hxxps://406deliverer[.]truepeak[.]org/democracy159/christof[.]stegmann@dreso[.]com

Analysis

user interaction
yes
max time kernel
164s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/05/2026, 07:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://406deliverer.truepeak.org/democracy159/[email protected]
Sample260528-jbrqdsbs3s

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3816_769533309\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3816_2094028610\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3816_2094028610\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3532	msedge.exe
1460	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134244270095034573"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{A0BB1EBB-EAF0-4558-B52E-B0DCCDF0EA52}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5608	chrome.exe
5608	chrome.exe
5416	msedge.exe
5416	msedge.exe
5608	chrome.exe
5608	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 4592	3816	msedge.exe	88
PID 3816 wrote to memory of 4856	3816	msedge.exe	90
PID 3816 wrote to memory of 3532	3816	msedge.exe	91
PID 3816 wrote to memory of 4856	3816	msedge.exe	90
PID 3816 wrote to memory of 4856	3816	msedge.exe	90
PID 3816 wrote to memory of 1088	3816	msedge.exe	92
PID 3816 wrote to memory of 1088	3816	msedge.exe	92
PID 3816 wrote to memory of 1072	3816	msedge.exe	93
PID 3816 wrote to memory of 2328	3816	msedge.exe	94
PID 3816 wrote to memory of 1072	3816	msedge.exe	93
PID 3816 wrote to memory of 1072	3816	msedge.exe	93
PID 3816 wrote to memory of 2328	3816	msedge.exe	94
PID 3816 wrote to memory of 2328	3816	msedge.exe	94
PID 3816 wrote to memory of 1316	3816	msedge.exe	95
PID 3816 wrote to memory of 1316	3816	msedge.exe	95
PID 3816 wrote to memory of 1316	3816	msedge.exe	95
PID 3816 wrote to memory of 4488	3816	msedge.exe	96
PID 3816 wrote to memory of 4488	3816	msedge.exe	96
PID 3816 wrote to memory of 4488	3816	msedge.exe	96
PID 3816 wrote to memory of 3956	3816	msedge.exe	99
PID 3816 wrote to memory of 3956	3816	msedge.exe	99
PID 3816 wrote to memory of 4412	3816	msedge.exe	101
PID 3816 wrote to memory of 4412	3816	msedge.exe	101
PID 3816 wrote to memory of 4036	3816	msedge.exe	104
PID 3816 wrote to memory of 4036	3816	msedge.exe	104
PID 3816 wrote to memory of 4264	3816	msedge.exe	105
PID 3816 wrote to memory of 4264	3816	msedge.exe	105
PID 3816 wrote to memory of 4972	3816	msedge.exe	107
PID 3816 wrote to memory of 4288	3816	msedge.exe	108
PID 3816 wrote to memory of 4288	3816	msedge.exe	108
PID 3816 wrote to memory of 5076	3816	msedge.exe	109
PID 3816 wrote to memory of 5076	3816	msedge.exe	109
PID 3816 wrote to memory of 3908	3816	msedge.exe	110
PID 3816 wrote to memory of 4464	3816	msedge.exe	111
PID 3816 wrote to memory of 3908	3816	msedge.exe	110
PID 3816 wrote to memory of 4464	3816	msedge.exe	111
PID 3816 wrote to memory of 1420	3816	msedge.exe	112
PID 3816 wrote to memory of 1420	3816	msedge.exe	112
PID 3816 wrote to memory of 1968	3816	msedge.exe	114
PID 3816 wrote to memory of 1968	3816	msedge.exe	114
PID 3816 wrote to memory of 1968	3816	msedge.exe	114
PID 3816 wrote to memory of 5756	3816	msedge.exe	116
PID 3816 wrote to memory of 5756	3816	msedge.exe	116
PID 3816 wrote to memory of 5800	3816	msedge.exe	117
PID 3816 wrote to memory of 5800	3816	msedge.exe	117
PID 3816 wrote to memory of 5800	3816	msedge.exe	117
PID 3816 wrote to memory of 5996	3816	msedge.exe	118
PID 3816 wrote to memory of 5996	3816	msedge.exe	118
PID 3816 wrote to memory of 5996	3816	msedge.exe	118
PID 3816 wrote to memory of 5924	3816	msedge.exe	128
PID 3816 wrote to memory of 2152	3816	msedge.exe	129
PID 3816 wrote to memory of 3664	3816	msedge.exe	130
PID 3816 wrote to memory of 2152	3816	msedge.exe	129
PID 3816 wrote to memory of 3664	3816	msedge.exe	130
PID 3816 wrote to memory of 3664	3816	msedge.exe	130
PID 3816 wrote to memory of 1420	3816	msedge.exe	133
PID 3816 wrote to memory of 3828	3816	msedge.exe	134
PID 3816 wrote to memory of 1688	3816	msedge.exe	135
PID 3816 wrote to memory of 5664	3816	msedge.exe	138
PID 3816 wrote to memory of 5664	3816	msedge.exe	138
PID 5608 wrote to memory of 5560	5608	chrome.exe	147
PID 5608 wrote to memory of 540	5608	chrome.exe	148
PID 5608 wrote to memory of 540	5608	chrome.exe	148
PID 5608 wrote to memory of 1460	5608	chrome.exe	149

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://406deliverer.truepeak.org/democracy159/[email protected]
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffccf63c188,0x7ffccf63c194,0x7ffccf63c1a0
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,9620274656831938963,14343991548829211164,262144 --field-trial-handle=2408,i,2236115444201099880,3133236181719815065,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:2
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,2195366066976767476,13790150678626192800,524288 --field-trial-handle=2408,i,2236115444201099880,3133236181719815065,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,15989282589027166446,15524855858023944820,524288 --field-trial-handle=2408,i,2236115444201099880,3133236181719815065,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,10671745126781025184,12498658738204204574,2097152 --field-trial-handle=2408,i,2236115444201099880,3133236181719815065,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,16792468602354438989,9227698538988762824,2097152 --field-trial-handle=2408,i,2236115444201099880,3133236181719815065,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,18162371150937661307,8858285973921285835,2097152 --field-trial-handle=2408,i,2236115444201099880,3133236181719815065,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,7920251870134855968,13695027512693568279,2097152 --field-trial-handle=2408,i,2236115444201099880,3133236181719815065,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:2
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,13667265819850501543,16515637660411854009,524288 --field-trial-handle=2408,i,2236115444201099880,3133236181719815065,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:8
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,6679689427641654010,17384294340958474893,524288 --field-trial-handle=2408,i,2236115444201099880,3133236181719815065,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,12851010418408628202,16876414412693749893,524288 --field-trial-handle=2408,i,2236115444201099880,3133236181719815065,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,4917128635278461732,13616504284693123910,524288 --field-trial-handle=2408,i,2236115444201099880,3133236181719815065,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,16920400157290988072,6683190691655986020,524288 --field-trial-handle=2408,i,2236115444201099880,3133236181719815065,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,16920400157290988072,6683190691655986020,524288 --field-trial-handle=2408,i,2236115444201099880,3133236181719815065,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,16395914890036556071,10826103768897587067,524288 --field-trial-handle=2408,i,2236115444201099880,3133236181719815065,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,17828495091090086268,2332195918664884598,524288 --field-trial-handle=2408,i,2236115444201099880,3133236181719815065,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,4647405241374563604,16385486652791813109,524288 --field-trial-handle=2408,i,2236115444201099880,3133236181719815065,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:8
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,8612584958092922748,5197190743431530448,524288 --field-trial-handle=2408,i,2236115444201099880,3133236181719815065,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,14241096252485295892,5597681718514260703,524288 --field-trial-handle=2408,i,2236115444201099880,3133236181719815065,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:8
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6444,i,4746307267337687166,2511449478115958646,2097152 --field-trial-handle=2408,i,2236115444201099880,3133236181719815065,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,13950578843837404787,13732042745019008939,524288 --field-trial-handle=2408,i,2236115444201099880,3133236181719815065,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:8
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6524,i,11065396059290141000,12756157528442830508,2097152 --field-trial-handle=2408,i,2236115444201099880,3133236181719815065,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6396,i,8415391418469481218,12781912230089246751,2097152 --field-trial-handle=2408,i,2236115444201099880,3133236181719815065,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:1
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4620,i,10033004598416357591,10703903779388558929,524288 --field-trial-handle=2408,i,2236115444201099880,3133236181719815065,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:8
  2⤵
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4620,i,10033004598416357591,10703903779388558929,524288 --field-trial-handle=2408,i,2236115444201099880,3133236181719815065,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:8
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,9630103090270712309,15686747005150252861,524288 --field-trial-handle=2408,i,2236115444201099880,3133236181719815065,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=3552,i,11105641525006143267,8730329724030451499,2097152 --field-trial-handle=2408,i,2236115444201099880,3133236181719815065,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7008,i,15964441628554064382,17750393222446875299,524288 --field-trial-handle=2408,i,2236115444201099880,3133236181719815065,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:8
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7012,i,3202299440764194224,16478089504959403296,524288 --field-trial-handle=2408,i,2236115444201099880,3133236181719815065,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7016,i,12338609759734612100,6002835079524304886,524288 --field-trial-handle=2408,i,2236115444201099880,3133236181719815065,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:8
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,8870099474620089760,9658599512431404283,524288 --field-trial-handle=2408,i,2236115444201099880,3133236181719815065,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:8
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,17346941697440208253,5557830982510348465,524288 --field-trial-handle=2408,i,2236115444201099880,3133236181719815065,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6840,i,4340112156347303591,17572978508104741849,262144 --field-trial-handle=2408,i,2236115444201099880,3133236181719815065,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,14898100666335306481,7716179864194819499,524288 --field-trial-handle=2408,i,2236115444201099880,3133236181719815065,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  PID:2248

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2968

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffccd43c728,0x7ffccd43c734,0x7ffccd43c740
  2⤵
  PID:5560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1724,i,6830418272382946569,17145862955477242047,262144 --field-trial-handle=2000,i,16285772402181194627,6729543130663959390,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,7220759387130554791,13559853914741035936,524288 --field-trial-handle=2000,i,16285772402181194627,6729543130663959390,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2432,i,18171957114914750498,13469056649377470884,524288 --field-trial-handle=2000,i,16285772402181194627,6729543130663959390,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3276,i,16189887706985939864,7572819046980093919,2097152 --field-trial-handle=2000,i,16285772402181194627,6729543130663959390,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3300,i,13542646691833516567,3899926849028913717,2097152 --field-trial-handle=2000,i,16285772402181194627,6729543130663959390,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4336,i,12417610023476382706,7292848414546597288,2097152 --field-trial-handle=2000,i,16285772402181194627,6729543130663959390,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4348 /prefetch:2
  2⤵
  PID:3892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4652,i,11854422039989258682,13232642081217543532,2097152 --field-trial-handle=2000,i,16285772402181194627,6729543130663959390,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5552,i,5077805842949633440,14283425594903213665,524288 --field-trial-handle=2000,i,16285772402181194627,6729543130663959390,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:5960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5904,i,3956469428888819515,39332809566443164,524288 --field-trial-handle=2000,i,16285772402181194627,6729543130663959390,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  PID:5544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5816,i,8827632388095677774,1805753937538857314,524288 --field-trial-handle=2000,i,16285772402181194627,6729543130663959390,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:3304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5824,i,11226791543928760012,12144323252532574536,524288 --field-trial-handle=2000,i,16285772402181194627,6729543130663959390,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:5444

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3816_2094028610\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3816_769533309\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 b91d3acc3bed7c9713a2ff316af9b129137666e14cd33ac4f0a348bdb9280639
MD5 789b40c5d8ad5d34d1a03bb2fc51eca6
SHA1 f95932b2d4287bc4c9990a00568af48b672ec0a6
SHA512 280c60334396192f48971e6e58f93bfafc37b7881b89216954ae3248ff875cd0ff94dc08c949c6044e30d34ebde81e4ff01e74f4af97b6e03672e0f595d008e4
TLSH
T11BF078B6D922AC3728FC172878B5474AE751236B3B408C5F3B3D920C4FB463B858681C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 657f05275babbfbc4889a27c04c94694bd76ddc92a4e6806d69da31158671437
MD5 d9d0fadf446e5b0e3cc57ac026121398
SHA1 50401315953906665d14c4fb1d9888a83a2099a7
SHA512 28e82f7d15026a73a7e023b60731f782c590303b5542229117dc80fa3aa2b13f4baadb2985cf99f2ce69943f502c712e4a35c4a3e3b5b2fefbb318ad29965a1d
TLSH
T1D6516DB3D3D8C67D841196E4A6216E1FDD690E14531C3C56C8D4AF4F53E2472D25178E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 51694c8a3566c20872e8a9e5348753c6906799b20bdfe37d767543d8e2846aa8
MD5 8b18caca4ed72cd9d102ccaa09b12ded
SHA1 83a33131c2da60b067e7bc1a7da5581bf241aa59
SHA512 7af2a65379af147ec5c3f3ff393a134da1e82d532bf6592876475e516da30bfbff5cb530dd0beae9f16d46231ade3477de625b6a690ed04a0bc5114d6271d055
SSDEEP 192:LRFBur7pG5rueLv7MF+hAPRp2S9HHsb+WNndN09+4kwbODVyIsnAUgtaJ:LRFB8gzgo8X91wr0Val8
TLSH
T15B42B76EEE15697B6CCBD229FD16BB53D7F5103121942E44EAFC8A2C05EB6CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 410dea08ea734bea78a311f722a6674355a87f58b3803aed8451f2068e0d1755
MD5 d9971f2b53b0f85c053c46688062b246
SHA1 46145303cb58e09f45da2b05968084c655932ce7
SHA512 36b7f3983566ebe169b138b23c120ec1781ada9429c6581f4aaaf50f8fe86c7c6c692941e55da6fa99bbcf026284d55893f3346463e76bbf31a2428a482dd441
SSDEEP 192:LRFBur7pG5rueWv7MF+hYPRp+S9HHsb+WNndN0T+4kwbfDVyIsnAUgraJ:LRFB8gigosXV1wr0fLle
TLSH
T1AE42B66EEE15697B6CCAD229FD16BB53D3F5103121942E44EAFC8B2C05EB6CC221711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 876bc727a974959091692db089594792cb93513c79f1384ed5dd73650acdc6f5
MD5 5b281df76b9bbec6b5139f957c54cbd8
SHA1 511ed951d7e510ee963b9ab95125904969b7ece3
SHA512 af70a7325f500ce6542f798018e43a7375c675bc6b0a957f45fdb22782290d51e5b8151810eec1067e3589d1856af403352c434c967a107ec23c8d596f7f06a3
SSDEEP 192:LRFBur7pG5rueCv7MF+hAPRp2S9HHsb+WNndN0R+4kwb7DVyIsnAUgraJ:LRFB8gOgo8X91wr0Rnle
TLSH
T16042C76EEE15697B6CCBD229FD16BB53D3F5102121942E44EAFC8B2C05EB6CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 ebff1e5b0e7f5496edfb52ad36ebe16e681b8ca6f27048409618e2e8f3e5c9d9
MD5 9f5498793714df098c67d0da22e0f2f4
SHA1 a42947d3f8ae1318f5a2fb45e41ace0e7efb6796
SHA512 afeffda39a76fd8adb54e865d543c8d4a6a24c9c4936e1ab20e43238b16c419d2bfb632ec6df46201e7ef39093d2beeed12bc43ae0dd9099e339082f55a8b398
TLSH
T130B01251C0425301C08302B4114224987258EF20971A2B0143E0693AD8261A181140D0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a05dd.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a05dd.TMP
Size 96B
SHA256 19f78f84dbd5325cfa3934d063c01b0858de1efb093b8b23b2bff8dca1315db4
MD5 a2e4b2b2f69d7fabc00b66092306a5a7
SHA1 e922a07baf1ea5aee46ec83c91ece6b43346d68f
SHA512 e390a5d7b7d350b62bab3634fd9ff5baf36d1d1017dee9ee99983e1aadd748fb0421cca7ff6cdaf35fd5f057271ed41b8300068e2849b2ff327b2fbb53691fac
TLSH
T152B002D7C1036662C0622BF027A5EBECB1A1DF25C6035216D3FC1BA6DC257754935170
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 c2f2eebc0a63490f0fd039d1e00216902b3c1205a26dcf26ec5d9a93cc1bbb52
MD5 453637ac88bb858506a32178d2b9f49a
SHA1 5e9bee0d4115770800b395d7cc7881a6dbfe5c52
SHA512 22aa6ad990298596898f281bd3aec09dfc6bb086bf5e07ab55938a61941bc6dafde84350813a60c8fc6ae7be5cdcfd2f475813ab6fa425a00fd33517e79f02be
SSDEEP 6144:L/C2N/IRDb7Z67+oocecG2Xm7Rkm1tYpBeh2BAoc:LKKgb7ZwbBl29oBGcAoc
TLSH
T18C3413277F21AD779869E71E006E1F1B6EF0AD11D830FA9AACC86B0527F62CC0955C74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 142a9a359c28e81a8d379cbd5e682137cd4c2a44c4ba255a20a278333991b854
MD5 3f15a97471b680d40424e866b40eb3b3
SHA1 94ecbc2a62b98295ed0f3a0ae3a0f80a957d9743
SHA512 af516630b7aeb070d7f84e7161628dd63a5a8e76b336d237a2b66ef1d431cc605ad3ef5fbc6071be116508817c1953fdf80f3fdc23c0d485a792e04c6c76f390
SSDEEP 6144:Uh2N/IRDb7Z67+oocecG2Xm7Rkm1tYpBeh2BAoc:UhKgb7ZwbBl29oBGcAoc
TLSH
T1FF3423136F22AE779869E35E006E0F1BAFB09C219871F79B9CD86B0527F62CC0565C74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 e601ee39b5fe6537b53414e03ecc20d42afe18752dc6ed4acfa7504e0b54c560
MD5 c88d719700f5f0d7f7c6e858cef71a10
SHA1 348b7f12116682c614097f140b9b6d9ade4cccbc
SHA512 2ef83e28737410ecfde16bf62a0834c2e8ddd338b82d13afcc7fec79ca0722839e2a27c1031df003a0471e889b4b51619955ac5da215ada9e57459115d3d5927
SSDEEP 6144:Lh2N/IRDb7Z67+oocecG2Xm7Rkm1tYpBeh2BAoc:LhKgb7ZwbBl29oBGcAoc
TLSH
T1C83423136F22AE779869E35E006E0F1BAFB09C219871F79B9CD86B0527F62CC0565C74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 d04c9a50511521fe0628c772335bae18b9642960eec35dd6430890aba4547670
MD5 a50716f9f38074367ec6b4c48cc40e92
SHA1 6495c3b45b49b03c76832fa9220f05596ab73fb6
SHA512 3d2cf3abd3029560db4a2f7b679b03f410f800387fc01a43dbd6cc49971330c1217b5a9b2e89defb1ed1d3416ffc48ef78aff0abad952a33cdc285b34173a931
SSDEEP 3072:/wGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/7m7Rkm1tYpBeh2BAoM
TLSH
T1F5C312275E75E9375878BB4EB08E0B1F1EF14AA6C930DA92C8D86B0467F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000094

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000094
Size 364KB
SHA256 8659c125bc8718eb28f8269dfb43a22a2b080ffa264928c0370e09a444ec142d
MD5 c6684b15c592145210534468e21335d9
SHA1 3ada6b014dc2227be173aabdebca3da225e51cb9
SHA512 2dd829c13df5113112632ccb6288105485ac73f48f08820cf32aef74edfb59287a243fd16c7f88fc208c94ac524117bf3dcc4b9cdd9bc85d6fbc38888e79a1b9
SSDEEP 6144:/xy3n4OXVRq7eQwYem1rSDGHmWjXe4wIg9zkxDHwwoGu4Dz25/tCB4V/FIGzZHmL:/xun4KV+eQwYp6GHmWju4hCCUwosi/7Q
TLSH
T1348423BE81B84C867A3E1AD57943E723C205BE26E1316BC73E4E010A23765E3457BDC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 cb632d9bc397d56f8b2ece8e00b1d77233d3dc7935ea9eb5fe7b4bf8274b7154
MD5 ba26e54f9abb8417facfebccb377da98
SHA1 995d5413eef2edc049b2cffefd8e698f1ce72963
SHA512 469c26d04b9dd6cf7b8cd0df394f4eb84d93220f9623144cb0f432573fba4778a0c0e3fe8d05a3357417801e8a903c61390be1cf2a3fd52d350bf3d0b4f1b3d6
SSDEEP 96:JCdoKVitKQV4OtoTqly3QDT7qMyHnanXoOsjyljEcoz/VThYdomRi9accxjF51J5:JCdoEi0lOtoTqlyADTbyHnmXoOsjylIa
TLSH
T191B140305B408DE8DB803570A8D666957832DCD5FC430E82B7766D70B91BF4189F9BBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\manifest.json
Size 962B
SHA256 5694c91f7d165c6f25daf0825c18b373b0a81ea122c89da60438cd487455fd6a
MD5 e805e9e69fd6ecdca65136957b1fb3be
SHA1 2356f60884130c86a45d4b232a26062c7830e622
SHA512 049662ef470d2b9e030a06006894041ae6f787449e4ab1fbf4959adcb88c6bb87a957490212697815bb3627763c01b7b243cf4e3c4620173a95795884d998a75
TLSH
T1661121366E2FC4260AE00698DC51308AF92453ADD380850E35BCE42E5B744FA430631E
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.pinterest.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 ce1501ae4334966d61f0b45bd77b1830ac241d55ef9d00e8a5324051c820b052
MD5 46659c9cf2a894ed09b71756c88a193a
SHA1 e4c7d0c176669a4173169ab54ffee71152fe3b5d
SHA512 9729bee2e150257af2f0d32d44e988f8d6c8ceabd3a7ec0d48dbc8960bcd6b08e194dbd695ec1a49e97ba85662ec6dc09607b45658d5de3e4c073e4a883bc749
SSDEEP 192:D00VK4wfUu4cEeW8GRo4kj6Qz2aqf218ndPF7eNRUr8ANiYQ:D00VK4wfUu4cEeW8GRo4kGQz2aqfG8ny
TLSH
T13F129BF7C3E48A6D8C119AF0AA14AD1FCE5D0A54822C3D168CD8FF4BA7E3471E24155E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 4535a28c2ca0a217d1e290cfaf7010046feb896c9deb4f8579df41cb32fb9ace
MD5 801209c29f9cd5c09fec4f675528be09
SHA1 56101badb8a340583064c530c9090df160e0dbd3
SHA512 55a9863b4b5fa8d2c4c9f9b59d85be56f9bdd872faff70cb011cb8d7d4dc2e821cf1421d64afbe28a0c802d8c9fc96009143952437f7f641040d8b7f1aaffa12
SSDEEP 192:D00VK4w0Uu4cEeyGRo4kj6Qz2aqf218ndPF7eNRUrs4PQ:D00VK4w0Uu4cEeyGRo4kGQz2aqfG8ndk
TLSH
T168029BF7C3E48A6D8C119AF0AA14AD1FCE6D0A54872C3D168CD8FF4BA7E2471D24155E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 2ac92484063a6d316b05394c5781687e27100ae294cc95df74ad48e1b692776f
MD5 4b746ab10e54e449bdfe6140a1b35a0b
SHA1 807a8e794fd055c5660c20b856eebd11bf079cd5
SHA512 2c1c620000229600e713da06137426c68def04da7547391f893842ae34842245c71ac8c4996c69897a4edb829a3ff3a4e119befda4e68d2ba65814237037973a
SSDEEP 192:sxZwRXyM/jK1Ml8Mk3/fXs7H+iIuSCO3gVRIdpzU9XzyHW6+WN08mFC/BDL6KagW:sxZwhM3/fXsT+Rln5xHbz/p3B8Uc
TLSH
T1FC62D852AA345D778CDBD219F955FB53D7F91462E6800E44AAFCCA1C00EABED2207C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 3c4ab31e4b5b545b3052ff44b2bba6bf12a6a375b70ded7881cb33294a9b5cb9
MD5 4387dff461cb499eebceb11d9e4505ae
SHA1 d5776224ee420c02b2fec8a02bbef6b8f0bc13d2
SHA512 2b5370b9fdd822253fc7d4dbf1d2f082ac13d935583779982c918f37359a56bdf7f81910b12fee1a08d0927fc01b6f4a30969fb18b285d8b8aa763366d64a1ca
SSDEEP 192:sxZwRXyMVjK1Ml8M93/fXsw5+bIuSCO3mVRIdpzU9XzyHW6+WN08mFCTJu/BDL6r:sxZw713/fXsc+8lnbxHbz0/p4B8Ux
TLSH
T16472D753A9385D778DDBD219F945FB53D7F91422D6800E84AAFC8B1C01EABED620381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 fe05722d33342d86ae5f0815ce86e6079ac7458e96ad2b6747009a574459705f
MD5 774ade54de4741607f7ce915ca57d1d5
SHA1 49f93451a6efb5dd2e42abd3793d8b5a0d20ad41
SHA512 5f7ad69283164eb9d9ac1867c5b52d5007303ebaf3b40155f5bd240f744a6fbfa1ec7eca9d0ad1df771398fd0673207dba62925bd083b39035d248b84a76ecfd
SSDEEP 192:sxZwRXyMVjK1Ml8UQp93/fXsw5+bIuSCO3mVRIdptU9XzyHW6+WN08mFCTJu/BDi:sxZw7qL3/fXsc+8lnbXHbz0/p8B8Ux
TLSH
T12B72E753A9385E77CDDBD219F951FB53D3F91422A6800E44AAFC8B1C01E6BED620381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 dd029f96ebbcac184116cf25aee346bb00bf818646185ddc7c3dc260bbc862de
MD5 cf4ccfaeed3d8b0834da237260607425
SHA1 04df008e202fab5d33299e92ee12f94928324278
SHA512 0b52777af704da08f9cd15f70262a984adcaa272ae04ad15229bff34787fdaae622e4a67bf3d28d4d31b1b3697e9c30c8e5fc5ad13cfc6b80c7441a8ebd33a09
SSDEEP 768:C4seJvX7pLuLXhxWvhfwn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVKZVcLly0pptro0:C4seJvREXhxWvhfwnu1jaTZVcL88pG0
TLSH
T147F2EC3B680CCB7E4F844E9CED2A7F9A6EE801CB56D8895447F9840C02C66EB15175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a4722af5a902a06aac62cafa48c605bb30bdba6dfb0113e48a4a70ea258fbd2e
MD5 333b4443fb16ff181124d5c9ab26fe17
SHA1 72f9aeba5326b72683f06cfa2b113c83187a8e0b
SHA512 4d19a9156396cda84406cf930e33b1eb499b1e0da775b01d74424e79eee7ef585c1b12221621c23432927bb796c3f5911c28f27f9a9a66e25294e3d307704469
SSDEEP 48:KYHIhKggkXyFrI1KAUonyhziHD1RFARpETIwbAKjV7dAXrQe09nz:KYH+Kggm+ruKAUyyQgKJu+z
TLSH
T110910416743A02122C3D3D8CB2A596764F4531A37468A8EFBFB904624E67E214EFCDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b1c6b02d-0c50-4108-8505-b0b18eb98d4f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b1c6b02d-0c50-4108-8505-b0b18eb98d4f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 baa5849ab2538122fe9926fb8fee2531ce763cd480e9fd80bc11298f08bea10b
MD5 6de06be72314066bbca348d7b9376436
SHA1 4879f7e9e35ec4e00dc1106a023686ad6dc426cc
SHA512 c0e57b48165a93b09887bd89ddf0d18b9d47221110213f81184c7aec048ba4ced515219186f30d639843436c17451fe69118fb5283240bec0ae0a684be4c51a6
SSDEEP 384:z8dtNnNnb9+sNWNkXf7RiWikdcxMdUm3f0:IdjZbEzyfjpnUm3f0
TLSH
T16F623B3169386D77AEB3AA86F14B37031FF851AB95D42E94FAED5F0D01C729C1306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 ffd8b277ade342037267f941954d86e5da9bae0abd7eeb2f7932b90fb0a4aff5
MD5 0ebc90b17e0288991bc07ba02613f214
SHA1 a6cd51dd67a96b9b63e554ba27c6a1e1a3273fc5
SHA512 b8d8485223f928e105dedd3e2e02fab2d26bfd6980f837dca4b49ea5d3d6574e6dc001d646bc10c9b93ff2cc5c7b3f4c3651828a14df72c98cb27525c3f2a960
SSDEEP 384:yfgiF1tNnNnb9MdsNWX8TUNTUlIl7Xf7RfTzo+Ai5DfcQdcxMdUs3f0:A7F1jZb0zXwgVf5zo+ANQnUs3f0
TLSH
T1D5C261F298E79976E9AE5783A33E7E425EBCC15775841980BBD81E0CCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 e133aab46baff8e0c840cce9dd61b04b7c8fae380ddf574b57fa5160143f646b
MD5 fe0fe9b50e316a5ae86381782cd90685
SHA1 b63aa7d1b50fb8fe7ea4d926d5af73177bae3142
SHA512 bddc9f6433f4c22f4f0614aff45103841d546996470d56a6deb72ff46871f5592ebdcebca12e05fa1b92a9491494fd782674aa2cdf43e9128cbbd8a292c35278
SSDEEP 384:y8dtNnNnb9lsNWNkXf7RgbikdcxMdUm3f0:1djZb/zyfIpnUm3f0
TLSH
T1DA623B3169386D77AEB3AA86F14B37031FF851AB95C42E94FAEC1F0D00C729C1306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 a941548f286c42c280b730a69d746c98993178fc5c748682866194e5b11c218d
MD5 2e87ff74a466fbc8e368826db500d291
SHA1 59d3bf1f36251e43ba74454d3dd0c9f4ca7f60f6
SHA512 544d4dd205242de426d003b463471becfc8e58274d9d8a3c6494bbaab700f8857facf9ab90f25e28fb8e92afa60c87afbaee14ab9cf475c4d06d2a9e238717a1
SSDEEP 384:yfgiFNtNnNnb9MjwsNVX8TUNTUlIl3Xf7RfTzo+Ai5DfcQdcxMdU23f0:A7FNjZb1OXwglf5zo+ANQnU23f0
TLSH
T102C261F298E79976E9AE5783A33E7E425EBCC15775841980BBD81E0CCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 926b4acc789f38011fda80346d53f2c410cce66c3242464f906605ea6f092e8c
MD5 2ad7bf8f9d3d9fd3bc012811c483b02a
SHA1 8c08f854340c3dbe29e6fe8cfc83e5650a0e1e10
SHA512 c553ce89b7cf933e6a7da9ac8a305a82815845d0d1e5499e1a5901eb1bd3583f0e7825dd5a70a69c2fcf691103a3504f9b443b886ce05613c542b2c573c4d5d8
SSDEEP 192:lONSs6vM/PQmiUyT8+hTAn+FdLQx6ptFd3E480Ii/gU/u:lONSs6U/RF+7dcxMdUd3U/u
TLSH
T12412FA71AC786C67AAA3AE86F48B37175FE4516BA9C41B50FAE91F1C00C779C1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5f2ac33b65018fa9fe080e436fbbc13879ec6652085516c7480409e05030d32b
MD5 0fbbc3e08db7b0ab28e2087e5ef7a039
SHA1 6da56a389b8891979f10ed3a480b2b62eb6a799f
SHA512 1b071e50b1479b40e72db7420ee08bec2f30168fdc530a57c930af838ce3fcf591844e456160044e4d1e1ea04cb564196bbf64d0c9cca895717e367711e8d97e
SSDEEP 192:lONb6vMtPQmiUyP8ThTAn+FdLQx6/847qMU/u:lONb6UtRvT7dcxE3U/u
TLSH
T14302F935AC786C7BEA73AE46F48A37171FE4516FA9D01B54EAE82F1C00D765C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 5da3351f1fcc3b1f3bdbc839a77eed3b84dd0cb86d66c47ddc13522c4ce2d71e
MD5 359d0df701ed5aaf63f6518cb3c50088
SHA1 67941a3be791944a7d9a28dc059c667801e75ddf
SHA512 2d00140d390551daf74a4ae0e9ec718341ed9e7f7a523cc2419f8991c4aff1038d10a39587be275a5557dc70493e534617b44021a28ce49a28e3e848b70f9301
SSDEEP 384:yXdtNnNnb9AsNWN7Xf7Rf9ikdcxMdUm3f0:edjZb2zNfrpnUm3f0
TLSH
T196623C7169386D77AAB3AA86F14B77031FF851AB95C42E94FAEC5F0D01C729C1306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

f0b01328-1612-4c8e-9418-7ace4265a876.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f0b01328-1612-4c8e-9418-7ace4265a876.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8fb70b6e2c158583c23f562810ffe4098b1065e72d53c70621c9c829d6a15378
MD5 104ecdb016277a3d8f0e7363c32dd262
SHA1 d0df77e50e48cae5d45dc6c67ee54453ede898d5
SHA512 493e2849fa2819c4d00db284b0039a830d3d08fee367d8c721d2454a416119daa7d7c66624ef1fdc95d0dc1f7c2a6cf40395f52b322adc388e632562fd60717d
TLSH
T19041065CA6EA1108B3B36F5A9BF7686D447F7D732E07C59D10110E8E0A23B40D8A2B37
MD5 SHA1 SHA512 TLSH

Submit Download

4df4d714-df8b-439c-8bca-c96ad8510ba1.tmp

Path C:\Users\Admin\AppData\Local\Temp\4df4d714-df8b-439c-8bca-c96ad8510ba1.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c9000741-06f4-477a-8746-d49c593e8504.tmp

Path C:\Users\Admin\AppData\Local\Temp\c9000741-06f4-477a-8746-d49c593e8504.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3816_1008305396\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2868ba96-92d6-479e-8200-5f1923413a9e.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3816_532538981\2868ba96-92d6-479e-8200-5f1923413a9e.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download