hxxp://amazen[.]com/

Analysis

geolocation tags

eueuropelondonukunited-kingdom
user interaction
yes
max time kernel
179s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/06/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://amazen.com/
Sample260620-2casdaaz4w

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4528	chrome.exe
1964	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264679630093653"	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{3651BA10-850D-42FB-B019-6780B13F64BE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3356	chrome.exe
3356	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
4092	msedge.exe
3864	chrome.exe
3864	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
1384	helppane.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1384	helppane.exe
1384	helppane.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 2720	3864	chrome.exe	86
PID 3864 wrote to memory of 4188	3864	chrome.exe	87
PID 3864 wrote to memory of 4188	3864	chrome.exe	87
PID 3864 wrote to memory of 4528	3864	chrome.exe	88
PID 3864 wrote to memory of 4760	3864	chrome.exe	89
PID 3864 wrote to memory of 4760	3864	chrome.exe	89
PID 3864 wrote to memory of 2088	3864	chrome.exe	92
PID 3864 wrote to memory of 2088	3864	chrome.exe	92
PID 3864 wrote to memory of 2716	3864	chrome.exe	91
PID 3864 wrote to memory of 2716	3864	chrome.exe	91
PID 3864 wrote to memory of 1972	3864	chrome.exe	93
PID 3864 wrote to memory of 1972	3864	chrome.exe	93
PID 3864 wrote to memory of 4224	3864	chrome.exe	94
PID 3864 wrote to memory of 4224	3864	chrome.exe	94
PID 3864 wrote to memory of 2328	3864	chrome.exe	95
PID 3864 wrote to memory of 2328	3864	chrome.exe	95
PID 3864 wrote to memory of 2296	3864	chrome.exe	96
PID 3864 wrote to memory of 2296	3864	chrome.exe	96
PID 3864 wrote to memory of 2820	3864	chrome.exe	97
PID 3864 wrote to memory of 2820	3864	chrome.exe	97
PID 3864 wrote to memory of 3196	3864	chrome.exe	99
PID 3864 wrote to memory of 5012	3864	chrome.exe	109
PID 3864 wrote to memory of 5012	3864	chrome.exe	109
PID 3864 wrote to memory of 872	3864	chrome.exe	110
PID 3864 wrote to memory of 872	3864	chrome.exe	110
PID 3864 wrote to memory of 3840	3864	chrome.exe	111
PID 3864 wrote to memory of 3840	3864	chrome.exe	111
PID 3864 wrote to memory of 872	3864	chrome.exe	118
PID 3864 wrote to memory of 4304	3864	chrome.exe	119
PID 3864 wrote to memory of 4488	3864	chrome.exe	120
PID 3864 wrote to memory of 4556	3864	chrome.exe	122
PID 3864 wrote to memory of 4556	3864	chrome.exe	122
PID 3864 wrote to memory of 1188	3864	chrome.exe	123
PID 3864 wrote to memory of 1188	3864	chrome.exe	123
PID 3864 wrote to memory of 1712	3864	chrome.exe	124
PID 3864 wrote to memory of 1712	3864	chrome.exe	124
PID 1384 wrote to memory of 4092	1384	helppane.exe	129
PID 4092 wrote to memory of 624	4092	msedge.exe	130
PID 4092 wrote to memory of 1964	4092	msedge.exe	131
PID 4092 wrote to memory of 2924	4092	msedge.exe	132
PID 4092 wrote to memory of 2924	4092	msedge.exe	132
PID 4092 wrote to memory of 2924	4092	msedge.exe	132
PID 4092 wrote to memory of 4800	4092	msedge.exe	133
PID 4092 wrote to memory of 4800	4092	msedge.exe	133
PID 4092 wrote to memory of 3304	4092	msedge.exe	134
PID 4092 wrote to memory of 3304	4092	msedge.exe	134
PID 4092 wrote to memory of 3304	4092	msedge.exe	134
PID 4092 wrote to memory of 3276	4092	msedge.exe	135
PID 4092 wrote to memory of 3276	4092	msedge.exe	135
PID 4092 wrote to memory of 3276	4092	msedge.exe	135
PID 4092 wrote to memory of 4556	4092	msedge.exe	137
PID 4092 wrote to memory of 4556	4092	msedge.exe	137
PID 4092 wrote to memory of 4556	4092	msedge.exe	137
PID 4092 wrote to memory of 2820	4092	msedge.exe	138
PID 4092 wrote to memory of 2820	4092	msedge.exe	138
PID 4092 wrote to memory of 2820	4092	msedge.exe	138
PID 4092 wrote to memory of 5312	4092	msedge.exe	139
PID 4092 wrote to memory of 5312	4092	msedge.exe	139
PID 4092 wrote to memory of 5504	4092	msedge.exe	142
PID 4092 wrote to memory of 5504	4092	msedge.exe	142
PID 4092 wrote to memory of 5776	4092	msedge.exe	143
PID 4092 wrote to memory of 5776	4092	msedge.exe	143
PID 4092 wrote to memory of 5776	4092	msedge.exe	143
PID 3864 wrote to memory of 5856	3864	chrome.exe	144

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://amazen.com/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa378ac728,0x7ffa378ac734,0x7ffa378ac740
  2⤵
  PID:2720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1676,i,2407393874983423141,7895582806290525263,262144 --field-trial-handle=1976,i,15246459573156223144,3685893587725222052,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1472,i,7454283404595183263,4965868970044142712,524288 --field-trial-handle=1976,i,15246459573156223144,3685893587725222052,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,18380306719769142376,11357606008163578374,524288 --field-trial-handle=1976,i,15246459573156223144,3685893587725222052,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2368 /prefetch:8
  2⤵
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3132,i,14547540217725613446,13415189506356139237,2097152 --field-trial-handle=1976,i,15246459573156223144,3685893587725222052,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3144,i,4671900773516184050,5724083103036833819,2097152 --field-trial-handle=1976,i,15246459573156223144,3685893587725222052,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4344,i,3432865404790160743,8309192466424980420,2097152 --field-trial-handle=1976,i,15246459573156223144,3685893587725222052,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4376 /prefetch:2
  2⤵
  PID:1972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4684,i,9181291362061217261,12342798201590027154,2097152 --field-trial-handle=1976,i,15246459573156223144,3685893587725222052,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4888,i,10870466104312274247,8716606291912970005,2097152 --field-trial-handle=1976,i,15246459573156223144,3685893587725222052,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4708,i,15900129109388046218,5173952457442500118,2097152 --field-trial-handle=1976,i,15246459573156223144,3685893587725222052,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4860,i,9997020536292274749,2212485157888474794,2097152 --field-trial-handle=1976,i,15246459573156223144,3685893587725222052,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5416,i,2373082052830478659,5574509280754796909,524288 --field-trial-handle=1976,i,15246459573156223144,3685893587725222052,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:3196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5684,i,4894690940772966416,15934489151378169889,2097152 --field-trial-handle=1976,i,15246459573156223144,3685893587725222052,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4856,i,12456852475702748788,4547995797467245519,2097152 --field-trial-handle=1976,i,15246459573156223144,3685893587725222052,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5020,i,5483793041429092031,3355352398283155099,2097152 --field-trial-handle=1976,i,15246459573156223144,3685893587725222052,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5952,i,11835646641497685064,10582067875238077898,524288 --field-trial-handle=1976,i,15246459573156223144,3685893587725222052,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5888,i,7153787777746420033,765145081726273345,524288 --field-trial-handle=1976,i,15246459573156223144,3685893587725222052,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:4304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5948,i,13137066725144997608,9647612903033829746,524288 --field-trial-handle=1976,i,15246459573156223144,3685893587725222052,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5888,i,12184780027305065876,8230662955110258477,2097152 --field-trial-handle=1976,i,15246459573156223144,3685893587725222052,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5828,i,7667013443403821006,13177468833212358045,2097152 --field-trial-handle=1976,i,15246459573156223144,3685893587725222052,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6012,i,7980933126223380226,12568341299642642696,2097152 --field-trial-handle=1976,i,15246459573156223144,3685893587725222052,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5624,i,2414274983622616798,8877524910706244097,2097152 --field-trial-handle=1976,i,15246459573156223144,3685893587725222052,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5844,i,1220993004388393543,10466723199429116123,2097152 --field-trial-handle=1976,i,15246459573156223144,3685893587725222052,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:5944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6048,i,8667731925675192537,9272640580536895314,2097152 --field-trial-handle=1976,i,15246459573156223144,3685893587725222052,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:6060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5924,i,15994480861837501687,12131756356725363611,2097152 --field-trial-handle=1976,i,15246459573156223144,3685893587725222052,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:6096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5824,i,3884359943081571672,9194086932804239682,262144 --field-trial-handle=1976,i,15246459573156223144,3685893587725222052,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3960 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=3304,i,14041933907563215845,8210034988854669510,2097152 --field-trial-handle=1976,i,15246459573156223144,3685893587725222052,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:5392

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3908

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2136

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=528884
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x314,0x7ffa2d09c188,0x7ffa2d09c194,0x7ffa2d09c1a0
    3⤵
    PID:624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,14868997722929407356,12443914747578538693,524288 --field-trial-handle=2344,i,8263871788686488073,5937406146932291830,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,8856714253565062261,2982934952472155933,262144 --field-trial-handle=2344,i,8263871788686488073,5937406146932291830,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
    3⤵
    PID:2924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,2718840957576010685,1952747374998719686,524288 --field-trial-handle=2344,i,8263871788686488073,5937406146932291830,262144 --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:8
    3⤵
    PID:4800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,14105159834029666291,16832258659835174350,2097152 --field-trial-handle=2344,i,8263871788686488073,5937406146932291830,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
    3⤵
    PID:3304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,7961137583298507371,15628223945233053462,2097152 --field-trial-handle=2344,i,8263871788686488073,5937406146932291830,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:3276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4120,i,7116720440946380407,7724632903438085016,2097152 --field-trial-handle=2344,i,8263871788686488073,5937406146932291830,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:1
    3⤵
    PID:4556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4152,i,1606835967589486477,12453869572239418854,2097152 --field-trial-handle=2344,i,8263871788686488073,5937406146932291830,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:2
    3⤵
    PID:2820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,9520468348209578362,15828471935974116053,524288 --field-trial-handle=2344,i,8263871788686488073,5937406146932291830,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:8
    3⤵
    PID:5312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,9011535924659795644,4764506859234024106,524288 --field-trial-handle=2344,i,8263871788686488073,5937406146932291830,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:8
    3⤵
    PID:5504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5096,i,6188983614180797375,9418228435685427409,2097152 --field-trial-handle=2344,i,8263871788686488073,5937406146932291830,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:1
    3⤵
    PID:5776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,3071480235109351391,3872184254258839946,524288 --field-trial-handle=2344,i,8263871788686488073,5937406146932291830,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
    3⤵
    PID:5924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3920,i,2821476743315044903,2396297144302149523,524288 --field-trial-handle=2344,i,8263871788686488073,5937406146932291830,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:8
    3⤵
    PID:5932
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,16188083121549316262,8289315866517193004,524288 --field-trial-handle=2344,i,8263871788686488073,5937406146932291830,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
    3⤵
    PID:5460
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,16188083121549316262,8289315866517193004,524288 --field-trial-handle=2344,i,8263871788686488073,5937406146932291830,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
    3⤵
    PID:5468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,1197218851584770995,16154202085521776732,524288 --field-trial-handle=2344,i,8263871788686488073,5937406146932291830,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
    3⤵
    PID:6104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,8756024198196361706,10132699567053329809,524288 --field-trial-handle=2344,i,8263871788686488073,5937406146932291830,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
    3⤵
    PID:5284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,13769877506318734382,9188368596410013873,524288 --field-trial-handle=2344,i,8263871788686488073,5937406146932291830,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
    3⤵
    PID:5304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,3511532346799652846,7784768082550551712,524288 --field-trial-handle=2344,i,8263871788686488073,5937406146932291830,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:8
    3⤵
    PID:5276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,5140042079973090810,681251567272926666,524288 --field-trial-handle=2344,i,8263871788686488073,5937406146932291830,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
    3⤵
    PID:1088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6220,i,2826979175426595388,454104201187884854,2097152 --field-trial-handle=2344,i,8263871788686488073,5937406146932291830,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:1
    3⤵
    PID:5352

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1a5f6b1d56f1b890594808a9fa522d8125e871353f7413fa01713597b8aaddc7
MD5 f33a462b17e419772d246ade08762eff
SHA1 67175d096cdfd8d4ffc1056e80d8c2d1c43b61be
SHA512 29e7b9c23ee16e5977281bc003a6c526fe3446aab08b47bf67c296e992d1ad1513384560fc97bfcd6c952299b7c40006ea5d74e8c622fc204b6e73a0b0f996f2
TLSH
T1BFE02BBAC921ED2B19FD071824580646E75423572B80456F7A7C830D8FB97360586C1C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a1ad37023ee1c2a805c557dd99e86a6cc340a1c467a646a9974f9b2ccbf955e9
MD5 c43dd4344c8bd05dbb76974fc61c3721
SHA1 56bd246c3eaac334a497b98560cec53f4870b4e2
SHA512 b117f0d26ade0189f664e6d557a28b35115a08f92993625f7ceb619c51476d80bd0d956316f763186dd7da16354d271e8a1273cbfc9bdb5713762868ea2d858b
TLSH
T166418DF793B4897D8A1192E4EB156E1FCE690524431C38B6C8D46E1793F2872E10079F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 e21f4cf817ad45fac29ad0cc88543db2a4bdf614c291d1576936ad74a2b0f8c3
MD5 c18e263dc64adb5d38d31a6066c66d25
SHA1 3e59c268924717d0019508ed56ebbd04965c60e5
SHA512 961e914c2055f23499dc0884cfef378558a2a820787dda3b34ae85e9f2f8cc824b9252bd0a7b8c666b23a0ecaad1df2f0347ff596087acd7d9b18d63a2165a26
SSDEEP 192:wRVm8Seq8Iakmv72ymp9PRplM395Hsb+WNn6OfS4gNFnIGSVyIsnAUgE:wRVmozkSQPX87wDdgrmE
TLSH
T15162C62EA924657BECD7C229FA227F27D7E5107226902D44EAFC861C14E79CC321742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 beb6ccaacbcb1a87b0bc531e8bcc25222ed61386df3609a9b00f9f2c4c60fdea
MD5 3c2ccecf167e4353fafc04715da2d44c
SHA1 1729308ccb935bf3338da8b43e1ed308d4fb758d
SHA512 c4fce48b35156524c5fa85cfd36740173e7de4c713db77183ccc122183b16ed69b5b1840a5af7ba7b4d981ef89af3b52174dda633065aa101bc646de1fb83d92
SSDEEP 192:wRVXO8SOMq8IakKv72ymp9PRplM395Hsb+WNn6OfmCi9cIjFnIGSVyIsnAUgE:wRVewMzkGQPX87wDOT9cI5mE
TLSH
T19262D62FA914697BECD7C22DFA227F67D7E5107226902D44EAFC861C14E79DC221342B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f60634d9479362b9e8c26694d551745073a367b413c84089d9044355320f0f5c
MD5 6534af383bb7b527423f913666527afa
SHA1 236462a16d8a795b7c5a0d47ea7c9070c6a29cd6
SHA512 3c1670871277d9b659884d2af600b785c7f3a742112c3b76b80be757ce326a0d45f0a7365d94bac235f1016a709a68d5bd645479b42e14eebc319555e8b5e2ad
SSDEEP 192:wRVsq8Iafdv72ympAPRp2MH95Hsb+WNn6Oflq2QFnIGHVyIsnAUge:wRVszfdQUXL7wDo2MVe
TLSH
T17642B52EBA10657BACD7C219F9627757D7F1107235942E80EAFC8B1C18E79CC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 cdde9accf3ac08797459d5263ef99e3481694288e4c9554f9063b9d83c05987e
MD5 b4adde0a69359f9671126b8fd4a34c9c
SHA1 0123893e914fd33ed279310c2ca8ee9416b72e37
SHA512 a7f48308557e3aee47d1bcbb970fbd1606f21bd3ddbe83897529e97b5f6a82eeea0f55b671251f65d1d1ade76c70b205337881a04e83cf200a70ae0ae4f37441
SSDEEP 192:wRVsq8Iafxv72ympAPRp2MH95Hsb+WNn6OfedeNFnIGHVyIsnAUge:wRVszfhQUXL7wDIerVe
TLSH
T14542B62EBA10657BACD7C219F9227757DBF1107235941E84EAFC8B1C18E79CC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3fb5193f1bffb4b1f643516c1be103d0b07f236c9b73d02596f5ee4af823e192
MD5 7cdbecb69f708605c106ed2d2959286c
SHA1 93f0a16c3bc74e3824e2ae0dc1faff8ee5b45647
SHA512 e2628628c921725a324bd1197abc65547b6884d907ccb006ce6ea6537b20047117b3b20214aa20308ec615ff1875837eb40344be27ed5030af0e5c31bbf5e519
SSDEEP 192:wRVsq8Iakxv72ympAPRp2M195Hsb+WNn6OfOwYSFnIGQVyIsnAUgE:wRVszkhQUXZ7wDxYmIE
TLSH
T10F42B72EBA10697BACDBC219F9227757E7F1107235941E84E6FC8B1C19E79CC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
TLSH
T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 169e06701cdece5107fcbd782ff0f0f4ec286aff2f6fe6e6061289ccee3a4e9d
MD5 bfe1310dd38f698eb0c0918586129b77
SHA1 61b83aa8ffbea7778481a5f88644d2a0057ebcaf
SHA512 d86d81def2c77315167620047ad155a417f9127ab67d6ece76f4156ea40db67058c5f2f149d2fb3747f62c6ec1d3624883924db1224091610087b38ad22bc528
TLSH
T1CDB0124180425522C08203F81142148871A49F10E60A1F0983E46933C8251508424050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58536a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58536a.TMP
Size 96B
SHA256 d366c1911af897d4be3c3d5703cafd1ae3ff29bfd2f03c5854c097254cb21313
MD5 ba32fa8cd9054122ab53f20a9e313cf2
SHA1 7cd05848bfd39eb22a7cc8d765140d9773080c42
SHA512 f01de7e17d2ceb5600242b660a0a30bd9dbb09cd6702a348ec3f4d0baa907f72aa16296e68bff4f7d6f0eeb55eb30b689be13fb2c35d9fac3ad6c94dcdc753d9
TLSH
T170B00255C1126312D08213B0399A9EDA7161DF27C6471217D3F11BE6DC29A608525960
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 950d5590f2b3758e83935bd23c85ffd007487e66e59927d364c4794c4ae35681
MD5 cc33e80a43a34aaf1ad721bc89b265e7
SHA1 16191280bdfadc19f2063857c3ade55455d880d9
SHA512 9e1275c3fdecb2dd7a27c00c2fe1022e6edad2d13e43069df4053bf4cd9e0ee3a81adb1079eaa44b250b7ed41a59e986a8aee7932da95629a65c6ea2447b8de6
SSDEEP 1536:9XyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:Hqfd7NtZL8cHQRZEQ6Spsk
TLSH
T156C30237AFC61E339DC2DF60B9130EDA53F644A9D034D305EA6D77AB6C83491A44289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 09ed75ae2359507d3a76ca2000ece3f95da2a8af2ff5aec0daa3b47811143ae6
MD5 d02042ce00795a27b5a50da947f6dcb2
SHA1 3fbd4902434085e96787c87cf2f29734ff078352
SHA512 99aa7cfaeda8ed2d2d4a921490ce23485a87ed1ef1675a3a2e6993c8eaea16e9ccefac9c108683d6736270e8f6e6b23f882365563023c7656131081d9122e70c
SSDEEP 1536:TtQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:0qfd7NtZL8cHQRZEQ6Spsk
TLSH
T129C30237EBC21F339D96CB60B9530FD697B644A99034D301EA6D77BF6C83891684289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 f9c0389cceeea21b061815c90c77d000777aa951b603d7577e2087e648973817
MD5 5c657b3fbd66b988fae8dedf12b86aaa
SHA1 4e7d998403934726af75fcf53edfb1baaef09963
SHA512 027df7612311d4c4a2e869a66f6f506009de6cc574f6863533bf1a18e636240cca91c3c245890815c81c3a41e0645bc972f68bb1b28ba9d6f63dc5faca2529de
SSDEEP 1536:caxeyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbz:zkqfd7NtZL8cHQRZEQ6Spsk
TLSH
T1CAC30237AFC61E339EC2CF70B9530ED797B544A99034D301AA6D37FB6883895658249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 73208ba578b17e21ce9270003931058804edf8613478763177294715d3e6fae8
MD5 499fd4db1bdab031fb4804ea7f7d76cb
SHA1 f2f07d8b17c1aac5406524c854dc9c727e3a19be
SHA512 83e38455503e6a6f2fea86ee4a336ab08cfa07fd2f3706f017ffa25560ce235171d6db61586f479975475295bd27f8e473921256b34b1c5a3a2ecdeb54cdf8bf
SSDEEP 1536:9axeyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbz:akqfd7NtZL8cHQRZEQ6Spsk
TLSH
T1D2C30237AFC61E339EC2CF70B9530ED797B544A99034D301AA7D27EB6883895698249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 7efbe8d25d4b29cba413a21a46503594ec0f602cfbd5340c012a13e27c533cf7
MD5 865cacb090cf77918b413f66ff3d3fb8
SHA1 ca25daa0556be2de81e5d6878b99ac152e8d78aa
SHA512 34d5d3645839c123ece81f971dd740f1c9491bd890e3d28ded41e09d3337753270e546917b3009d72488ac4c045c7f868394a8a8efad349810519917e8655f59
SSDEEP 1536:9NyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:Jqfd7NtZL8cHQRZEQ6Spsk
TLSH
T103C30237AFC61E339DD2DF60B9130EDA53F644A9D034D305EA6D77AB6C83491A44289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ade204e90379c9ed596d5b9654f95c49520f2eb9b4354cd4d6e306f60b5656f8
MD5 d6527841c8e22f82f47dc963372aa2be
SHA1 8f3c140e6a4496c67b6ec8fd7d47339e4b3a7dd0
SHA512 c461ba22986885f29dcc6bcc09c8657d63edb2c26efaa1f4aa812cce2b9f6b3c316fbebc1f1fa6eb62823ce873f044560b0a0f065ec035b4f2947778252f8858
TLSH
T190D0A721741A78D1D23F103549219264A5594153A371824A7610480ED97984467D1A97
MD5 SHA1 SHA512 TLSH

Submit Download

8ddcf98e-3156-415b-a2ce-864a1d201866.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8ddcf98e-3156-415b-a2ce-864a1d201866.tmp
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 7fc9336231f8ca61431d4ed358b7c9e6536b24363fa7c09eb3aa2a6f3c8e3006
MD5 2a0034b97848efc2f7737d4581f0c82a
SHA1 cb49291623186b0b7f67f992d815f35ab9432420
SHA512 d34d1ca7162e02b432328c57a5c36201841f635c33be7e8e934bcc0f04bfd02a9d9779cbedd053fe8f0bd735f84c050d0f0d6820d2a51a75329e6e59f52e4e32
SSDEEP 96:umI/u+NAgVBf13069dnRe6vwVfTO404cJiUCtStntqDd+EobFUD4D2ZTknfhn1IF:ulm+NAgVBf130AdnReGwZTzVcJiFtStM
TLSH
T1EFB14BD90D458099EFD60D31DFD0D7E83734A282CA8B6E7A466CC8BC5532FB14AC215D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe593cd0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593cd0.TMP
Size 3KB
SHA256 201085c0330d77316de1557b75bf06e501849804afc53b2e6234220b70b8e22b
MD5 0bb363a49ec97cc4218363a398e3d03e
SHA1 1512d6b43033e4bf66ada182f844f7e76395dafe
SHA512 873f3355be7eafe182a9c5abde11c24572e530a9392a3fb334b91f60d0cda1d92a52059ff2c0b31aacdbdf1b544c017f1d088c1d4dfdf170408106e19c96d300
TLSH
T101610A190E05549DEFD31631E5D123B83AB4B3978ACFBE56421CC8BD6A35F3246C600C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e32c08fbb5c409a606a79a383783638b6b4ca9403890bb51a31177d0b76b6e40
MD5 a81cbb5f8a970a310bbbbd3ad88c1e75
SHA1 889056b1aa8b16706589f4b3e4214d4fd536ad0f
SHA512 86f4a499cdc93aec14b9a09bb574fafff0ceded2acb9bbecc4c93ffcc5e369e39660094cbd020dc9e53adb7557c763ae8317afbc81e76c6db194411a99ca64bb
TLSH
T186418BF7C7D9866D891116F4BA186E1BCE1D0944936C3C16C8E4AF1F93E6871E24049F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 7711431adae417ac44cf44eac6a9d995592987b70e9bd6d2043a2a47b04bdc71
MD5 821f7aae95ea7cc5ff72eedfac225e8f
SHA1 01aae3745da88546f5ef910469e818c024af0d4f
SHA512 6f8b79ae30940fb079d60564d633886630eef8d095c187ce96a9024fc8af400eeaadd2ba1a7674b90c91d24ac39bf65d21557df7a734cad8a5409e953ccc9f2d
SSDEEP 192:sxZORYyM/jK1Ml8hfcB1e/fisFWpVLUqdhdpTZ8HW6+WNeZGN/YnH53tIgyhVX10:sxZO6Am1e/fisFWvLUaWHbt/agVi
TLSH
T1D772D9526A348977CCCBD609FD657F53D6F504229A515E889AFCCA0C01EAAFD2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 cc604eb14a125deaa9e97da96e9c874f5ade45c06f0b5353ddf703441063bd20
MD5 f132cad5a040cd8af02b3c1049739a58
SHA1 08a5f947e4e3a6a3ada26a8aa81fa49784b05ff5
SHA512 37acc150b45573bb7bc6a57a7340e18b4308b40731149c6ad0ba152399fba9adf652a7a70a253e86fa4559b7879a6370f3386c2753bb73844af36711ee93a661
SSDEEP 768:VEUZYmW7pLuL7gMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVM0CeLlPZ4R2roz:VEUZYm2E7gMWvg0Pou1jaV0CeLZmRNR1
TLSH
T195F2FA3B6C0CCB7E4F844E9DEC2A6E8A7DE801CB5A98895447FA844C03C66EF11175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 0eca418a9573bce74a40c98a178298c365f8ce61c60fda03220c863cd3c38b85
MD5 4a6b08af222648aaf3b18a0f74826dcc
SHA1 6c5de975b91e4d91cc14993530746102f19d3768
SHA512 15a86c916f1b42c14938b2e0c9214f848e69628a363d503df18f72a84dda4669d3e1f5b42259d944de5f8397a55f9e64330b81eab163bd29ccf093b81fa9001b
SSDEEP 96:KA1eK2AUqIKLSqKAIKheqWkKzC2W7KKU0T:ES3D2rZW
TLSH
T18DD1130232BB12033C3D6918A2AA97774F45F1E33454E82B7BA854B64E66E741CFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 218ccc7df7b8693933b54454f1c9516b99718795694f3962345d70dc2d5f4ff9
MD5 6ce7ca77a45a1b5ad2a3aa0039c8e65a
SHA1 c2f52c99921e9ab59494ac15d769b0eada166029
SHA512 e53ba77599f3c940cac85894f788a796513d88af93473159e9450a96355aebf4fea987ba626ea064aa8bdd87b10a9d4a024332220adb144c903fe0923780b83b
SSDEEP 192:yON061VWQmiUygwgGX5Obd+jKOImm/a03GFU6:yON06WSgGX5od+2OTJFU6
TLSH
T1A802D73569286C6BCEB2BE49F58737135FA8207BEA546F84D6E81B1C00D769C2307C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 6e11b56b84c1ad7e436e60071bf63c33a4cbce062ad63a7d36b32776d27f5431
MD5 b14ee35391c32a1ff117b2b5dc1ced05
SHA1 690467709bfa7381547d45214cfd7d1fe4de7760
SHA512 5a7219a7ebbd5b6ebb54aa70e0cbe4b20c8ce52231b22327941b143b7c416a4ca04c26a541cd1e3ff1a0e56081d1be3c6a711ec07c8f927439da7bd080dfd3e0
SSDEEP 384:nMtNn/s3n9SfsNCV1Qx9EzX5od+2OU9fYNrA2Ut5k1sTaTV41aAkmITGT0Igx9R:Mj+9UecOTOUpYGJrTaTV41ahmi+0RvR
TLSH
T109C27CB2D4652CEB4591E8C96607E6032EB410B7C1981A4CE2FC7B3C308FAF82352D66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 78f9efceb7615c1f31829a546613488db718083d3ebc9c1b2e9195f6a208826e
MD5 2d8ec0b0028faae1aa2c0ad56ecf970d
SHA1 cfd75a29b65f27a9640063684959243141387aeb
SHA512 61ec681e33aeb8862e0c37c9e960fb4f8c3c688b9e86e9f9fa78fbbd555a97ec926323a5847ffd4dc49e244d9ba6fb32039c2e409c584e3245bbf269bf9c24a0
SSDEEP 192:MONT611WQmiUyrwEGX5Obd+jKOImy9wjJGqnDU6:MONT6qLEGX5od+2OU9I/U6
TLSH
T19112F975A469AC675EE6B549F48732936EA820B7EE40AFC4D1D81B1C00D679C370BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

de7bad0d-622a-47e4-840f-33a21a6e51e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\de7bad0d-622a-47e4-840f-33a21a6e51e0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 72a09f31d4821897267b38a3fe7177c11957c9cc0ddabc610e992eb01ce5493b
MD5 db350d8378d5302679d8b08b83994807
SHA1 efcf01c7f6dfe9fe7e585adcc904138e4a1a41de
SHA512 973c9bc12d6980b2c5963673fcf7c0673763cdeb63121e86246ac5e29bed591ae86dd35eecea8945e26222eca4a73af4bed7d0662eea4461341191c7a3c9d62e
TLSH
T1DF41255CAAE91148B3B76E56ABF6A8AD447FBC372F0AD55D00010D4F0A72A40D8B1733
MD5 SHA1 SHA512 TLSH

Submit Download

15f20d86-0ccb-4555-b09d-facea977b076.tmp

Path C:\Users\Admin\AppData\Local\Temp\15f20d86-0ccb-4555-b09d-facea977b076.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa477f38-1d41-4141-970c-a19cd54bd345.tmp

Path C:\Users\Admin\AppData\Local\Temp\fa477f38-1d41-4141-970c-a19cd54bd345.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

43ac5a2c-e646-4dcb-af21-d48885965a98.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4092_1304833301\43ac5a2c-e646-4dcb-af21-d48885965a98.tmp
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4092_49445625\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download