Overview

overview

9

Static

static

3

RealSetup_...5a.exe

windows10-2004-x64

9

Analysis

  • user interaction
    yes
  • max time kernel
    295s
  • max time network
    305s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/09/2026, 03:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    RealSetup_bb342d7b32105f71b7030ebe567e0a4ae85370314dadf5c68f282652b2f8435a.exe
  • Size 16.5MB
  • Sample260930-ecfx3azz2p
  • SHA256 b411b444682179bf2f4270fbc22d9a86263b659152f9611712ec40101a8f3aee
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionpersistencespywarestealertrojan

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    defense_evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file 2 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    defense_evasiontrojan
  • Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs
    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 5 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 14 IoCs
  • Modifies registry class 18 IoCs
  • Modifies registry key 1 TTPs 2 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\RealSetup_bb342d7b32105f71b7030ebe567e0a4ae85370314dadf5c68f282652b2f8435a.exe
    "C:\Users\Admin\AppData\Local\Temp\RealSetup_bb342d7b32105f71b7030ebe567e0a4ae85370314dadf5c68f282652b2f8435a.exe"
    1⤵
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Reads the TCP/IP host and domain name from the registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1464
    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RealSetup_bb342d7b32105f71b7030ebe567e0a4ae85370314dadf5c68f282652b2f8435a.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D99881E-E2E2-4337-A487-7F9C412621C7}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=1464.924.12513266154814056805
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of WriteProcessMemory
      PID:3928
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D99881E-E2E2-4337-A487-7F9C412621C7}\wv2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D99881E-E2E2-4337-A487-7F9C412621C7}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffadf2fb078,0x7ffadf2fb084,0x7ffadf2fb090
        3⤵
          PID:4336
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D99881E-E2E2-4337-A487-7F9C412621C7}\wv2\EBWebView" --webview-exe-name=RealSetup_bb342d7b32105f71b7030ebe567e0a4ae85370314dadf5c68f282652b2f8435a.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1720,i,5738043113431510351,15297493388131224382,262144 --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:2
          3⤵
            PID:260
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D99881E-E2E2-4337-A487-7F9C412621C7}\wv2\EBWebView" --webview-exe-name=RealSetup_bb342d7b32105f71b7030ebe567e0a4ae85370314dadf5c68f282652b2f8435a.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2024,i,5738043113431510351,15297493388131224382,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:3
            3⤵
              PID:3348
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D99881E-E2E2-4337-A487-7F9C412621C7}\wv2\EBWebView" --webview-exe-name=RealSetup_bb342d7b32105f71b7030ebe567e0a4ae85370314dadf5c68f282652b2f8435a.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2304,i,5738043113431510351,15297493388131224382,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:8
              3⤵
                PID:3956
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D99881E-E2E2-4337-A487-7F9C412621C7}\wv2\EBWebView" --webview-exe-name=RealSetup_bb342d7b32105f71b7030ebe567e0a4ae85370314dadf5c68f282652b2f8435a.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3720,i,5738043113431510351,15297493388131224382,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:1
                3⤵
                  PID:4812
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c sc config w32time start= auto >nul 2>nul & net start w32time >nul 2>nul
                2⤵
                • Executes a command shell one-liner
                • System Time Discovery
                • Suspicious use of WriteProcessMemory
                PID:2096
                • C:\Windows\system32\sc.exe
                  sc config w32time start= auto
                  3⤵
                  • Launches sc.exe
                  PID:2456
                • C:\Windows\system32\net.exe
                  net start w32time
                  3⤵
                  • System Time Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:2008
                  • C:\Windows\system32\net1.exe
                    C:\Windows\system32\net1 start w32time
                    4⤵
                    • System Time Discovery
                    PID:3496
              • C:\Windows\SYSTEM32\w32tm.exe
                w32tm /config /manualpeerlist:"time.windows.com,0x9 pool.ntp.org,0x9" /syncfromflags:manual /reliable:no /update
                2⤵
                  PID:2752
                • C:\Windows\SYSTEM32\w32tm.exe
                  w32tm /resync /rediscover
                  2⤵
                    PID:1684
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "try{ $ex=@((Get-MpPreference).ExclusionPath); $want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll'); $stale='C:\Users\Admin\AppData\Local\Temp'; $miss=$want | Where-Object { $ex -notcontains $_ }; if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1} }catch{exit 1}"
                    2⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Enumerates connected drives
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2680
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';$want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll');$stale='C:\Users\Admin\AppData\Local\Temp';foreach($p in $want){ $ex=@((Get-MpPreference).ExclusionPath); if($ex -notcontains $p){ Add-MpPreference -ExclusionPath $p }};if($stale -and @((Get-MpPreference).ExclusionPath) -contains $stale){ Remove-MpPreference -ExclusionPath $stale};$ex=@((Get-MpPreference).ExclusionPath);$miss=$want | Where-Object { $ex -notcontains $_ };if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1}"
                    2⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Enumerates connected drives
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3276
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/projectreal
                    2⤵
                    • Checks processor information in registry
                    • Enumerates system info in registry
                    • Modifies registry class
                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of WriteProcessMemory
                    PID:3284
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2e0,0x7ffadedcc188,0x7ffadedcc194,0x7ffadedcc1a0
                      3⤵
                        PID:3992
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,4623735666570640854,17838431442985974046,524288 --field-trial-handle=2776,i,8159829728582129820,17441007301561452148,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:3
                        3⤵
                        • System Time Discovery
                        PID:5072
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,15599230052525914963,15730742146518443007,262144 --field-trial-handle=2776,i,8159829728582129820,17441007301561452148,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:2
                        3⤵
                          PID:1948
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2192,i,10557542062999096489,10065703745621922768,524288 --field-trial-handle=2776,i,8159829728582129820,17441007301561452148,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:8
                          3⤵
                            PID:3752
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,16962244921331755630,9981257015714091741,2097152 --field-trial-handle=2776,i,8159829728582129820,17441007301561452148,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
                            3⤵
                              PID:5176
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,18013562112706426609,9670690620043471550,2097152 --field-trial-handle=2776,i,8159829728582129820,17441007301561452148,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
                              3⤵
                                PID:5184
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,16783161825853159224,14840763339630685433,2097152 --field-trial-handle=2776,i,8159829728582129820,17441007301561452148,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
                                3⤵
                                  PID:5332
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,16295472270949952891,46528920912445509,2097152 --field-trial-handle=2776,i,8159829728582129820,17441007301561452148,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:2
                                  3⤵
                                    PID:5340
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,16299487876903232394,8638160117239269559,524288 --field-trial-handle=2776,i,8159829728582129820,17441007301561452148,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
                                    3⤵
                                      PID:5684
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,12899899890655721097,9406378893966744307,524288 --field-trial-handle=2776,i,8159829728582129820,17441007301561452148,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
                                      3⤵
                                        PID:5864
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5408,i,10671248199110601114,15305079569556353483,2097152 --field-trial-handle=2776,i,8159829728582129820,17441007301561452148,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:1
                                        3⤵
                                          PID:5912
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3532,i,12499133084705084413,7049889664958439589,524288 --field-trial-handle=2776,i,8159829728582129820,17441007301561452148,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:8
                                          3⤵
                                            PID:1128
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,5156189077361358092,13325951822420014386,524288 --field-trial-handle=2776,i,8159829728582129820,17441007301561452148,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:8
                                            3⤵
                                              PID:2820
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,15903366441561852853,4811584526202728595,524288 --field-trial-handle=2776,i,8159829728582129820,17441007301561452148,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:8
                                              3⤵
                                              • Modifies registry class
                                              PID:5424
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,6941864859238387743,8560975516150692587,524288 --field-trial-handle=2776,i,8159829728582129820,17441007301561452148,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
                                              3⤵
                                                PID:5404
                                            • C:\Users\Admin\AppData\Local\Real\Update.exe
                                              "C:\Users\Admin\AppData\Local\Real\Update.exe" --processStart Real.exe
                                              2⤵
                                              • Executes dropped EXE
                                              • Reads the TCP/IP host and domain name from the registry
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of WriteProcessMemory
                                              PID:392
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';$want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll');$stale='C:\Users\Admin\AppData\Local\Temp';foreach($p in $want){ $ex=@((Get-MpPreference).ExclusionPath); if($ex -notcontains $p){ Add-MpPreference -ExclusionPath $p }};if($stale -and @((Get-MpPreference).ExclusionPath) -contains $stale){ Remove-MpPreference -ExclusionPath $stale};$ex=@((Get-MpPreference).ExclusionPath);$miss=$want | Where-Object { $ex -notcontains $_ };if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1}"
                                                3⤵
                                                • Command and Scripting Interpreter: PowerShell
                                                • Enumerates connected drives
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:5352
                                          • C:\Users\Admin\AppData\Local\Real\Update.exe
                                            C:\Users\Admin\AppData\Local\Real\Update.exe
                                            1⤵
                                            • Executes dropped EXE
                                            • Reads the TCP/IP host and domain name from the registry
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of WriteProcessMemory
                                            PID:1688
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';$want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll');$stale='C:\Users\Admin\AppData\Local\Temp';foreach($p in $want){ $ex=@((Get-MpPreference).ExclusionPath); if($ex -notcontains $p){ Add-MpPreference -ExclusionPath $p }};if($stale -and @((Get-MpPreference).ExclusionPath) -contains $stale){ Remove-MpPreference -ExclusionPath $stale};$ex=@((Get-MpPreference).ExclusionPath);$miss=$want | Where-Object { $ex -notcontains $_ };if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1}"
                                              2⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              • Enumerates connected drives
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:3712
                                            • C:\Users\Admin\AppData\Local\Real\real-2.7.3\Real.exe
                                              "C:\Users\Admin\AppData\Local\Real\real-2.7.3\Real.exe" --real-launched-by-updater
                                              2⤵
                                              • Executes dropped EXE
                                              • Checks whether UAC is enabled
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of FindShellTrayWindow
                                              • Suspicious use of SendNotifyMessage
                                              • Suspicious use of WriteProcessMemory
                                              PID:6432
                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=6432.6540.17854069598150966814
                                                3⤵
                                                • Drops file in Program Files directory
                                                • Enumerates system info in registry
                                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                • Suspicious use of WriteProcessMemory
                                                PID:6544
                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x19c,0x7ffadf2fb078,0x7ffadf2fb084,0x7ffadf2fb090
                                                  4⤵
                                                    PID:6572
                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1880,i,15935115535025588016,2628194128636341799,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1752 /prefetch:2
                                                    4⤵
                                                      PID:6084
                                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1720,i,15935115535025588016,2628194128636341799,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:3
                                                      4⤵
                                                        PID:5692
                                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2272,i,15935115535025588016,2628194128636341799,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:8
                                                        4⤵
                                                          PID:3088
                                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3480,i,15935115535025588016,2628194128636341799,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
                                                          4⤵
                                                            PID:6908
                                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4380,i,15935115535025588016,2628194128636341799,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
                                                            4⤵
                                                              PID:5536
                                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2144,i,15935115535025588016,2628194128636341799,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:8
                                                              4⤵
                                                                PID:332
                                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4812,i,15935115535025588016,2628194128636341799,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:8
                                                                4⤵
                                                                  PID:4224
                                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=760,i,15935115535025588016,2628194128636341799,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
                                                                  4⤵
                                                                    PID:4424
                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4220,i,15935115535025588016,2628194128636341799,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:8
                                                                    4⤵
                                                                      PID:6864
                                                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4772,i,15935115535025588016,2628194128636341799,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:8
                                                                      4⤵
                                                                        PID:6060
                                                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=960,i,15935115535025588016,2628194128636341799,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:8
                                                                        4⤵
                                                                          PID:3540
                                                                      • C:\Windows\system32\reg.exe
                                                                        "reg" query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
                                                                        3⤵
                                                                        • Modifies registry key
                                                                        PID:6736
                                                                      • C:\Users\Admin\AppData\Local\Real\real-2.7.3\bin\Real.exe
                                                                        "C:\Users\Admin\AppData\Local\Real\real-2.7.3\bin\Real.exe" --rbxversion
                                                                        3⤵
                                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                        • Checks BIOS information in registry
                                                                        • Executes dropped EXE
                                                                        • Checks whether UAC is enabled
                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                        PID:5712
                                                                      • C:\Users\Admin\AppData\Local\Real\real-2.7.3\bin\luau-lsp.exe
                                                                        "C:\Users\Admin\AppData\Local\Real\real-2.7.3\bin\luau-lsp.exe" lsp --stdio --definitions @roblox=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\roblox.PluginSecurity.d.luau --definitions @real=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\real_executor_apis.d.luau --docs=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\roblox-api-docs.json --base-luaurc=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\base.luaurc
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        PID:5700
                                                                      • C:\Windows\system32\reg.exe
                                                                        "reg" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion"
                                                                        3⤵
                                                                          PID:5768
                                                                        • C:\Windows\system32\reg.exe
                                                                          "reg" query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
                                                                          3⤵
                                                                          • Modifies registry key
                                                                          PID:4712
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://projectreal.gg/register?app_auth=1&state=VhsKi5pJaD-zE7zsl2NiRBdfUuyy0Z7BIU2T6erbhnc&app_auth_protocol=3&login_attempt_id=w3Ll1Hds1eeNZrMNDPcFauWvty1OUqWfTdc0t0hxlac&code_challenge=cB_B6Z36keZUtR5RFbXUUhbb34B_bIHcMiB9g3-U0l0&code_challenge_method=S256&loopback_port=58600#real_app_auth_v=2&hwid=HWIDv6_6b14ece99ba6b57e48184e941c87b2a8d0d81962a378e0d0c123ba15f49f6da3&hwidCoverage=30&anchors=%7B%22machineGuid%22%3A%22present%22%2C%22machineSid%22%3A%22present%22%2C%22permanentMac%22%3A%22present%22%2C%22storageSerial%22%3A%22present%22%2C%22tpmEk%22%3A%22missing%22%7D&devicePublicKey=MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEpIsbOI4mSKq9yMa-35irvI2I2nBwKG8Df592Bn-qlFvQHROIgbQUdXgBTSdP236oddlg2QLQAEtU6lAxUvD8Pg&deviceProof=MEYCIQDL3baMi2x_V63NPhExLYuP36RfG-JUR4D4DKGxC0oCmgIhAKOpCI_01i8veT4kVn0ZVAnQNnObO_aG9HsdhZ280DZ7&proofTs=1790740137287&proofNonce=FI3hdMpwvQHpydMRD3WbwAkC98vth_44XiFCBDInqaM
                                                                          3⤵
                                                                            PID:2180
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://projectreal.gg/register?app_auth=1&state=VhsKi5pJaD-zE7zsl2NiRBdfUuyy0Z7BIU2T6erbhnc&app_auth_protocol=3&login_attempt_id=w3Ll1Hds1eeNZrMNDPcFauWvty1OUqWfTdc0t0hxlac&code_challenge=cB_B6Z36keZUtR5RFbXUUhbb34B_bIHcMiB9g3-U0l0&code_challenge_method=S256&loopback_port=58600#real_app_auth_v=2&hwid=HWIDv6_6b14ece99ba6b57e48184e941c87b2a8d0d81962a378e0d0c123ba15f49f6da3&hwidCoverage=30&anchors=%7B%22machineGuid%22%3A%22present%22%2C%22machineSid%22%3A%22present%22%2C%22permanentMac%22%3A%22present%22%2C%22storageSerial%22%3A%22present%22%2C%22tpmEk%22%3A%22missing%22%7D&devicePublicKey=MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEpIsbOI4mSKq9yMa-35irvI2I2nBwKG8Df592Bn-qlFvQHROIgbQUdXgBTSdP236oddlg2QLQAEtU6lAxUvD8Pg&deviceProof=MEYCIQDL3baMi2x_V63NPhExLYuP36RfG-JUR4D4DKGxC0oCmgIhAKOpCI_01i8veT4kVn0ZVAnQNnObO_aG9HsdhZ280DZ7&proofTs=1790740137287&proofNonce=FI3hdMpwvQHpydMRD3WbwAkC98vth_44XiFCBDInqaM
                                                                              4⤵
                                                                              • Drops file in Program Files directory
                                                                              • Checks SCSI registry key(s)
                                                                              • Checks processor information in registry
                                                                              • Enumerates system info in registry
                                                                              • Modifies registry class
                                                                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                              • Suspicious use of FindShellTrayWindow
                                                                              PID:5224
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ffadedcc188,0x7ffadedcc194,0x7ffadedcc1a0
                                                                                5⤵
                                                                                  PID:5228
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,14923772105915337546,2569674882001581768,524288 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:3
                                                                                  5⤵
                                                                                  • Downloads MZ/PE file
                                                                                  • System Time Discovery
                                                                                  PID:5204
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,12958279384796514548,1220497271512968600,262144 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
                                                                                  5⤵
                                                                                    PID:5284
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,1682275271039157335,13774040112081003010,524288 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:8
                                                                                    5⤵
                                                                                      PID:6752
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3384,i,17638913460171989311,16181698892985519602,2097152 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
                                                                                      5⤵
                                                                                        PID:3260
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3388,i,17158603403631428306,7169207626111906919,2097152 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
                                                                                        5⤵
                                                                                          PID:4760
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,14701566241930173957,8933037930459029636,524288 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:8
                                                                                          5⤵
                                                                                            PID:7080
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,9112080958525929818,10229939705688030559,524288 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:8
                                                                                            5⤵
                                                                                              PID:6284
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,15867845540116382891,10796782492392776274,524288 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:8
                                                                                              5⤵
                                                                                                PID:5796
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,18329087351368934478,4157944947747079166,524288 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:8
                                                                                                5⤵
                                                                                                  PID:5236
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,14955746843623461287,7052741062318716010,524288 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:8
                                                                                                  5⤵
                                                                                                    PID:6564
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,14955746843623461287,7052741062318716010,524288 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:8
                                                                                                    5⤵
                                                                                                      PID:6200
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,12828044483004811521,9411867406610357131,524288 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
                                                                                                      5⤵
                                                                                                        PID:2004
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,6803313598162379433,14293330280531144791,524288 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
                                                                                                        5⤵
                                                                                                          PID:1892
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,12447772140158478531,8363555142656092623,524288 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
                                                                                                          5⤵
                                                                                                            PID:7140
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,11221910015718314332,7058303548682423510,524288 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
                                                                                                            5⤵
                                                                                                              PID:7144
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6332,i,1690382282682911170,15092783018968856429,2097152 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:1
                                                                                                              5⤵
                                                                                                                PID:1292
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,13310011613901481286,9563535858088889568,524288 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:8
                                                                                                                5⤵
                                                                                                                  PID:4068
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3324,i,5036703850806824730,9175241220757668142,2097152 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:1
                                                                                                                  5⤵
                                                                                                                    PID:5640
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,3108414345843907513,9019946436248145487,524288 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
                                                                                                                    5⤵
                                                                                                                      PID:6988
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,10491473009953506563,363670453534722453,524288 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
                                                                                                                      5⤵
                                                                                                                        PID:3436
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,4765005771862875272,13512755169768297987,524288 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:8
                                                                                                                        5⤵
                                                                                                                          PID:6864
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,5975613065266864829,18055364005167861797,524288 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
                                                                                                                          5⤵
                                                                                                                            PID:4344
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6940,i,9450883485261068377,185334705403753135,524288 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:8
                                                                                                                            5⤵
                                                                                                                              PID:2808
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,16611045981962608637,13272873157258195242,524288 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:8
                                                                                                                              5⤵
                                                                                                                                PID:3500
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6732,i,1606949667740672509,2533141277088958183,524288 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:8
                                                                                                                                5⤵
                                                                                                                                  PID:7044
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,13193380153624661526,9425455699352605238,524288 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
                                                                                                                                  5⤵
                                                                                                                                    PID:6200
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6776,i,1258677123712163834,9758882418674714113,262144 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:8
                                                                                                                                    5⤵
                                                                                                                                      PID:1008
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,5171572029640244319,15648655973230995744,524288 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:8
                                                                                                                                      5⤵
                                                                                                                                        PID:3972
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5128,i,8729257575070021891,15316115567942951726,2097152 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:1
                                                                                                                                        5⤵
                                                                                                                                          PID:6980
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=3452,i,5581540889125311418,6206092113901976240,2097152 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:1
                                                                                                                                          5⤵
                                                                                                                                            PID:6528
                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=6776,i,10554481030756548461,6344248019846507179,2097152 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:1
                                                                                                                                            5⤵
                                                                                                                                              PID:2620
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=6176,i,18064001321478933970,15779410291868966707,2097152 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:1
                                                                                                                                              5⤵
                                                                                                                                                PID:2716
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=6348,i,16061772703353427107,10729653535316949542,2097152 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:1
                                                                                                                                                5⤵
                                                                                                                                                  PID:372
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=5324,i,8276117522051002935,11830237277917731856,2097152 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:1
                                                                                                                                                  5⤵
                                                                                                                                                    PID:5448
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=5956,i,12285475151103846224,8773726454784562453,2097152 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:1
                                                                                                                                                    5⤵
                                                                                                                                                      PID:1244
                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7064,i,3476868884029972766,8616732865310726062,2097152 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:1
                                                                                                                                                      5⤵
                                                                                                                                                        PID:6048
                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=6224,i,4499407062403340138,7325871491548336427,2097152 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:1
                                                                                                                                                        5⤵
                                                                                                                                                          PID:6160
                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=6236,i,2621780671792005360,12648935590258218788,2097152 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:1
                                                                                                                                                          5⤵
                                                                                                                                                            PID:1480
                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=7152,i,8548732605606721093,16225761477890517651,2097152 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:1
                                                                                                                                                            5⤵
                                                                                                                                                              PID:556
                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=7228,i,6418525697307120506,16296845143382062189,2097152 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:1
                                                                                                                                                              5⤵
                                                                                                                                                                PID:3816
                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=7332,i,17888662580780590422,13490278754005609721,2097152 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=7348 /prefetch:1
                                                                                                                                                                5⤵
                                                                                                                                                                  PID:1444
                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=7544,i,2557510342823724102,15151869848323257377,2097152 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=7548 /prefetch:1
                                                                                                                                                                  5⤵
                                                                                                                                                                    PID:312
                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=7712,i,9229509702527714002,10111488709786821105,2097152 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=7620 /prefetch:1
                                                                                                                                                                    5⤵
                                                                                                                                                                      PID:4592
                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,370045421549125010,15400532955503586096,524288 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
                                                                                                                                                                      5⤵
                                                                                                                                                                        PID:6660
                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,231600758175479924,13724111949786452457,524288 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:8
                                                                                                                                                                        5⤵
                                                                                                                                                                          PID:3472
                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8024,i,5299242752581904620,17926636506924113238,524288 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=8020 /prefetch:8
                                                                                                                                                                          5⤵
                                                                                                                                                                            PID:7084
                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7992,i,1431273502007063408,1749315874789472611,524288 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=7984 /prefetch:8
                                                                                                                                                                            5⤵
                                                                                                                                                                              PID:5108
                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8168,i,63646692246110094,11283150711490467931,524288 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=8148 /prefetch:8
                                                                                                                                                                              5⤵
                                                                                                                                                                                PID:6032
                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=8180,i,10522953886884992035,11316328505050798966,2097152 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=8336 /prefetch:1
                                                                                                                                                                                5⤵
                                                                                                                                                                                  PID:2984
                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8456,i,1110774107877770669,11106770180036161000,524288 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=8452 /prefetch:8
                                                                                                                                                                                  5⤵
                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                  PID:2052
                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8644,i,7468082821730610871,14807931170023394918,524288 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=8556 /prefetch:8
                                                                                                                                                                                  5⤵
                                                                                                                                                                                    PID:3684
                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8000,i,7750432351618719889,16568533058234419153,524288 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=8140 /prefetch:8
                                                                                                                                                                                    5⤵
                                                                                                                                                                                      PID:7004
                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,5190630272175577798,2567158167883195112,524288 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=8140 /prefetch:8
                                                                                                                                                                                      5⤵
                                                                                                                                                                                        PID:2244
                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=3936,i,853815365058832243,2461343327192282608,2097152 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:1
                                                                                                                                                                                        5⤵
                                                                                                                                                                                          PID:6996
                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8668,i,10083092926726754629,4369616536079386527,524288 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=8788 /prefetch:8
                                                                                                                                                                                          5⤵
                                                                                                                                                                                            PID:5596
                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8984,i,11271920316377558491,179651551367754305,524288 --field-trial-handle=2348,i,11801728024072501727,16054228210758223940,262144 --variations-seed-version --mojo-platform-channel-handle=8884 /prefetch:8
                                                                                                                                                                                            5⤵
                                                                                                                                                                                              PID:2196
                                                                                                                                                                                            • C:\Users\Admin\Downloads\OperaInstaller.exe
                                                                                                                                                                                              "C:\Users\Admin\Downloads\OperaInstaller.exe"
                                                                                                                                                                                              5⤵
                                                                                                                                                                                              • Downloads MZ/PE file
                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:4844
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\OpInst.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\OpInst.exe" --silent --allusers=0 --setdefaultbrowser=1
                                                                                                                                                                                                6⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:3128
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS83C1B50D\installer.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zS83C1B50D\installer.exe --silent --allusers=0 --setdefaultbrowser=1 --server-tracking-blob=YTUyZjgzYzNlN2RiMmNhNTY4OGZiNDliNzZkNWM4ZDIxZWVjNzNlNmQ1MDBmMjgxMmYxNDdkZDdiMzY3NTliMzp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5X29wZXJhJnV0bV9jb250ZW50PTYxMjYzNCIsInRpbWVzdGFtcCI6IjE3OTA3NDAzODMuODQyOSIsInVzZXJhZ2VudCI6Ik9wZXJhIEluc3RhbGxlci8xLjAiLCJ1dG0iOnsiY2FtcGFpZ24iOiJzcG90aWZ5X29wZXJhIiwiY29udGVudCI6IjYxMjYzNCIsIm1lZGl1bSI6InBiIiwic291cmNlIjoid3JrIn0sInV1aWQiOiIxYjk3NzdjZC1mNzgwLTRlNDItYjBhZi1mZTAyZGJlNzM3YjUifQ==
                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                  • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                                                                  PID:5668
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS83C1B50D\installer.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zS83C1B50D\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.52 --initial-client-data=0x274,0x278,0x27c,0x250,0x280,0x7ff7d60f6998,0x7ff7d60f69a8,0x7ff7d60f69b8
                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:4288
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\.opera\3ed11b8a-53a2-4290-b54a-c6e9a70a5bde Opera Installer Temp\installer.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\.opera\3ed11b8a-53a2-4290-b54a-c6e9a70a5bde Opera Installer Temp\installer.exe" --version
                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:5656
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS83C1B50D\installer.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7zS83C1B50D\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=5668 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\3ed11b8a-53a2-4290-b54a-c6e9a70a5bde Opera Installer Temp\opera_package_20260930045303" --session-guid=2c1124a5-720f-4473-90ed-eef019071411 --server-tracking-blob=NWQwMWNjNTU3MzY0ODlkNDUyZjFiYjZiNDk3NzFlMWMyMWQ2YjliYTIwOWFkYzIwYzRiMTVjMTBkNzRlMzVkNTp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5X29wZXJhJnV0bV9jb250ZW50PTYxMjYzNCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTc5MDc0MDM4My44NDI5IiwidXNlcmFnZW50IjoiT3BlcmEgSW5zdGFsbGVyLzEuMCIsInV0bSI6eyJjYW1wYWlnbiI6InNwb3RpZnlfb3BlcmEiLCJjb250ZW50IjoiNjEyNjM0IiwibWVkaXVtIjoicGIiLCJzb3VyY2UiOiJ3cmsifSwidXVpZCI6IjFiOTc3N2NkLWY3ODAtNGU0Mi1iMGFmLWZlMDJkYmU3MzdiNSJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=5407000000000000
                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:4512
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS83C1B50D\installer.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zS83C1B50D\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.52 --initial-client-data=0x26c,0x270,0x280,0x248,0x284,0x7ff7d60f6998,0x7ff7d60f69a8,0x7ff7d60f69b8
                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                        PID:6896
                                                                                                                                                                                              • C:\Users\Admin\Downloads\OperaInstaller.exe
                                                                                                                                                                                                "C:\Users\Admin\Downloads\OperaInstaller.exe"
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:3140
                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:5260
                                                                                                                                                                                        • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
                                                                                                                                                                                          C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:5864
                                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:5176
                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:5124
                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:6232

                                                                                                                                                                                                Network

                                                                                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                      Reconnaissance

                                                                                                                                                                                                      Resource Development

                                                                                                                                                                                                      Initial Access

                                                                                                                                                                                                      Execution

                                                                                                                                                                                                      Command and Scripting Interpreter

                                                                                                                                                                                                      2
                                                                                                                                                                                                      T1059

                                                                                                                                                                                                      PowerShell

                                                                                                                                                                                                      1
                                                                                                                                                                                                      T1059.001

                                                                                                                                                                                                      Windows Command Shell

                                                                                                                                                                                                      1
                                                                                                                                                                                                      T1059.003

                                                                                                                                                                                                      Persistence

                                                                                                                                                                                                      Privilege Escalation

                                                                                                                                                                                                      Defense Evasion

                                                                                                                                                                                                      Debugger Evasion

                                                                                                                                                                                                      1
                                                                                                                                                                                                      T1622

                                                                                                                                                                                                      Modify Registry

                                                                                                                                                                                                      1
                                                                                                                                                                                                      T1112

                                                                                                                                                                                                      Virtualization/Sandbox Evasion

                                                                                                                                                                                                      1
                                                                                                                                                                                                      T1497

                                                                                                                                                                                                      Credential Access

                                                                                                                                                                                                      Credentials from Password Stores

                                                                                                                                                                                                      1
                                                                                                                                                                                                      T1555

                                                                                                                                                                                                      Credentials from Web Browsers

                                                                                                                                                                                                      1
                                                                                                                                                                                                      T1555.003

                                                                                                                                                                                                      Unsecured Credentials

                                                                                                                                                                                                      1
                                                                                                                                                                                                      T1552

                                                                                                                                                                                                      Credentials In Files

                                                                                                                                                                                                      1
                                                                                                                                                                                                      T1552.001

                                                                                                                                                                                                      Discovery

                                                                                                                                                                                                      Browser Information Discovery

                                                                                                                                                                                                      1
                                                                                                                                                                                                      T1217

                                                                                                                                                                                                      Debugger Evasion

                                                                                                                                                                                                      1
                                                                                                                                                                                                      T1622

                                                                                                                                                                                                      Network Share Discovery

                                                                                                                                                                                                      1
                                                                                                                                                                                                      T1135

                                                                                                                                                                                                      Peripheral Device Discovery

                                                                                                                                                                                                      2
                                                                                                                                                                                                      T1120

                                                                                                                                                                                                      Query Registry

                                                                                                                                                                                                      9
                                                                                                                                                                                                      T1012

                                                                                                                                                                                                      System Information Discovery

                                                                                                                                                                                                      8
                                                                                                                                                                                                      T1082

                                                                                                                                                                                                      System Location Discovery

                                                                                                                                                                                                      1
                                                                                                                                                                                                      T1614

                                                                                                                                                                                                      System Language Discovery

                                                                                                                                                                                                      1
                                                                                                                                                                                                      T1614.001

                                                                                                                                                                                                      System Network Configuration Discovery

                                                                                                                                                                                                      1
                                                                                                                                                                                                      T1016

                                                                                                                                                                                                      System Time Discovery

                                                                                                                                                                                                      1
                                                                                                                                                                                                      T1124

                                                                                                                                                                                                      Virtualization/Sandbox Evasion

                                                                                                                                                                                                      1
                                                                                                                                                                                                      T1497

                                                                                                                                                                                                      Lateral Movement

                                                                                                                                                                                                      Collection

                                                                                                                                                                                                      Data from Local System

                                                                                                                                                                                                      1
                                                                                                                                                                                                      T1005

                                                                                                                                                                                                      Command and Control

                                                                                                                                                                                                      Web Service

                                                                                                                                                                                                      1
                                                                                                                                                                                                      T1102

                                                                                                                                                                                                      Exfiltration

                                                                                                                                                                                                      Impact

                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                      manifest.json
                                                                                                                                                                                                      • Path C:\Program Files\chrome_Unpacker_BeginUnzipping5224_108019875\manifest.json
                                                                                                                                                                                                      • Size 165B
                                                                                                                                                                                                      • SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      LICENSE
                                                                                                                                                                                                      • Path C:\Program Files\chrome_Unpacker_BeginUnzipping5224_1543333896\LICENSE
                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                      • SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      manifest.json
                                                                                                                                                                                                      • Path C:\Program Files\chrome_Unpacker_BeginUnzipping5224_1543333896\manifest.json
                                                                                                                                                                                                      • Size 78B
                                                                                                                                                                                                      • SHA256 c7e506687caffcf3906916ad3fc190a19212d67a2535479241096bd0d4418b03
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      manifest.json
                                                                                                                                                                                                      • Path C:\Program Files\chrome_Unpacker_BeginUnzipping5224_1702145868\manifest.json
                                                                                                                                                                                                      • Size 135B
                                                                                                                                                                                                      • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      manifest.json
                                                                                                                                                                                                      • Path C:\Program Files\chrome_Unpacker_BeginUnzipping5224_1832138293\manifest.json
                                                                                                                                                                                                      • Size 135B
                                                                                                                                                                                                      • SHA256 cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      manifest.json
                                                                                                                                                                                                      • Path C:\Program Files\chrome_Unpacker_BeginUnzipping5224_30956148\manifest.json
                                                                                                                                                                                                      • Size 43B
                                                                                                                                                                                                      • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      manifest.json
                                                                                                                                                                                                      • Path C:\Program Files\chrome_Unpacker_BeginUnzipping5224_35360733\manifest.json
                                                                                                                                                                                                      • Size 160B
                                                                                                                                                                                                      • SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      manifest.json
                                                                                                                                                                                                      • Path C:\Program Files\chrome_Unpacker_BeginUnzipping5224_733896029\manifest.json
                                                                                                                                                                                                      • Size 85B
                                                                                                                                                                                                      • SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      english_wikipedia.txt
                                                                                                                                                                                                      • Path C:\Program Files\chrome_Unpacker_BeginUnzipping6544_134024793\english_wikipedia.txt
                                                                                                                                                                                                      • Size 269KB
                                                                                                                                                                                                      • SHA256 ff105c5b6e65386cd0af95272607eca296c5b8b786c2f0bb4a9ffef20b4cd4f1
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      manifest.json
                                                                                                                                                                                                      • Path C:\Program Files\chrome_Unpacker_BeginUnzipping6544_134024793\manifest.json
                                                                                                                                                                                                      • Size 69B
                                                                                                                                                                                                      • SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      manifest.json
                                                                                                                                                                                                      • Path C:\Program Files\chrome_Unpacker_BeginUnzipping6544_1525337787\manifest.json
                                                                                                                                                                                                      • Size 113B
                                                                                                                                                                                                      • SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      hyph-as.hyb
                                                                                                                                                                                                      • Path C:\Program Files\chrome_Unpacker_BeginUnzipping6544_1813661142\hyph-as.hyb
                                                                                                                                                                                                      • Size 703B
                                                                                                                                                                                                      • SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      hyph-hi.hyb
                                                                                                                                                                                                      • Path C:\Program Files\chrome_Unpacker_BeginUnzipping6544_1813661142\hyph-hi.hyb
                                                                                                                                                                                                      • Size 687B
                                                                                                                                                                                                      • SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      hyph-nb.hyb
                                                                                                                                                                                                      • Path C:\Program Files\chrome_Unpacker_BeginUnzipping6544_1813661142\hyph-nb.hyb
                                                                                                                                                                                                      • Size 141KB
                                                                                                                                                                                                      • SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      manifest.json
                                                                                                                                                                                                      • Path C:\Program Files\chrome_Unpacker_BeginUnzipping6544_1813661142\manifest.json
                                                                                                                                                                                                      • Size 82B
                                                                                                                                                                                                      • SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      manifest.json
                                                                                                                                                                                                      • Path C:\Program Files\chrome_Unpacker_BeginUnzipping6544_940262337\manifest.json
                                                                                                                                                                                                      • Size 76B
                                                                                                                                                                                                      • SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      powershell.exe.log
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                      • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      blocklist
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                                                                                                                                                      • Size 105KB
                                                                                                                                                                                                      • SHA256 b83cbf64cc348bda7418cf4d51290f954f1a229bfc174076604c71e6316695b1
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      protocols.json
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
                                                                                                                                                                                                      • Size 3KB
                                                                                                                                                                                                      • SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      settings.dat
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                      • Size 280B
                                                                                                                                                                                                      • SHA256 db998f2ab3bc4e87d03b65e45c5cbb178df73d3cf3485b0f37651dcc2814f3c4
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      settings.dat
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                      • Size 280B
                                                                                                                                                                                                      • SHA256 bd838e22e2b02f662548f951457d8a00b717cc0c8fc59ad9bed64019a25de233
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      settings.dat
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                      • Size 280B
                                                                                                                                                                                                      • SHA256 02cf6c2debe9573f3713554c359339f3deb6fa4abd8c14fc6d2577e42ce2d830
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      settings.dat
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                      • Size 280B
                                                                                                                                                                                                      • SHA256 98f220c14bd3d385f1dd482d8b868745c75685e4a2573b4336f235cf3bdce6c1
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      LOG.old
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                                                                                                                      • Size 334B
                                                                                                                                                                                                      • SHA256 96d7112c06cbdefb60db29c85cdcaa8af47093d261d89f57dba99cd895d815d4
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      LOG.old
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                                                                                                                      • Size 334B
                                                                                                                                                                                                      • SHA256 63c159e06cfd81a118197ca8a131fd802380dfc29980224349aa9087fd12e498
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      BookmarkMergedSurfaceOrdering
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                                                                                                      • Size 6B
                                                                                                                                                                                                      • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      f_000073
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
                                                                                                                                                                                                      • Size 346KB
                                                                                                                                                                                                      • SHA256 9be344d8aab52c80881980d24ba1435146143794aebbeb98bcae9a4b41f0bd16
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      f_000087
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
                                                                                                                                                                                                      • Size 23KB
                                                                                                                                                                                                      • SHA256 926f0c9a413d7e94ec6c73c3c8ae01cc31875d915b2933131785a6033fe5ea0e
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      f_000089
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
                                                                                                                                                                                                      • Size 1024KB
                                                                                                                                                                                                      • SHA256 a3d40dbe24720085f21a1a2f5f18b6f5ad20d800330be0f1488e7ffd9c6128ab
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      temp-index
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                                                                                                                                      • Size 10KB
                                                                                                                                                                                                      • SHA256 aa332e1396784c411e09d4ecb3320013dfbd44952beb8e0240b9c6910507ac9e
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      the-real-index
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                      • Size 9KB
                                                                                                                                                                                                      • SHA256 507a9014fd4d2054175560a3641e417d740e59afed550c81020121131cc3294f
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      the-real-index
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                      • Size 10KB
                                                                                                                                                                                                      • SHA256 65d09125f1f18cf0c7a14ca0aae653d55615753d681cd6dc09fa6157dd393d39
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      the-real-index
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                      • Size 12KB
                                                                                                                                                                                                      • SHA256 001b9db23bf985cccb00bebb4dd9d2aa2190cdec4fae72baa955195dcb3dc362
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      the-real-index
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                      • Size 10KB
                                                                                                                                                                                                      • SHA256 b0338d58e64930954efb0057dc44f9e16b9fa97f37eacb985dcd891f680ff75b
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      the-real-index~RFe59907e.TMP
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59907e.TMP
                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                      • SHA256 607a18d416e4c2a8709d0752bbd4e71d0a922839b89124178970cc2fef0d7538
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      SiteList-Enterprise.json
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                                                                                      • Size 2B
                                                                                                                                                                                                      • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Edge Profile.ico
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                                                                                                      • Size 70KB
                                                                                                                                                                                                      • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Network Persistent State
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                      • SHA256 80e4c40b51c449f73adc6a5b0a0d88080ef1c1ff3c8a0b931e737ffe35f099ce
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Network Persistent State
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                      • Size 5KB
                                                                                                                                                                                                      • SHA256 e99730d6ffcfd565342f7e39097026bbb9041efbfb8e4d72930a367c69d00d9d
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Network Persistent State
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                      • SHA256 f0a28100184e5ecf6f1369069a71f4580e55c739d4f2c947e3150d348b9daa11
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Network Persistent State
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                      • Size 6KB
                                                                                                                                                                                                      • SHA256 f5a2f3fe9de76270b274fe8fc74f96c1f264384bb220b5df85e1829d9f94f137
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Network Persistent State
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                      • Size 22KB
                                                                                                                                                                                                      • SHA256 0f39a57bbf46b8834976064184b45145aa01e5c3a1a0a121494522ab974933a9
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Preferences
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                      • Size 9KB
                                                                                                                                                                                                      • SHA256 0e863fcb5c6a39dd311123cd07885494d0ef7f302b28807a060e61bc316477c8
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Preferences
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                      • Size 13KB
                                                                                                                                                                                                      • SHA256 53340e039102fef2d50c210f5cab22034b6d592a5d447e6649003144031f4cfc
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Preferences
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                      • Size 16KB
                                                                                                                                                                                                      • SHA256 4f5d1abea5bbc73ec8001b2f38dc847184ebd56904ac01934e4217b6271761b6
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Preferences
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                      • Size 12KB
                                                                                                                                                                                                      • SHA256 0d523849f6dae503648ca2cbbdbbb86a119c590d818aae7d65e34bed6cf8da3c
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Preferences
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                      • Size 10KB
                                                                                                                                                                                                      • SHA256 96949bdadc8a4228e2a646e439e5caae86260bd279421582fe04c04194916a44
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Preferences
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                      • Size 12KB
                                                                                                                                                                                                      • SHA256 7cd6ec6857ec4a9d3e210f77209602fd8882bbf0935492142e311f55897d580c
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Preferences
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                      • Size 13KB
                                                                                                                                                                                                      • SHA256 68f63cf25dff538a0f0d1e29c9a94de5451fa69a9ce5408aba61f4447ad37516
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Secure Preferences
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                                                                      • Size 27KB
                                                                                                                                                                                                      • SHA256 cdac3aab19928461399c23d5669eef38f1fb8816a12f533bc53ffda3e48f78c7
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      index.txt
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
                                                                                                                                                                                                      • Size 226B
                                                                                                                                                                                                      • SHA256 3d6e82fff45ccaa2176f8275811ffbdf99502384a684f803298e1239d2035909
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      index.txt
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
                                                                                                                                                                                                      • Size 233B
                                                                                                                                                                                                      • SHA256 0422a682751986cad29f345d4a8d35d973c8f64c0e073f73fc6f0c155bd0e9c6
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      index.txt~RFe5969cc.TMP
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5969cc.TMP
                                                                                                                                                                                                      • Size 138B
                                                                                                                                                                                                      • SHA256 780d4ce258e10e9cd248146d65b1f3bc9584b7bbae220dcb8198263918826819
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      sync_diagnostic.log
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                                                                                      • Size 7KB
                                                                                                                                                                                                      • SHA256 b3c6727bdf9b94f171d4e0ae88c21d58323aa33a9423b8bf8d24a7fec6432f5e
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      00000000
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\4\FileSystem\t\00\00000000
                                                                                                                                                                                                      • Size 1B
                                                                                                                                                                                                      • SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      index.txt
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\5\CacheStorage\index.txt
                                                                                                                                                                                                      • Size 88B
                                                                                                                                                                                                      • SHA256 bce148b7bbf8034341af605808359ee7797decf728e0609f04fbfd934de76f12
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      index.txt~RFe5c7fb7.TMP
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\5\CacheStorage\index.txt~RFe5c7fb7.TMP
                                                                                                                                                                                                      • Size 175B
                                                                                                                                                                                                      • SHA256 a0b1bbd7835172a69bf6c2287c51a2e54e79a7e9ded27a49eac80fa79d251db1
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      456e3b98-bc6f-4aaa-bf79-035db434c723.tmp
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\456e3b98-bc6f-4aaa-bf79-035db434c723.tmp
                                                                                                                                                                                                      • Size 22KB
                                                                                                                                                                                                      • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      office_endpoints_list.json
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
                                                                                                                                                                                                      • Size 9KB
                                                                                                                                                                                                      • SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Local State
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                      • Size 8KB
                                                                                                                                                                                                      • SHA256 b76e0e2db9c1b051a881ab3ebf50a48bdab7a2bed2e3f26cbcdcd7c46c63f272
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Local State
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                      • Size 12KB
                                                                                                                                                                                                      • SHA256 60b2d1bdd9e1bd7afee2a9149c3867203755695d4835ab158c3cc5e58c11744f
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Local State
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                      • Size 12KB
                                                                                                                                                                                                      • SHA256 b1422376698e8d4215ae0089b38182c197d85c6f967b349b9f560f80c79951bc
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Local State
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                      • Size 17KB
                                                                                                                                                                                                      • SHA256 161c825eb6d0cf3535db45bd35d9c950b7a82bbbb86721b87177615bb732336f
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Local State
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                      • Size 16KB
                                                                                                                                                                                                      • SHA256 6d4d4747aea2a78239c601cb4258ce0026a2b3c4c635e2de78a54f9d5c3f7c9f
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Local State
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                      • Size 8KB
                                                                                                                                                                                                      • SHA256 9cfa0cd415a6ce1ee26ffe22da333b071452450a69b9b7c15d7f5c2f12aca767
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Local State
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                      • Size 17KB
                                                                                                                                                                                                      • SHA256 c21633b81490e95da065662601f2c58d10db2d355ac3922348a4d46fd7b3d39a
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Local State
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                      • Size 28KB
                                                                                                                                                                                                      • SHA256 a363ddb6f7728d583d65f3b9d1c126bac440abff419adf491a0342d38313f8f6
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      RevisitationBloomfilter
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                      • Size 392B
                                                                                                                                                                                                      • SHA256 4aa669fa96b51ad69b08228856585ccfe69c03f35d8cd24faa3f0541278e9eea
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      RevisitationBloomfilter
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                      • Size 392B
                                                                                                                                                                                                      • SHA256 1e910ad67c89f1fd8c7f28b6e644f3c0c49260b63a3a68aacc625d47405732da
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      RevisitationBloomfilter
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                      • Size 392B
                                                                                                                                                                                                      • SHA256 570d0dfd75134868d6ef2b8b104a0ecc4e1639b4e00634c36a7f1882e8e1e520
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      RevisitationBloomfilter
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                      • Size 392B
                                                                                                                                                                                                      • SHA256 bac63685dd14087fb015b23a822d8a5c15afea3fd5616bad9137d0398f34ecd2
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      RevisitationBloomfilter~RFe5b7dd7.TMP
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5b7dd7.TMP
                                                                                                                                                                                                      • Size 392B
                                                                                                                                                                                                      • SHA256 9f53a045e497e66d44685f9c0ef8f74b3fab53dab14c3220a4c5fb6a69798f39
                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      keys.json
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.8.3.1\keys.json
                                                                                                                                                                                                      • Size 8KB
                                                                                                                                                                                                      • SHA256 3d6c659801f1686ff3ac64bc3b24b1d0ae76ffdd5f0e9c399ba37d1354a15ab4
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      nav_config.json
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                      • SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      metadata.json
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                      • Size 492B
                                                                                                                                                                                                      • SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      metadata.json
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                      • Size 252B
                                                                                                                                                                                                      • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      metadata.json
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                      • Size 852B
                                                                                                                                                                                                      • SHA256 cc631188ae4a22c0621e596be3d4335218373ee3aafe98bb7b213069a0dc3b70
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      metadata.json
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                      • Size 612B
                                                                                                                                                                                                      • SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      metadata.json
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                      • Size 732B
                                                                                                                                                                                                      • SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      metadata.json
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                      • Size 132B
                                                                                                                                                                                                      • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      metadata.json
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                      • Size 372B
                                                                                                                                                                                                      • SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      3d835c1c-e9fc-481d-ad34-c06d88fe0f5f.tmp
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d835c1c-e9fc-481d-ad34-c06d88fe0f5f.tmp
                                                                                                                                                                                                      • Size 13B
                                                                                                                                                                                                      • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                      • Size 944B
                                                                                                                                                                                                      • SHA256 2d206e0c67bac38429a3c306e7ab325ef514565e3cf61f5f26bf754946cd1a76
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                      • Size 944B
                                                                                                                                                                                                      • SHA256 35a882b070c9f98c728af00a387afd3b9473d550a661efce9b8b20b4ad0012df
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      .real-write-probe-392-240736375.tmp
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Real\.real-write-probe-392-240736375.tmp
                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                      • SHA256 aa33996d60e89311b4d1a920dae03c6d7fa3ae1956c52662e273aad4683e577f
                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Update.exe
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Real\Update.exe
                                                                                                                                                                                                      • Size 8.2MB
                                                                                                                                                                                                      • SHA256 b42d62f0e5275ed85cb8451973f6d3b953ab024c685cf9bb90bf10dbf48ad3b2
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      account-vault.dpapi
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Real\data\account-vault.dpapi
                                                                                                                                                                                                      • Size 298B
                                                                                                                                                                                                      • SHA256 4403db6622c0e67144834d4d5805bcb611e74fd09a087c9b524a68e5537442d4
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      crl-set
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
                                                                                                                                                                                                      • Size 22KB
                                                                                                                                                                                                      • SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      settings.dat
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad\settings.dat
                                                                                                                                                                                                      • Size 280B
                                                                                                                                                                                                      • SHA256 11f66450a07a0a3f990f476181dce894dc6f8fe71768089fd0cce31b6780f9af
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      the-real-index
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                      • Size 576B
                                                                                                                                                                                                      • SHA256 c90190d62de5c4a64ca86a15ed110e32681dcbaba70a3cfa9a029a2cdcd65458
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      the-real-index~RFe59ecc7.TMP
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59ecc7.TMP
                                                                                                                                                                                                      • Size 48B
                                                                                                                                                                                                      • SHA256 1456068d44514dee334b1a0dc248b84c54a3816e96f7be17c08dd5d685ccb82f
                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      42137ae6-d4ca-441b-94ba-484d913d39fe.tmp
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Network\42137ae6-d4ca-441b-94ba-484d913d39fe.tmp
                                                                                                                                                                                                      • Size 40B
                                                                                                                                                                                                      • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Preferences
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Preferences
                                                                                                                                                                                                      • Size 6KB
                                                                                                                                                                                                      • SHA256 0014967be7afc98337ac74645fec014ae294e42681f289fe944940b38102b73c
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Preferences
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Preferences
                                                                                                                                                                                                      • Size 6KB
                                                                                                                                                                                                      • SHA256 7ad0aee8991d54c738a3c173f9ed934560824ff383670c4509afbdba45b60398
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Preferences~RFe59e11f.TMP
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Preferences~RFe59e11f.TMP
                                                                                                                                                                                                      • Size 6KB
                                                                                                                                                                                                      • SHA256 e64ec93231d7105f3d0075e12868527dfe497c6189b3fd835099bc086dd1a9a8
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Local State
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
                                                                                                                                                                                                      • Size 16KB
                                                                                                                                                                                                      • SHA256 97bd9ba4be56f3e1c79c749dd2994e76f53ae582c9e600cce0b039c6cb27989d
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Local State
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                      • SHA256 4bfb519870f297012f3c049880e9c082cecf915dc42308ac3a9be26d851f7ee4
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Local State
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                      • SHA256 58cc7913757ac7ea2edd7206c9c042006f0c6d61c4aea6b86dad0ac096f47de9
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Local State
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
                                                                                                                                                                                                      • Size 3KB
                                                                                                                                                                                                      • SHA256 562ed6db8b17ac892a879535a73534294c6a32b4f61eb1e802fb1de295eee0ca
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Local State
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
                                                                                                                                                                                                      • Size 16KB
                                                                                                                                                                                                      • SHA256 1b2c1f6ab2497fb17931198b87f7e1cf9b253ba703c8350bcae6d2964edefa8e
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Local State~RFe597f96.TMP
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State~RFe597f96.TMP
                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                      • SHA256 298ba40af1203a6147da54903e43ef6f239c673d395fc01ca0617141be62effe
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      settings.json
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Real\data\config\settings.json
                                                                                                                                                                                                      • Size 228B
                                                                                                                                                                                                      • SHA256 8792491684557930c6a1330096a245f393cef2953a52a21360caacc6abef8508
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      current-version.txt
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Real\data\meta\current-version.txt
                                                                                                                                                                                                      • Size 5B
                                                                                                                                                                                                      • SHA256 0ecfcedbed0573e089c104186c12bf34c0a72e5bb9d4046c7dd586878d212e76
                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      real-taskbar-dark.ico
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Real\icons\real-taskbar-dark.ico
                                                                                                                                                                                                      • Size 38KB
                                                                                                                                                                                                      • SHA256 884cae569dc6d4b82eece32755b3567ce082867c266b27cf6d2fb649e1e91c5f
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Real.exe
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Real\real-2.7.3\Real.exe
                                                                                                                                                                                                      • Size 16.2MB
                                                                                                                                                                                                      • SHA256 0a1a6a6aad2e3f25339a2397f52865794f1a84eb7e6f13628804f40527731c16
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Real.dll
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Real\real-2.7.3\bin\Real.dll
                                                                                                                                                                                                      • Size 4.1MB
                                                                                                                                                                                                      • SHA256 a236f09e9b48b17840ca575b33dc776243155ca0f6a7b26e85eb62d8533225b9
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Real.exe
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Real\real-2.7.3\bin\Real.exe
                                                                                                                                                                                                      • Size 7.9MB
                                                                                                                                                                                                      • SHA256 1b2bdfc2e1dc658da80a696f5df9288fe2de2eb5407cd68e784458fbbfd6612a
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Spoofer.exe
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Real\real-2.7.3\bin\Spoofer.exe
                                                                                                                                                                                                      • Size 3.1MB
                                                                                                                                                                                                      • SHA256 38a0c331f536e3f3b6dd2fb9ecf88c98a8ded1290c8476f15d84d9c232a2f266
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      luau-lsp.exe
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Real\real-2.7.3\bin\luau-lsp.exe
                                                                                                                                                                                                      • Size 16.1MB
                                                                                                                                                                                                      • SHA256 9e85ce9370f208c97f1dfc1b8fcf7185fe64386f23130a65fc834f5323a0d653
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      real-mcp.exe
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Real\real-2.7.3\bin\real-mcp.exe
                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                      • SHA256 a281001f9ebd6c6f4776db34f883186c069bec4eaf878d7d940ff354ad14e6de
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      setup.log
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Real\setup.log
                                                                                                                                                                                                      • Size 399B
                                                                                                                                                                                                      • SHA256 39d60cacec94535c9488b111e2f79d34c8c54f289972cddde5dfd70f77518154
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      setup.log
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Real\setup.log
                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                      • SHA256 dbe9699fde66d0ebdd2fe59e8f395ccf9ac5f0bddc89064745923b999d79db08
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      setup.log
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Real\setup.log
                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                      • SHA256 05f7bdbb8624a5e379fcc602063fc74ab25fd604900c9e0a648f33119dd6f1b8
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      setup.log
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Real\setup.log
                                                                                                                                                                                                      • Size 3KB
                                                                                                                                                                                                      • SHA256 6a8fb4021ee5086b0d6bd06c1af98ca9e2e3aff1c579953eb7e1609b0505d878
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      setup.log
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Real\setup.log
                                                                                                                                                                                                      • Size 4KB
                                                                                                                                                                                                      • SHA256 a2b9c2551108f14d7d45c0fc8701f519782646176bcff5c372f7ffa62f91f52d
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      installer.exe
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\.opera\3ed11b8a-53a2-4290-b54a-c6e9a70a5bde Opera Installer Temp\installer.exe
                                                                                                                                                                                                      • Size 8.3MB
                                                                                                                                                                                                      • SHA256 a98e228f9d31c84cec88654b9fbf48e8bbec816fd1ab935572f448fd997c2c31
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      41dbb2ea-bc97-4887-879c-6458751676f7.tmp
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\41dbb2ea-bc97-4887-879c-6458751676f7.tmp
                                                                                                                                                                                                      • Size 157KB
                                                                                                                                                                                                      • SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      OpInst.exe
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\OpInst.exe
                                                                                                                                                                                                      • Size 3.1MB
                                                                                                                                                                                                      • SHA256 54964baa0882a59b15a190239bd02539ce3a0e527f41bb96842c029ec352193a
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      3b66879f-394b-4787-a2db-b1d7a6f1faaf.tmp
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D99881E-E2E2-4337-A487-7F9C412621C7}\wv2\EBWebView\3b66879f-394b-4787-a2db-b1d7a6f1faaf.tmp
                                                                                                                                                                                                      • Size 4KB
                                                                                                                                                                                                      • SHA256 94682ce36e711c0462fcd7167870be20bfa27f4f15701448193300534a51b4ba
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      settings.dat
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D99881E-E2E2-4337-A487-7F9C412621C7}\wv2\EBWebView\Crashpad\settings.dat
                                                                                                                                                                                                      • Size 280B
                                                                                                                                                                                                      • SHA256 b838b8da848566618183eb408a7048a22da02a37ad3ac50eec1015d336accef1
                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      settings.dat
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D99881E-E2E2-4337-A487-7F9C412621C7}\wv2\EBWebView\Crashpad\settings.dat
                                                                                                                                                                                                      • Size 280B
                                                                                                                                                                                                      • SHA256 6d5de68a158e5473b45f869bdc3069d33675b31239820d7c567a27dfa6ae5c11
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      throttle_store.dat
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D99881E-E2E2-4337-A487-7F9C412621C7}\wv2\EBWebView\Crashpad\throttle_store.dat
                                                                                                                                                                                                      • Size 20B
                                                                                                                                                                                                      • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      7a5220a4-3aab-467c-9004-17233890892b.tmp
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D99881E-E2E2-4337-A487-7F9C412621C7}\wv2\EBWebView\Default\7a5220a4-3aab-467c-9004-17233890892b.tmp
                                                                                                                                                                                                      • Size 6KB
                                                                                                                                                                                                      • SHA256 cb83af360b0ac4d3525067d12ab419cba4cf2f75b279e550c861131d67421a8c
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      index
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D99881E-E2E2-4337-A487-7F9C412621C7}\wv2\EBWebView\Default\Cache\Cache_Data\index
                                                                                                                                                                                                      • Size 256KB
                                                                                                                                                                                                      • SHA256 d3b64d9c9beea29f8d551d82ba6bf25b089e8081ea7734a4d820f54e866072b8
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      the-real-index
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D99881E-E2E2-4337-A487-7F9C412621C7}\wv2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                      • Size 48B
                                                                                                                                                                                                      • SHA256 d821663af69a19962e32a297dadcee122016da8633f6fb06ce17a0c9ced81343
                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      index
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D99881E-E2E2-4337-A487-7F9C412621C7}\wv2\EBWebView\Default\Code Cache\wasm\index
                                                                                                                                                                                                      • Size 24B
                                                                                                                                                                                                      • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      the-real-index
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D99881E-E2E2-4337-A487-7F9C412621C7}\wv2\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index
                                                                                                                                                                                                      • Size 48B
                                                                                                                                                                                                      • SHA256 bdf4a8eb55146dec78547c5ef2007b436ad7b57f1def00efe7a67743ed4b0116
                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      data_0
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D99881E-E2E2-4337-A487-7F9C412621C7}\wv2\EBWebView\Default\DawnWebGPUCache\data_0
                                                                                                                                                                                                      • Size 8KB
                                                                                                                                                                                                      • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      data_1
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D99881E-E2E2-4337-A487-7F9C412621C7}\wv2\EBWebView\Default\DawnWebGPUCache\data_1
                                                                                                                                                                                                      • Size 264KB
                                                                                                                                                                                                      • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      data_1
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D99881E-E2E2-4337-A487-7F9C412621C7}\wv2\EBWebView\Default\DawnWebGPUCache\data_1
                                                                                                                                                                                                      • Size 264KB
                                                                                                                                                                                                      • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      data_2
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D99881E-E2E2-4337-A487-7F9C412621C7}\wv2\EBWebView\Default\DawnWebGPUCache\data_2
                                                                                                                                                                                                      • Size 8KB
                                                                                                                                                                                                      • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      data_3
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D99881E-E2E2-4337-A487-7F9C412621C7}\wv2\EBWebView\Default\DawnWebGPUCache\data_3
                                                                                                                                                                                                      • Size 8KB
                                                                                                                                                                                                      • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      index
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D99881E-E2E2-4337-A487-7F9C412621C7}\wv2\EBWebView\Default\DawnWebGPUCache\index
                                                                                                                                                                                                      • Size 256KB
                                                                                                                                                                                                      • SHA256 5cdf9f6eae759531b9a37f81d5700e3427377a034ab4a9280ea9e5982e9f204b
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      LOG
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D99881E-E2E2-4337-A487-7F9C412621C7}\wv2\EBWebView\Default\Extension Rules\LOG
                                                                                                                                                                                                      • Size 367B
                                                                                                                                                                                                      • SHA256 b35ce213d19170f85fa55def1874f5e225e8632bc385f689fadd6eb3d70e81dc
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      000003.log
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D99881E-E2E2-4337-A487-7F9C412621C7}\wv2\EBWebView\Default\Extension Scripts\000003.log
                                                                                                                                                                                                      • Size 38B
                                                                                                                                                                                                      • SHA256 1c43a1bda1e458863c46dfae7fb43bfb3e27802169f37320399b1dd799a819ac
                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      LOG
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D99881E-E2E2-4337-A487-7F9C412621C7}\wv2\EBWebView\Default\Extension Scripts\LOG
                                                                                                                                                                                                      • Size 371B
                                                                                                                                                                                                      • SHA256 c1809ab8efd7b2a3c22163e7a0326fa2ce6b0b16d3593d43f5d4c4b7b656bd1d
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      000003.log
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D99881E-E2E2-4337-A487-7F9C412621C7}\wv2\EBWebView\Default\Extension State\000003.log
                                                                                                                                                                                                      • Size 114B
                                                                                                                                                                                                      • SHA256 e2610960c3757d1757f206c7b84378efa22d86dcf161a98096a5f0e56e1a367e
                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      LOG
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D99881E-E2E2-4337-A487-7F9C412621C7}\wv2\EBWebView\Default\Extension State\LOG
                                                                                                                                                                                                      • Size 367B
                                                                                                                                                                                                      • SHA256 13d3290e4b2c76436e41487589af1d130c89e1caf84e9d9157c5559daa27083b
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Favicons
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D99881E-E2E2-4337-A487-7F9C412621C7}\wv2\EBWebView\Default\Favicons
                                                                                                                                                                                                      • Size 20KB
                                                                                                                                                                                                      • SHA256 46b5ecada4edb2585f87953f7847aefc938be2404b9d9455c772b97295b7b1cb
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      index
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D99881E-E2E2-4337-A487-7F9C412621C7}\wv2\EBWebView\Default\GPUCache\index
                                                                                                                                                                                                      • Size 256KB
                                                                                                                                                                                                      • SHA256 92776c0e2551403ecbbe821b74cc8287b81330633b4ede70e3db8a8a55d15fc6
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      History
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D99881E-E2E2-4337-A487-7F9C412621C7}\wv2\EBWebView\Default\History
                                                                                                                                                                                                      • Size 184KB
                                                                                                                                                                                                      • SHA256 7ac0739f534f89ae63c46cd41f0cffaf0335fe348933e3e3d660044351f2a746
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Network Persistent State
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D99881E-E2E2-4337-A487-7F9C412621C7}\wv2\EBWebView\Default\Network\Network Persistent State
                                                                                                                                                                                                      • Size 111B
                                                                                                                                                                                                      • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Network Persistent State~RFe5972f4.TMP
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D99881E-E2E2-4337-A487-7F9C412621C7}\wv2\EBWebView\Default\Network\Network Persistent State~RFe5972f4.TMP
                                                                                                                                                                                                      • Size 59B
                                                                                                                                                                                                      • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      SCT Auditing Pending Reports
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D99881E-E2E2-4337-A487-7F9C412621C7}\wv2\EBWebView\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                                      • Size 2B
                                                                                                                                                                                                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      CURRENT
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D99881E-E2E2-4337-A487-7F9C412621C7}\wv2\EBWebView\Default\Sync Data\LevelDB\CURRENT
                                                                                                                                                                                                      • Size 16B
                                                                                                                                                                                                      • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      MANIFEST-000001
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D99881E-E2E2-4337-A487-7F9C412621C7}\wv2\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
                                                                                                                                                                                                      • Size 41B
                                                                                                                                                                                                      • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Local State
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D99881E-E2E2-4337-A487-7F9C412621C7}\wv2\EBWebView\Local State
                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                      • SHA256 f572616c1b888ebdb00402554d912ed1d4db8f540ad9e0797df6e6e69a96be5c
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Local State
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D99881E-E2E2-4337-A487-7F9C412621C7}\wv2\EBWebView\Local State
                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                      • SHA256 74f59b72bf23adb0584bb760144dc4db857187b5c1b35f19b80e148e5bfae9a6
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Local State
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D99881E-E2E2-4337-A487-7F9C412621C7}\wv2\EBWebView\Local State
                                                                                                                                                                                                      • Size 4KB
                                                                                                                                                                                                      • SHA256 1cf1c7e93e2c2f827c8579947f9b79fb90519a79a1005f6ecc395fd3c58365fe
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Local State
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D99881E-E2E2-4337-A487-7F9C412621C7}\wv2\EBWebView\Local State
                                                                                                                                                                                                      • Size 3KB
                                                                                                                                                                                                      • SHA256 a66f26b1e901e0d442dc4f08a4015e8aa38c9975a9eccb3003f4c8fb42948a3d
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Local State~RFe58f1be.TMP
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D99881E-E2E2-4337-A487-7F9C412621C7}\wv2\EBWebView\Local State~RFe58f1be.TMP
                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                      • SHA256 63bb0be27fd8605e4ec362cdc3bc45a0549232bc4cc355d8df667dde12156291
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      __PSScriptPolicyTest_qnm2ubds.o4y.ps1
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qnm2ubds.o4y.ps1
                                                                                                                                                                                                      • Size 60B
                                                                                                                                                                                                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      bg.png
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\bg.png
                                                                                                                                                                                                      • Size 224KB
                                                                                                                                                                                                      • SHA256 5fa976ea5780439175bb696817cd6eab3625ba5ccfe5b220587130ed5e1da855
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      f06119e1-dfab-487f-a7ec-366b6ba54e42.tmp
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\f06119e1-dfab-487f-a7ec-366b6ba54e42.tmp
                                                                                                                                                                                                      • Size 1B
                                                                                                                                                                                                      • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      content_new.js
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5224_571074991\CRX_INSTALL\content_new.js
                                                                                                                                                                                                      • Size 10KB
                                                                                                                                                                                                      • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      bec1615d-93a8-494b-8ba2-7efafa4e069e.tmp
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5224_571074991\bec1615d-93a8-494b-8ba2-7efafa4e069e.tmp
                                                                                                                                                                                                      • Size 10KB
                                                                                                                                                                                                      • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      default.dic
                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                                                                                                                                                                                      • Size 2B
                                                                                                                                                                                                      • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      Real.lnk
                                                                                                                                                                                                      • Path C:\Users\Admin\Desktop\Real.lnk
                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                      • SHA256 71f4a2f2eb26b87093def109ccc8f237f56c6a8af040da451a4e24ad91f19caa
                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      OperaInstaller.exe
                                                                                                                                                                                                      • Path C:\Users\Admin\Downloads\OperaInstaller.exe
                                                                                                                                                                                                      • Size 178KB
                                                                                                                                                                                                      • SHA256 20b545c7b0b0cb56926972b7fc2a94f428b7aa3e4f9f4e65d1bd0ad800fb60b7
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      memory/260-25-0x00007FFAFB2F0000-0x00007FFAFB2F1000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/2680-233-0x0000020DBB650000-0x0000020DBB672000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/3956-101-0x00007FFAF9F10000-0x00007FFAF9F11000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/3956-102-0x00007FFAFB670000-0x00007FFAFB671000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/4424-2441-0x0000017909EC0000-0x0000017909EC1000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/4424-2445-0x0000017909EC0000-0x0000017909EC1000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/4424-2434-0x0000017909EC0000-0x0000017909EC1000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/4424-2440-0x0000017909EC0000-0x0000017909EC1000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/4424-2442-0x0000017909EC0000-0x0000017909EC1000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/4424-2435-0x0000017909EC0000-0x0000017909EC1000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/4424-2436-0x0000017909EC0000-0x0000017909EC1000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/4424-2443-0x0000017909EC0000-0x0000017909EC1000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/4424-2446-0x0000017909EC0000-0x0000017909EC1000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/4424-2444-0x0000017909EC0000-0x0000017909EC1000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/4812-130-0x00007FFAFB2F0000-0x00007FFAFB2F1000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/5712-1351-0x0000000140000000-0x00000001415F6000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/5712-1365-0x0000000140000000-0x00000001415F6000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/5712-1366-0x0000000140000000-0x00000001415F6000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/5712-1456-0x0000000140000000-0x00000001415F6000-memory.dmp
                                                                                                                                                                                                      Download