718cf15f4439caa697f6058448e2b7016cb1cef9cd2e54315587d87208
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      the-real-index
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\4445e28a-b8bc-4650-8c0e-3964bb572e58\index-dir\the-real-index
                                                                                                                                      • Size 576B
                                                                                                                                      • SHA256 c260a31c49f59462d393a58aeabb14c4f17e5ce997192ef2e50adfee6925447c
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      the-real-index~RFe5cd99e.TMP
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\4445e28a-b8bc-4650-8c0e-3964bb572e58\index-dir\the-real-index~RFe5cd99e.TMP
                                                                                                                                      • Size 48B
                                                                                                                                      • SHA256 8389f810c198ef97da7e7f9cb0637f5960e3933df218316bf1f2a105e8162d35
                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                      Submit Download

                                                                                                                                      index
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\7caa122b-fd16-4ced-a351-7fc5da624ba8\index
                                                                                                                                      • Size 24B
                                                                                                                                      • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                      Submit Download

                                                                                                                                      the-real-index
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\7caa122b-fd16-4ced-a351-7fc5da624ba8\index-dir\the-real-index
                                                                                                                                      • Size 2KB
                                                                                                                                      • SHA256 e7fb1a9e8e9ff9ce41d14bac1c68f156b97eb4160c08e40b5c8e6317f9f5f8c6
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      the-real-index
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\7caa122b-fd16-4ced-a351-7fc5da624ba8\index-dir\the-real-index
                                                                                                                                      • Size 2KB
                                                                                                                                      • SHA256 f01c6978d5ad1ef3321999cd071e35e7e8c4210aecf6a95713e596e1d223e71c
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      the-real-index~RFe5c80c0.TMP
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\7caa122b-fd16-4ced-a351-7fc5da624ba8\index-dir\the-real-index~RFe5c80c0.TMP
                                                                                                                                      • Size 48B
                                                                                                                                      • SHA256 faf6cb3389f85c461e90d4425b2a35f30cf5cec02b71671bd64cea6f0649f323
                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                      Submit Download

                                                                                                                                      index.txt
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                                                                                                                                      • Size 243B
                                                                                                                                      • SHA256 6e1fc4d45b72ee86fbb26feb2de3a1815e670afb6976e5349a02857547555e40
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      index.txt
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                                                                                                                                      • Size 390B
                                                                                                                                      • SHA256 5d3532ee94179bd7cb553695234ac1d231cdb24ad990124fd569bc5036d6b4a2
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      index.txt
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                                                                                                                                      • Size 216B
                                                                                                                                      • SHA256 0e9efa3682639197e9d24cd5003bea9f3e7f38a55373918f83a41ad2c305812c
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      index.txt
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                                                                                                                                      • Size 214B
                                                                                                                                      • SHA256 918da2efe20005d9679f6409e04fdf27c1e1b907181f125a6fd6d1a6f117381c
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      index.txt
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                                                                                                                                      • Size 130B
                                                                                                                                      • SHA256 d9012f5f25d45634069265045d68090be74ab12683e560aebef4aaa54d99df9e
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      index.txt
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                                                                                                                                      • Size 383B
                                                                                                                                      • SHA256 44d42752bcb7760ef8f9b34d15e7df43a3be7cf788e31c31ee99f550a1ba173c
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      index.txt
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                                                                                                                                      • Size 132B
                                                                                                                                      • SHA256 860f757b172c9944cc33ae95b67db3e4351c838c91f56015490d751b5bdd34bb
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      index.txt~RFe5c71ad.TMP
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5c71ad.TMP
                                                                                                                                      • Size 137B
                                                                                                                                      • SHA256 115d83860f1eb698456ef5612710fdbe24625d61806e22a777f003250e6df496
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      the-real-index
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                      • Size 168B
                                                                                                                                      • SHA256 ecd59f38c538b0287bbb5d75c87bf492dc319f816038e970b016228ea48577c4
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      the-real-index
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                      • Size 120B
                                                                                                                                      • SHA256 d88d7e5761a4943362dea16aca03d6b89cf2fec03b0e2c3a744c328492c59f66
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      the-real-index~RFe5a9e74.TMP
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a9e74.TMP
                                                                                                                                      • Size 96B
                                                                                                                                      • SHA256 e6c3f89cc7b16d16ca1d8bc85f2e90983a49ae83a0079039b83ce821c5725e4c
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      the-real-index
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
                                                                                                                                      • Size 72B
                                                                                                                                      • SHA256 d64e9b69bcae60614e6539973fa7fce2ea0ac15ef31d2fa207298612c389b6f2
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      the-real-index
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
                                                                                                                                      • Size 96B
                                                                                                                                      • SHA256 cb0c29e3337ae6941a2cc607026c9a0add5d5cc5c664eba5689450638f76338f
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      512.png
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Shortcuts Menu Icons\Monochrome\2\512.png
                                                                                                                                      • Size 9KB
                                                                                                                                      • SHA256 ad08077126e7106674e4219f5f9cfac2305e8b3f627247c1d3e72136399e6fd2
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      512.png
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir1204_2002897591\Shortcuts Menu Icons\Monochrome\0\512.png
                                                                                                                                      • Size 4KB
                                                                                                                                      • SHA256 d345d2dbe2efd56ff9494cb31cae0e28cde5bdf176a22bca9aee27465b117c88
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      512.png
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir1204_2002897591\Shortcuts Menu Icons\Monochrome\1\512.png
                                                                                                                                      • Size 7KB
                                                                                                                                      • SHA256 1e0b1b2e4dac49da1e2ce91a72e01f77fdb3bbb26ed3422e5d4037745cc307a4
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      index.txt
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
                                                                                                                                      • Size 150B
                                                                                                                                      • SHA256 211a067f3c2c7a88f2979b6337b360bf82ea3861afdf80be68a431e56dbf86aa
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      index.txt
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
                                                                                                                                      • Size 76B
                                                                                                                                      • SHA256 944fff1dd6764143550534f747243ef7d84fdac0642c94135ab40f584520f63e
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      index.txt
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
                                                                                                                                      • Size 157B
                                                                                                                                      • SHA256 b710c52247e38beee21feca6813225f124c8a8b96ce18e3c4ecf5e3011847785
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      index.txt~RFe5c6605.TMP
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe5c6605.TMP
                                                                                                                                      • Size 160B
                                                                                                                                      • SHA256 8d39423815f197a2c43a6c03809ae4bba468fa4116d1fadd46b79eacc0ee2f03
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      000001.dbtmp
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\000001.dbtmp
                                                                                                                                      • Size 16B
                                                                                                                                      • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                      Submit Download

                                                                                                                                      MANIFEST-000001
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\MANIFEST-000001
                                                                                                                                      • Size 23B
                                                                                                                                      • SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                      Submit Download

                                                                                                                                      Local State
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                      • Size 239KB
                                                                                                                                      • SHA256 034953b6eddf80ac90a31cc7a5ef98cf13e9a966253823da6dde90b48b9b34b2
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Local State
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                      • Size 240KB
                                                                                                                                      • SHA256 e4cd3a6ac0e21493e308b76ff0a27d3809313def656d376eddacc219bd97acba
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Local State
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                      • Size 115KB
                                                                                                                                      • SHA256 11b857edfe11b6e75cc4c92d7d652ec568ebf63b93c8c1c338c3b25f18e706b8
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Local State
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                      • Size 240KB
                                                                                                                                      • SHA256 9d06518e4149dacf62813d0b08e28ec4d7969e898b0a0d8f022dddfbbec5715a
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Local State
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                      • Size 129KB
                                                                                                                                      • SHA256 121fad23f30343a7fea485576210e89cec987b1d87ee724efe15ba31636a8e24
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Local State
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                      • Size 135KB
                                                                                                                                      • SHA256 96f054456fcb0f64c9184231656b0a1d421172fd12c80f82775f1bb9376f001a
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Local State
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                      • Size 135KB
                                                                                                                                      • SHA256 d2b7300037647f61847bd26e7225b827dda8232792084c67ecb0f32f5403e6ee
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      blocklist
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                                                                                      • Size 105KB
                                                                                                                                      • SHA256 0bc6098c2195ea120fd2411f8b8c4fa0be6092da7b9834a6a10e2505ee8edd65
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      settings.dat
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                      • Size 280B
                                                                                                                                      • SHA256 3d6022b8b09d410224e6f49ce6c5693abe531fcaf66bb13ef03126afd2691fe0
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      settings.dat
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                      • Size 280B
                                                                                                                                      • SHA256 bb2092aac65238f5c99a5041af4953f8df51484d0a523a06aaae064a4d1a8d8a
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      settings.dat
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                      • Size 280B
                                                                                                                                      • SHA256 940cbc9ecbe8080b4f78231e8ea559e5f25ba4586d9b9c7484580010ea141f8b
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      BookmarkMergedSurfaceOrdering
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                                      • Size 6B
                                                                                                                                      • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                      Submit Download

                                                                                                                                      the-real-index
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                      • Size 5KB
                                                                                                                                      • SHA256 9d783c0fc67fec6a3b8a1d6cf667e922aee16c14d54dd4cadfa8be701572e475
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      the-real-index~RFe58701a.TMP
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58701a.TMP
                                                                                                                                      • Size 3KB
                                                                                                                                      • SHA256 f31364f18eb6d65ae5baa1116ad626de87e1057fdc765642ba2e8b7dc33aa3fd
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      SiteList-Enterprise.json
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                      • Size 2B
                                                                                                                                      • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                      Submit Download

                                                                                                                                      Edge Profile.ico
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                                      • Size 70KB
                                                                                                                                      • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Network Persistent State
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                      • Size 3KB
                                                                                                                                      • SHA256 4fe1d3982147ecaeff90371804dacbb9869995237e915da1313dea65a02ecd1b
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      SCT Auditing Pending Reports
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                      • Size 2B
                                                                                                                                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                      Submit Download

                                                                                                                                      Preferences
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                      • Size 14KB
                                                                                                                                      • SHA256 604bdb9e1fb67c537d200da19646960cedd2d7ee878325b1ed65650858d2034d
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Secure Preferences
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                      • Size 31KB
                                                                                                                                      • SHA256 1628bacb1679cc54a66d3a3625f87ce59e0334e4524ab2648dfe5d9e022ae4ef
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      sync_diagnostic.log
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                      • Size 6KB
                                                                                                                                      • SHA256 1df596f78af031af95d5ac72a8877f47814d03d01a2593cc9884103dd8bf22b4
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Local State
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                      • Size 25KB
                                                                                                                                      • SHA256 6dfe164511a8ab3944e99b77c340c78faca571022ddfaa96c155f90842662877
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Local State
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                      • Size 8KB
                                                                                                                                      • SHA256 e29f841029ea79e469dc5f8c526c0875320f28e402c336a46db93aa5cc4b29b8
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Local State
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                      • Size 8KB
                                                                                                                                      • SHA256 db776f0099699d1b1d4f4b7afa4a68f596c9079db7662fe062579ea1b6351d3d
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      data_1
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
                                                                                                                                      • Size 264KB
                                                                                                                                      • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                      Submit Download

                                                                                                                                      FileCoAuth-2026-8-15.435.3736.1.odl
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2026-8-15.435.3736.1.odl
                                                                                                                                      • Size 706B
                                                                                                                                      • SHA256 59e3eb148a411aafe996ce29b9d60e072ff9b604735f27d7e318f9dce3080fb3
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      FileCoAuth-2026-8-15.436.776.1.odl
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2026-8-15.436.776.1.odl
                                                                                                                                      • Size 1KB
                                                                                                                                      • SHA256 51f958dbd40f4b05d56e798fafc555abfbd11b6a3f7278d95c46e4ea68cd12c6
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      www.bing[1].xml
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\E1Z9YJJA\www.bing[1].xml
                                                                                                                                      • Size 9KB
                                                                                                                                      • SHA256 e6245f141f2a9a343e15377b947d9c47de2f124272468e9a13ca1f72ee6a5471
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      MSI4090.tmp
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\MSI4090.tmp
                                                                                                                                      • Size 494KB
                                                                                                                                      • SHA256 98a4a140ff5195bb9564efe60457e495289d9808b28eb86d672d8425535a42d4
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      MSIb3de0.LOG
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\MSIb3de0.LOG
                                                                                                                                      • Size 128KB
                                                                                                                                      • SHA256 9daa60a716284292793bf645993fdb64692968caf73877fbdb4a57061dd6a0a5
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      VirtualBox-7.2.14-174565-Win.exe:Zone.Identifier
                                                                                                                                      • Path C:\Users\Admin\Downloads\VirtualBox-7.2.14-174565-Win.exe:Zone.Identifier
                                                                                                                                      • Size 159B
                                                                                                                                      • SHA256 59e856fcd5c1d4ab0c4ddbed8a6508486322f92eff1ef989d63b355562b17a19
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      oem0.PNF
                                                                                                                                      • Path C:\Windows\INF\oem0.PNF
                                                                                                                                      • Size 5KB
                                                                                                                                      • SHA256 7a327532abced2862a6ea163fbd8705534c5c3d3f5443e21af79bd14da9e41f5
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      oem1.PNF
                                                                                                                                      • Path C:\Windows\INF\oem1.PNF
                                                                                                                                      • Size 5KB
                                                                                                                                      • SHA256 ec66810579edbd2c310829d134b0eb6ee0522258e5d4b95b142e548f67dfccf6
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      oem2.PNF
                                                                                                                                      • Path C:\Windows\INF\oem2.PNF
                                                                                                                                      • Size 6KB
                                                                                                                                      • SHA256 086f9cde9636bd0906aa59033984aa2290afa0ba2e53c8613b05c45b9075df0b
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      VBoxSup.cat
                                                                                                                                      • Path C:\Windows\System32\DriverStore\Temp\{03bc4e76-407d-b049-88d6-9729c9022e7a}\VBoxSup.cat
                                                                                                                                      • Size 11KB
                                                                                                                                      • SHA256 191d53d9d65efcd8cb2d48962f71d529b2ede51d1dca50dfc764a8103c5129fa
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      VBoxSup.inf
                                                                                                                                      • Path C:\Windows\System32\DriverStore\Temp\{03bc4e76-407d-b049-88d6-9729c9022e7a}\VBoxSup.inf
                                                                                                                                      • Size 2KB
                                                                                                                                      • SHA256 472f69d3b956ea8eb7579c144c438533704f4cfe905604931a0658ffdeab9ddb
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      VBoxSup.sys
                                                                                                                                      • Path C:\Windows\System32\DriverStore\Temp\{03bc4e76-407d-b049-88d6-9729c9022e7a}\VBoxSup.sys
                                                                                                                                      • Size 1.0MB
                                                                                                                                      • SHA256 257fb12b25cd673ca1bfabd957f9c183a2f1f08192581fa365e279c080db8124
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      metadata-2
                                                                                                                                      • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                                                                                                                                      • Size 24.6MB
                                                                                                                                      • SHA256 04960adebe7853e429f432d61105a0c44230d6c383968fe0f195707a542af016
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      {f373f47a-161c-40fa-883a-a4b9427df593}_OnDiskSnapshotProp
                                                                                                                                      • Path \??\Volume{b99e3a64-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{f373f47a-161c-40fa-883a-a4b9427df593}_OnDiskSnapshotProp
                                                                                                                                      • Size 6KB
                                                                                                                                      • SHA256 bbc58d1358830446717fa99a73867063d4e72f89046342786c640d69259ede37
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      memory/5456-2443-0x000001866DB80000-0x000001866DBA0000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5456-2410-0x000001865C530000-0x000001865C630000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5456-2413-0x000001864B250000-0x000001864B350000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5456-2520-0x000001876FF70000-0x0000018770070000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5456-2444-0x000001866DAE0000-0x000001866DB00000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5456-2412-0x000001864B250000-0x000001864B350000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5456-2411-0x000001864B250000-0x000001864B350000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5456-2421-0x000001864AE90000-0x000001864AF90000-memory.dmp
                                                                                                                                      Download