hxxps://cloud-mine[.]org

Analysis

user interaction
yes
max time kernel
86s
max time network
88s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/04/2026, 00:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cloud-mine.org
Sample260416-am97facy2m

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_426164874\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\de\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_426164874\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_426164874\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_426164874\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_2552_1357135274\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1126194863\_locales\am\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1112	msedge.exe
5456	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207724833142432"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1456842261-3464001825-2855069093-1000\{7BA75584-DDD6-46C6-BB0B-8D2AF7A58B09}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3088	chrome.exe
3088	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2440	2552	msedge.exe	79
PID 2552 wrote to memory of 1112	2552	msedge.exe	80
PID 2552 wrote to memory of 5140	2552	msedge.exe	81
PID 2552 wrote to memory of 5140	2552	msedge.exe	81
PID 2552 wrote to memory of 5140	2552	msedge.exe	81
PID 2552 wrote to memory of 6068	2552	msedge.exe	83
PID 2552 wrote to memory of 6068	2552	msedge.exe	83
PID 2552 wrote to memory of 4500	2552	msedge.exe	84
PID 2552 wrote to memory of 4500	2552	msedge.exe	84
PID 2552 wrote to memory of 4500	2552	msedge.exe	84
PID 2552 wrote to memory of 4204	2552	msedge.exe	85
PID 2552 wrote to memory of 4204	2552	msedge.exe	85
PID 2552 wrote to memory of 4204	2552	msedge.exe	85
PID 2552 wrote to memory of 1596	2552	msedge.exe	87
PID 2552 wrote to memory of 1596	2552	msedge.exe	87
PID 2552 wrote to memory of 1596	2552	msedge.exe	87
PID 2552 wrote to memory of 692	2552	msedge.exe	88
PID 2552 wrote to memory of 692	2552	msedge.exe	88
PID 2552 wrote to memory of 692	2552	msedge.exe	88
PID 2552 wrote to memory of 4352	2552	msedge.exe	89
PID 2552 wrote to memory of 4352	2552	msedge.exe	89
PID 2552 wrote to memory of 4352	2552	msedge.exe	89
PID 2552 wrote to memory of 3720	2552	msedge.exe	90
PID 2552 wrote to memory of 3720	2552	msedge.exe	90
PID 2552 wrote to memory of 3720	2552	msedge.exe	90
PID 2552 wrote to memory of 2972	2552	msedge.exe	91
PID 2552 wrote to memory of 2972	2552	msedge.exe	91
PID 2552 wrote to memory of 2972	2552	msedge.exe	91
PID 2552 wrote to memory of 4644	2552	msedge.exe	92
PID 2552 wrote to memory of 4644	2552	msedge.exe	92
PID 2552 wrote to memory of 6116	2552	msedge.exe	93
PID 2552 wrote to memory of 6116	2552	msedge.exe	93
PID 2552 wrote to memory of 4696	2552	msedge.exe	95
PID 2552 wrote to memory of 4516	2552	msedge.exe	96
PID 4696 wrote to memory of 6136	4696	msedge.exe	97
PID 2552 wrote to memory of 2996	2552	msedge.exe	100
PID 2552 wrote to memory of 2996	2552	msedge.exe	100
PID 2552 wrote to memory of 4440	2552	msedge.exe	101
PID 2552 wrote to memory of 4440	2552	msedge.exe	101
PID 2552 wrote to memory of 4440	2552	msedge.exe	101
PID 2552 wrote to memory of 4252	2552	msedge.exe	103
PID 2552 wrote to memory of 5744	2552	msedge.exe	104
PID 2552 wrote to memory of 844	2552	msedge.exe	105
PID 2552 wrote to memory of 4732	2552	msedge.exe	106
PID 2552 wrote to memory of 4732	2552	msedge.exe	106
PID 2552 wrote to memory of 3708	2552	msedge.exe	107
PID 2552 wrote to memory of 3708	2552	msedge.exe	107
PID 2552 wrote to memory of 3708	2552	msedge.exe	107
PID 2552 wrote to memory of 4732	2552	msedge.exe	108
PID 2552 wrote to memory of 4732	2552	msedge.exe	108
PID 2552 wrote to memory of 4732	2552	msedge.exe	108
PID 2552 wrote to memory of 3716	2552	msedge.exe	109
PID 2552 wrote to memory of 3716	2552	msedge.exe	109
PID 3088 wrote to memory of 3868	3088	chrome.exe	113
PID 3088 wrote to memory of 900	3088	chrome.exe	114
PID 3088 wrote to memory of 900	3088	chrome.exe	114
PID 3088 wrote to memory of 5456	3088	chrome.exe	115
PID 3088 wrote to memory of 5220	3088	chrome.exe	116
PID 3088 wrote to memory of 5220	3088	chrome.exe	116
PID 3088 wrote to memory of 5600	3088	chrome.exe	117
PID 3088 wrote to memory of 3172	3088	chrome.exe	118
PID 3088 wrote to memory of 5600	3088	chrome.exe	117
PID 3088 wrote to memory of 3172	3088	chrome.exe	118
PID 3088 wrote to memory of 808	3088	chrome.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cloud-mine.org
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffad996c188,0x7ffad996c194,0x7ffad996c1a0
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1704,i,4206023271014111008,15196811941442917241,524288 --field-trial-handle=2172,i,14472759703995331718,2143790556685411491,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,5251206667987806555,6597703637312665830,262144 --field-trial-handle=2172,i,14472759703995331718,2143790556685411491,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,15337339478004666433,12250453471085881870,524288 --field-trial-handle=2172,i,14472759703995331718,2143790556685411491,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:13
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,11383991818223271089,4537157005815166535,2097152 --field-trial-handle=2172,i,14472759703995331718,2143790556685411491,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,8094533244682111244,2720863176226289390,2097152 --field-trial-handle=2172,i,14472759703995331718,2143790556685411491,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4904,i,10992080813010220921,10136158463537828824,2097152 --field-trial-handle=2172,i,14472759703995331718,2143790556685411491,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,14298961935948874479,13803351828599661284,2097152 --field-trial-handle=2172,i,14472759703995331718,2143790556685411491,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3400,i,14977198057855065442,1386577918467134581,2097152 --field-trial-handle=2172,i,14472759703995331718,2143790556685411491,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3532,i,2154471303230396927,15597751541543988077,2097152 --field-trial-handle=2172,i,14472759703995331718,2143790556685411491,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4856,i,8331986915750395845,645148072053995014,2097152 --field-trial-handle=2172,i,14472759703995331718,2143790556685411491,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,6927972130020397968,8102722094285025892,524288 --field-trial-handle=2172,i,14472759703995331718,2143790556685411491,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:14
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,17776238313724078735,10956531751534785538,524288 --field-trial-handle=2172,i,14472759703995331718,2143790556685411491,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:14
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,18406722714918109324,8520105651666010084,524288 --field-trial-handle=2172,i,14472759703995331718,2143790556685411491,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,18177084207418310090,8394242300131257828,524288 --field-trial-handle=2172,i,14472759703995331718,2143790556685411491,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,18406722714918109324,8520105651666010084,524288 --field-trial-handle=2172,i,14472759703995331718,2143790556685411491,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,3807336058580024151,7649466920843832877,524288 --field-trial-handle=2172,i,14472759703995331718,2143790556685411491,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6308,i,7771622766560472879,13518816415006797092,2097152 --field-trial-handle=2172,i,14472759703995331718,2143790556685411491,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,7780098129019201977,17017936222040578805,524288 --field-trial-handle=2172,i,14472759703995331718,2143790556685411491,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,1758692893865142420,12309533759363439731,524288 --field-trial-handle=2172,i,14472759703995331718,2143790556685411491,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,1457602644964823412,2527392216531367662,524288 --field-trial-handle=2172,i,14472759703995331718,2143790556685411491,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:14
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,9267569904039551833,3091465916728638931,524288 --field-trial-handle=2172,i,14472759703995331718,2143790556685411491,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:14
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6764,i,7421122186517494678,15676865965802390387,2097152 --field-trial-handle=2172,i,14472759703995331718,2143790556685411491,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6248,i,8628520125261469969,3359733862893676217,2097152 --field-trial-handle=2172,i,14472759703995331718,2143790556685411491,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,15428431083194758366,3623343773526820851,524288 --field-trial-handle=2172,i,14472759703995331718,2143790556685411491,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:14
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,14497064929873839471,14382591190288918042,524288 --field-trial-handle=2172,i,14472759703995331718,2143790556685411491,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
  2⤵
  PID:2800

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4408

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffac7c1c728,0x7ffac7c1c734,0x7ffac7c1c740
  2⤵
  PID:3868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,17270486509171637693,9809296956552997999,262144 --field-trial-handle=1988,i,16746921813144657964,12649203105602483142,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2248,i,13726261909648565264,9588200599632403609,524288 --field-trial-handle=1988,i,16746921813144657964,12649203105602483142,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2252 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,14450124656512276159,5997748848587145997,524288 --field-trial-handle=1988,i,16746921813144657964,12649203105602483142,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2336 /prefetch:13
  2⤵
  PID:5220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,11446205030683444194,15921650063673367673,2097152 --field-trial-handle=1988,i,16746921813144657964,12649203105602483142,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:5600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,11877009778117709321,8929742563348972984,2097152 --field-trial-handle=1988,i,16746921813144657964,12649203105602483142,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4204,i,2244207980523840652,17764122865305387314,2097152 --field-trial-handle=1988,i,16746921813144657964,12649203105602483142,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4164 /prefetch:9
  2⤵
  PID:808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4552,i,13182513248430101883,18362015257632062947,2097152 --field-trial-handle=1988,i,16746921813144657964,12649203105602483142,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5388,i,6341176866966249340,2252538369921030251,524288 --field-trial-handle=1988,i,16746921813144657964,12649203105602483142,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5396 /prefetch:14
  2⤵
  PID:3044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5392,i,16699348805974757210,16993747895215588792,2097152 --field-trial-handle=1988,i,16746921813144657964,12649203105602483142,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4600,i,7879830976005894470,17792712531803223725,2097152 --field-trial-handle=1988,i,16746921813144657964,12649203105602483142,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3432,i,18330574432743694217,5908809782088840463,2097152 --field-trial-handle=1988,i,16746921813144657964,12649203105602483142,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5660,i,9808498641310670594,18348720674663161820,2097152 --field-trial-handle=1988,i,16746921813144657964,12649203105602483142,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3524,i,9075282139778303671,4027917750590902661,2097152 --field-trial-handle=1988,i,16746921813144657964,12649203105602483142,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:1432

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4fb3a59e-8f33-4bbb-a539-8eaf3a6fa6d2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4fb3a59e-8f33-4bbb-a539-8eaf3a6fa6d2.tmp
Size 12KB
SHA256 579b06e788ffe4832a312219a043633aa8cf13fa92cc55dbf85e40b24ce3d63f
MD5 cfb3b8319190f91e655aef3f165409d7
SHA1 5dee0fbe6619a604b2b00963944f4654dad942e8
SHA512 9dec220cf235a955c9a055c57c968f00e5767d6a32e7c894f318b7a7828313ac9ac77cd283d6104c0bc00c11edb75502dab89df14eb7a5ec93a0dd5f9b24ea07
SSDEEP 192:OR37uReYrsz272/mn/f3xetua47v7pFhAPRp2XG9YHsb+WNnWGfMQ2IP2oMkw0al:ORr6eMUKvb8X/OwjX2+2lUam8
TLSH
T12042D42ABD64393B9CCAC219FE217757EBF5112161842F88E6FD8A1C25E79CD2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 9af7567a82807da3160fb1f8942720f4712cce424a62e777e96cb6941c063b21
MD5 3bee99ca374907da76dd5ade384b257e
SHA1 8d34398752ff5ffaa6d7f44c29323022df3c80b9
SHA512 c5e810d7244dde349f84bce5c4f61041dde230d2977de5aae099c250510130db6475e08d6f65a05510ad9bdc5a4ae6f7f254db98b7e5f55893cc3847c3a34ae2
TLSH
T1D7E0E5AADC24AC372CFE072960544705EA60131A2B809A0F7B3D82088FB06264196C5C
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 21e81c420f3d017ae32c8b64d4e6d75c94b8234e6b16495dd8068581d8c1d8ae
MD5 00354c26d974dd37c82892cc4543401d
SHA1 998a31960482acf892a8127374d96c3a440e9e8d
SHA512 002a30061d299c004f2cb1f953a686553784e46d60be4a0ead8a5803cc85dda5c5d4c62a1b8c130db4c0b1023316a356061b53cd0cdbc9a204299c12d96f29e7
SSDEEP 384:OEjql7KxkXqKf/pUZNCgVLH2Hfgsl817pLuLcifMtXODql+ErU3HtHGDu9P:OIql7KxkXqKf/pUZNCgVLH2Hfgsi17p+
TLSH
T1BA72FA676C4C9E770F94C9CCD8267E4FADB5024B65DDC86482FA982A03D5ACF110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 491fac116449f25004eb4fe4966cbb2f1aaf588d9a7d36a0658d820e46d6b9ff
MD5 690ab01e91e4a0bcf83647e9adcb741f
SHA1 913b9ccd23f92d799de002ff1a9ac4dd6eb53df7
SHA512 567d4ebfb6b98d07f2ad33a44b1961d95d4be58cd1fc441b7eccbc22242c61e2edfe7a40c5292ff9168dabe7ecfb8c2ce7c66398b2519da10f225f2a11ce32ce
TLSH
T181B01291C0019946C49703F5298B0498B1145F108706230563E46DB2D82B3A14118160
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598d33.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe598d33.TMP
Size 96B
SHA256 797988e93ba42082ce99a0bce75169406b8eef3fed97049d00c086134425d33b
MD5 e3a05720775324c64be5d361724683e0
SHA1 47c7955b19108ee3afec9e057b32ed74945725fa
SHA512 adf972ddc9dd891444aa4a0683bc0dc57a9ca7feeab2c85e87eb88cfc83fd05c97b938ef048e77bd1ad88868143603f707281f4764abb885c6a8fa9cd255430d
TLSH
T124B022A0C002E202C00303B028C080E832A0CF30C203020AB3E00A3ACC20AB000282B0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 fbd0e533706606733eccdae8097aaa8f388b8f7c3e4044d30b9ecf6dd9948337
MD5 1204e97086cfdbb29de02711f9d67951
SHA1 980c1299aaf249709160a4e22acb32fb86d5f2dc
SHA512 f770eae15c7eb47956c57ba9c9a7a3e7397500c03bec51c7d11cd963edeac7f2ab3c1bb6c52415b092e6bebfc51119c7e1fbe9df249d10e5dc8e86150b118b8b
SSDEEP 1536:S9P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNz:2++J3qUQm08KMWF0bFTcVHr6zo
TLSH
T16D9312B99D1FBC79635EC69690079CAC4CE39CDD151014BC30C75F1E14BA3A2A31B8E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 b98600fffa6e7c0c69a70d02f006d59159f00241e26bfabe122d785c945ad3b3
MD5 9d53df8b821f92986221da72bf558ccb
SHA1 1ad0e11c3bf5de6d2a3019a0ff945c14aee15e50
SHA512 114a30e892f8fc86b4845052e6eb73f0a814c99697472007a4da20c84810221fcfb3412147bfc98114ded34d446839c88db1b21964a8f6708b54b3590cd04fc3
SSDEEP 3072:lyES3ahl/ldBBU/td1gB6mnNalOnNTqBWJ++J3qUQm08KMWF0bFTcVHr6zH:lyEn/ct/gwWNalOoK++JjcMW2VcVLY
TLSH
T18A1422A4A82B7E75375EC16A502F1CBDC9E34E8E443400B8728A2B6D16BC746875FC69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9cf5acc3a4797f1d8e969ab1970c2330530e33f7dac25d2b42a810961a67ea68
MD5 6bbadb85852ef58796e988ee6bd3abc6
SHA1 f87a8c99cc4052067a5b532f97bd1ccc92f6a0b9
SHA512 a3813b64d663d976b681f2ced98d428dc47f49c99219d4a147277e7c8375b07692a5a14501eee0df77c86f9da6e3205c49e89510005d4f3b21e3afff243fb088
TLSH
T13CD080155FF27C70D014E8F694187B41392DACA68D43A6115471EA7E4C224D48BD0FE7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ea750b8ccfa8d7c7a393cdf6c9c8a3be0f2f086fb814bb44905a02c83d9af71f
MD5 697a394c9a3ff43b8925489b648b073c
SHA1 5828315de0bd17378051f664204bff07d8659dea
SHA512 37519d78554ef3947030bf7fc74d2660bf2dc752f04de85daef8079fdce335d2e6ad77071de5a938f7422ad0bdd2acad3963260b61149fc0d91381c007a2514f
TLSH
T173D080115FF27C70D014E8F694187B413A3DA8A68D43A61154B1EA7E4C624D48FD0FE7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 4755aedc18193ff2dffe5a43aaf55d4a44d55517f8209f4edd2cdce5dd7270ea
MD5 8d67f49204cc4b1d3120ac83924c30ce
SHA1 ef1bd346881207d2b298f134e0ba3bae94ae4915
SHA512 fb2f224e572facdbaed0ea7f2d8eff39fc01780aa13539b928947ce6890930dba3c179eda418750891ffb91d2e2369b235bde989615601a0a25958439964f811
TLSH
T1A6E02BAACC20EC3749FD475850584346EB5013571B80485F3A3D95098FB56374557C6C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 62KB
SHA256 df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3
MD5 c813a1b87f1651d642cdcad5fca7a7d8
SHA1 0e6628997674a7dfbeb321b59a6e829d0c2f4478
SHA512 af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b
SSDEEP 1536:Q9pfnSa+E9Az52gNbkYtUtqvUhZRHuLdrx07LXz:uhnSpE9A1EY6tBPix07Lj
TLSH
T1695301D4670EE2A579F2CF23BF59C5C00803162D8E11AA68FFA063878D8430BA793D1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
Size 68KB
SHA256 0274a299b3a81687a5192c4ff424872941d24a0b986035abacbbcda16ca5210b
MD5 d67f112773e898f90e775e65ebeb6385
SHA1 86b3728d490c3c6a6a97809f6b2eb7c2eb19cdf3
SHA512 f6e93b614653bc993daf4e0391000efe6286f78a9cc7d15a5836501d3016f5801c7cde8e8f875f2f1d6981dedc0946dfc87b83133cbecc5af92de3b122999823
SSDEEP 1536:fInxmnkHNVx/Uur0YtX30S30zT9HQG4TGnzmC4:rktPRbn4zTezG6/
TLSH
T13963011299EB3F1CBD0EFA80BEAD35EA0325C995A652A3F5073453E72425B60C025D6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
Size 19KB
SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863
SSDEEP 384:/Und3PKicut4yiFkC9RWzlJpa2/CKYOyDJmCZyXJTW4PO821GyLjSoBwNeS:0UizQDYlJpaQCKYOyDJpI5Kx821DS3Nz
TLSH
T13692E1670BCE314E422EE25FA316A51733E41BE1EFE49640D6AA70D81C38DA243179D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008f
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000090

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000090
Size 36KB
SHA256 e13254529ac3e751547b147370179c4d434fe7ba18ff1d9bfbffa46f24b7a3b5
MD5 80a87cddcb7f5d4b2b116a732e3ce664
SHA1 71de97563eab27594c391557f052c66372849208
SHA512 457c1e6ed399e0887ea0bfc6a4c9ac17e7784e6b53d63575741b4644c2994e3e96f52362496de2937234736335eb337fda040523d9cc2377ef02c082ac3ac695
SSDEEP 768:fUxP1KsHQelvHotCt5UmtkZnkWd+lfbPC4NoXtzKZb:8bKolv2Ct5UmtkkWd+lTq4iAb
TLSH
T15403F128AF3BB4B30394B659B9418B296A0E987B9E51D07D7CEF4421754DB3EE07B310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 aed8e6543a67cdc01461d2eb19b19380d9a946686ac3078c2fb2846318234e68
MD5 e6a93aa8f9e65cc0413fda23148cae86
SHA1 c3096400ff9723b4546265de5eba649b7a71e69b
SHA512 9013bdbd1b721bf0afacee8e4b42a46060a7c707403ecb987a377b72be9c38134b2b8c3819afe123d5adf1fb439812e3aa843bc35ee435243d9b6621318cad7e
SSDEEP 96:K79E1ORbpe1VCkYzDbH3LCG1g1bdj2y0j8R:KS1EbI1IFbH3LCcgN0y0AR
TLSH
T156B1E404B3BAD4D1EBD104B39BE2ECDA3BF05589058B9F453FE5413EA93EB915CA9480
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 b98478de7a717dbd601c9b6765297ecd46070231d2a7a51941e2caa47f3b4625
MD5 86b84283950e8def809645b39cfdeeb7
SHA1 1de80e12f6ae4689ee3de68e670b6911215bac45
SHA512 5383528f078fd4d607bdbbedc2354b0c59a5a8b67edb19d44eede8b872637692993a747ad29ba7dcacbb8e0268f7ce84a2f73236beeb91af76c2aeca3081af04
SSDEEP 96:kaUPvhlSUs40GUnaktcExMfFbyDAfQ4JDZH78k094:VUPvhIUs40RaktcvLfDl4k0a
TLSH
T1B6C119A0B3BAC495E7E085779FEADCD53BF042C9066B8F843ED5413E583EB905CA9444
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe591592.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591592.TMP
Size 3KB
SHA256 daad8b9484972a0fb5580e8b1c653844095001dfdfd4bd5a70c1450b38f98cc8
MD5 6723ac589c2e0692b227dc910e9ecb20
SHA1 c0efc93e7dbc3c47ff0ada1c8f57118c1d617b6f
SHA512 d4b4f4034e8a34c069a2e44abe209a586b66a0e80caec458b1ad57a9b5a9c5dc118655b31e2aed8ec82761df0f1cdf7610aaaaa134f5987ab76cc8bcb70b6ffb
TLSH
T1C161F50473F298D9E7E045B79FE22CCA72F48698054F5F552EE5803FAA3EB026DB9400
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 c0495b95fab5e802501cb0505ba98c5c5587fef752dcedfc3ddce4d7761c29d3
MD5 ccc0692e3b286c16227423204391f2b2
SHA1 06c73f8a75ecb530bc2a855b003e94b26281ee14
SHA512 bb179f843def393eb0d5e9ecb644a4b06dc602be3b46541f77e4e6ed30a0b58acd153ab4136a222fd06056d5200bd0d15398da04f0e9c45f495a6448841c08d6
SSDEEP 96:D1ORAuHNjSIE7zBuKRUuLuouLBj6y/U4w51/va/vEBBsmzr:D4C4N2IE71d60fIj6y/U4M1/va/vg1X
TLSH
T1D0A1CDF3C7E9826ED91155F0AB187E2BCE6D0955432C3C5AC5E4AF0B97F2430E141A6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 a34ed72726f8826aaf79ca147fb5a4c8813e4f57231973ba5f975119e7ecd556
MD5 fa4ec424836987f32e72e3c87ec3f85e
SHA1 5d9a4b0e01666ce94a53812284f30b5de0d17bdd
SHA512 78107b06ce1efdffa800932ebc77391a2eaeb03392c3abdc1dc50f539033902144fc724c9b62444def6d26b70c75317f54ff7e46dd6c2c3e3e87b2d308af58c2
TLSH
T11CD022A31383B0B5B9AD6E8AA06AED8FC32710600887DED611E0A99E093A4AC050B240
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 73badd48fc697af9d359cdf989ec714fa9934b367456eef3849ad31794f950e7
MD5 beb2c46183b339c37e712f39074de4fc
SHA1 80adb63b791369c073f43e75a78d3f0dec711190
SHA512 d013cffab11203c9bebc7d5cc944ba451fad23a9075d3094f6f44456449803c27d2c8a2370be828fb572bbbf47c807664004db8293921066d7735f9c7174b845
TLSH
T185D022E31382B0B4B69D6EABE06EED9FC32A04200883DED611F069DE0D3E4AC050B245
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 1d7435f63d1f0d9e1ff50461e6521c0b34bbf0771d7f92248c94a10ba9ca0790
MD5 7207c894e2e32d714ae181fa52108bc7
SHA1 c8209d7b1bf0537d800d1f69a95cc010176065d8
SHA512 7301b09f899616090f243b7cc0a91bd7002c0d07b4cab51f56ef09faaa36799fe596ef2bfb63e8a83460481b98203bd131d1ec20936bbe70b6de14feb76b5173
SSDEEP 192:sxZERSyMqZ/K1Ml8MFN/fZsUIY4rsycILcqzodprpWe1/W6+WNxed3sxJ/Y0lHa3:sxZEHdN/fZsUIYsc3RD/bX/5t14
TLSH
T12172E71666389D7BCCD7E219B945BB53D7F95563C2904E44AAFCCE0C00E6BED620382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 aa697be64a39a16fe800796b38fbea513af1910203cae6ff030edb82faa4e5cc
MD5 a2eb3ec797d239d47611da706385bf15
SHA1 7cadd7288cf1d37d314a0c81f30ef4281f3b40da
SHA512 9fa0945f76328b438626ac307dbe8f43641e188126e75be58975b4c62845c1b12484730b02030a8ba17a9431392bd7dd5870d2b46e864be609ee0187b463420a
SSDEEP 192:sxZERSyMqZ/K1Ml8MFN/fZs4IYH/ILcezodprpWe1/W6+WNxed3sxJ/Y0l3jOIgE:sxZEVdN/fZs4IYf3FD/bX/5oj4
TLSH
T18372E806A6389D7BCCD7D219B945BB53D7F95562D2904E44AAFCCE0C04E6BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 505eacdc29886eff3ded51407a62a78a67523e261d5566e341eeab5ae9dae61f
MD5 cdfdb6ff18067b1a9997d6dfb69fc503
SHA1 6fe177a9d752a5fb565fd356292ed9f4e9b6eec6
SHA512 d52063bc50b2ae4b40a86f09a619d1d9496101f40c6af1a88b2d277a2063ed4cf470997286c3e8bd1779ecd9b96b2fe71cb4f261df5f8e55d41b8bd62e9ac0fc
SSDEEP 768:EZN9b8PT24f7pLuL/CuWRmCCQx68F1+UoAYDCx9Tuqh0VfUC9xbog/OV3f7yZLl8:EZN9b8PT24ZE/CuWRmCCQx6u1jaKf7yg
TLSH
T1FC031C3B280CCB7E4F804E9CDD26BE8E7DE801CB9698899447FA844C03D66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 a39af4db2ba6002b76c74ee6adc65e939ceff7415f2d0b47ffbe815a3440713c
MD5 0ad258d5285157a91f882e7691001f9f
SHA1 a7477c3afe65b315b4855b3127180d89c45077b4
SHA512 6bb87ba9cfa399629759608fbfe3ccab72e3b9e816341942ed8117236683f73f01bc4d12a26a7344b7b12e8b910986dc924a8b70cbd8e69103db58ec0afd575a
SSDEEP 768:EmN9b8PT24f7pLuL/CuWRmCCQx68F1+UoAYDCx9Tuqh0VfUC9xbog/OV3f7yZLl/:EmN9b8PT24ZE/CuWRmCCQx6u1jaKf7yD
TLSH
T10C032B3B2C0CCB7E4F844E9CDD26BE8E7DE8018B9698898447FA844C03D66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 629c1bac8b83a29b7084811b66b7f3a3862db1b3362f08239efe0f112d926d97
MD5 4058e073900d1b3f959ffbfa75dee24b
SHA1 67d7ec9938f8eaa6f7000d9001d61c0b21d63502
SHA512 c5188027baeff46ede6d3e2e61d6c628f873dbb2401d2825b1adaa277cdd50d77c10dfc5a1861de41be03c9cc1b212e7961533e32f31e41f5d806c104ceaff45
SSDEEP 384:cdOlNbMrgcmS2paFgkI1keB0k1+ojSSjroduZh9l:cdOlNXJjSSjroduZh9l
TLSH
T17BB27F15713B23903ABD258A8594B4AF52C231633018F47B7BB954AE1F67E18DCFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 518fdf37d95771e05e7e1f7eb3439e0057c12c5f8d10e62152223a877b588c17
MD5 5f1236084889a37284dfc8b07e024538
SHA1 6f359b81e558ca79d6f899cfaee450066e186543
SHA512 ea5a5c9d58755a961c6377d00f4156298186ad3a6e7cffea434b0a03a9853dce2d0530d82531af44b78d1be9d3b74c0eb37173e511dc60db47496f486d3ca321
SSDEEP 384:nUiFavqMg38NZ8TUNTUlIxB4dzzr14fDK0Z4gjz4M+YQ9OXpy8eRYV/Vw1mRTrNE:vFayv3uwgacKgYj9epy8eRYk1mhe
TLSH
T1F2C26C76E8A8DDA7EDEA8FD9E74A7603EEE00167C98C4AD4DAD40D1D009719E130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 075b80b3a97f4b42d1aff20c98d7c261dc740ec4846f1373d13318a829540e52
MD5 8c0772d8cd285e6c3494102ffad73d26
SHA1 fa5a1a635342f7cc0aef3fd8c975a618acbe3d29
SHA512 455717bb8409f2e653b7685df7333c31a0108537c3e57c4ed2c9c1d885f1bfcbdb6928ffbaf6c7cf2f02a03af1e3f7e5144785bacaf8d6692a1d2793c15b467c
SSDEEP 384:n2iFJjccCs+Bt0S3k8N98TUNTUlIRn4dnTq14fDK0Z4gjz4M+YQ9OXpO8eSBFt15:dFJccQEewgITKgYj9epO8eSHky1
TLSH
T184C25C32E8A8DDA7EDE78FD9A3497603EEE01063969C4AD4DAC94D5D00C71DE030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ab3b79f318218295b93ff000029b32e0810584ee81ab48409ec78e32d841fd6a
MD5 21613ab2a801b9267fd2b91553de34c5
SHA1 316865cc558e5913ab40c43591002241b01662a4
SHA512 fb32e31ee8808f00874e1c50ca748d7cd6366ab1d0ab6c10f42531e32f62c367fd32f2b829a140141565ab81621de587d86aabbe5eca340dd5bbcdb686805662
SSDEEP 384:nMiFJjccCs+Bt0S3k8N98TUNTUlIRn4dHtq14fDK0Z4gjz4M+YQ9OXpO8eSBFt15:3FJccQEewg0TKgYj9epO8eSHky1
TLSH
T1FFC25C32E8A8DDA7EDE68FD9A3497603EEE01163969C4AD4D9C94D5D00C71DE030BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 f37ec046dcf39b947a519679912de902bbe09bd8c67b768e8391e40de903bc4c
MD5 01851ad85d62b48476b8f365bf668aa5
SHA1 863637e6650f9d802732b3e279535bd2ff8ddb18
SHA512 90af965239f8d943b1778a7a9592bb001ea6a776e11cab08606f308a007718486dd2cc5905b69fd3cdcdf7a763de2fe0b457f8966fd0af76c7aa08a86feafe0c
SSDEEP 384:nciFavqMg38Nv8TUNTUlIxB4d45G1K14fDK0Z4gjz4M+YQ05RYV/Vw1mRTrN1k+c:HFayv38wgLU1zKgYj05RYk1mhe
TLSH
T1FEC26D36E898DDA7EDEA8FD9E74A7603EEE00167D99C4AD8DAD40D1D00970DE130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 fb2ceef8a2c461c127a7f7674d2ec162faa1310186f84ad37691fdebec6c0d98
MD5 559e3b47c75fd092537d44c43ea21b38
SHA1 9275d182fb17ae696504b18162e75849078f412a
SHA512 581fb0679207875a952f97fbd55f2cf2405303ca2669ea91a1e338195faddd35cb59b47452b217b52df8abef4520f5222ca413fdf8364f71a425d854f4429c70
SSDEEP 384:n2iFavqMM8N98TUNTUlIRm4dnTq14fDK0Z4gjz4M+YQ9OXpO8e5oo3rN1k+5vI+2:dFayxewg3TKgYj9epO8ePTi
TLSH
T1B3B24B72E8A8DDA7EDE68FD9A7497603EEE00163C58C4AD4DAD91D1D00971DE130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8bf6d86fd6573428892b00f99182fdb355e90347a729b8ce06c9abdea6879346
MD5 fca240cbe368bfb4efb8fa1a63d449d6
SHA1 8d6dd33da67726ed73b00c5de7059b6c219a10c0
SHA512 66ea8ad25d9389d89dcf1b5a24078195734e23c84b47813a589588832eb48a43000224b9e3a928d9e7946838a35c3acaeec153d72671faf0b53cca91aad96efd
SSDEEP 384:nJiF2jccCs+Bt0S328N98TUNTUlIRL4dHwq14fDK0Z4gjz4M+YQ9OXpT8eSBFt15:gFwccQWewgpTKgYj9epT8eSHky1
TLSH
T1B2D25B32E8A8DDB7EDE68FD9A3597603EEE01153969C4AD8DAC94D5C00C71DE030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 72c320da358a82e44568ebeabeb344834bca889ee49551883a5e1cc28d8a1947
MD5 b62c7b0be1eaa4656dffc90fa3888333
SHA1 bd832639c444f653bff10c5a4d0bd0741fc78f51
SHA512 2be548f2cc26c4aab0f822a66c26a1999e210a02e05cac28b7e9cca7086081d149290c9d6966a4aa160802774c233c2e9a50477e27d7e68d66e63dc712c978df
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe593dbb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe593dbb.TMP
Size 392B
SHA256 4c7e9596ec916e6e76c781bb6e44d33442927b28613ce859db0690d85384f50e
MD5 4669ad5af405a4ded0f6882b8f4bcab6
SHA1 1f1b8afb5d811350877e93b3963e64a431f468ae
SHA512 27f509145bc1607857e8121d57ed0e45e06e8cd9e3c3543ab8bb27e9fd6528ab1889195e2b07c06fb34620d2b0837094173827a7cc27471eaafe04a6560fec14
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 265f973437a74550f0c30381751a4f0f7d213749a0f577bc45e283fb51a94f96
MD5 c2b390104a44982afef3bb0b6fe6d3e5
SHA1 b206a8bd4b4b75bc793c7ce1a0257ffb8ae39fc2
SHA512 c6a3b5eb814b9984b58fa60a0e3e8d3f2c81b23b6b417e8926cbd5ddae05a9fc3daad14c21be81330bcb5844e3b667843d800cdccd22c94670844fd67cd3b2ab
TLSH
T1AD4161D18C3D26D1D8BD1A3E648B38FC95DCD72AF4A4357D6824EAD8063A61CB08443F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_426164874\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_426164874\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download