hxxp://xeno[.]onl | Triage™

Resubmissions

21/06/2026, 12:22

260621-pjwl7sds6m10

21/06/2026, 12:19

260621-phackses2w10

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/06/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://xeno.onl
Sample260621-phackses2w

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
363	discord.com
364	discord.com
365	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2712	chrome.exe
3296	msedge.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134265179686476058"	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{256225CC-19E9-43B2-BEED-9FC9C4D6AABD}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{E2CB435F-AEC6-497C-BBF9-0B9873385F70}	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
6956	msedge.exe
6956	msedge.exe
6872	chrome.exe
6872	chrome.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 43 IoCs

pid	Process
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
4568	msedge.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	372	chrome.exe
Token: SeCreatePagefilePrivilege	372	chrome.exe
Token: SeShutdownPrivilege	372	chrome.exe
Token: SeCreatePagefilePrivilege	372	chrome.exe
Token: SeShutdownPrivilege	372	chrome.exe
Token: SeCreatePagefilePrivilege	372	chrome.exe
Token: SeShutdownPrivilege	372	chrome.exe
Token: SeCreatePagefilePrivilege	372	chrome.exe
Token: SeShutdownPrivilege	372	chrome.exe
Token: SeCreatePagefilePrivilege	372	chrome.exe
Token: SeShutdownPrivilege	372	chrome.exe
Token: SeCreatePagefilePrivilege	372	chrome.exe
Token: SeShutdownPrivilege	372	chrome.exe
Token: SeCreatePagefilePrivilege	372	chrome.exe
Token: SeShutdownPrivilege	372	chrome.exe
Token: SeCreatePagefilePrivilege	372	chrome.exe
Token: SeShutdownPrivilege	372	chrome.exe
Token: SeCreatePagefilePrivilege	372	chrome.exe
Token: SeShutdownPrivilege	372	chrome.exe
Token: SeCreatePagefilePrivilege	372	chrome.exe
Token: SeShutdownPrivilege	372	chrome.exe
Token: SeCreatePagefilePrivilege	372	chrome.exe
Token: SeShutdownPrivilege	372	chrome.exe
Token: SeCreatePagefilePrivilege	372	chrome.exe
Token: SeShutdownPrivilege	372	chrome.exe
Token: SeCreatePagefilePrivilege	372	chrome.exe
Token: SeShutdownPrivilege	372	chrome.exe
Token: SeCreatePagefilePrivilege	372	chrome.exe
Token: SeShutdownPrivilege	372	chrome.exe
Token: SeCreatePagefilePrivilege	372	chrome.exe
Token: SeShutdownPrivilege	372	chrome.exe
Token: SeCreatePagefilePrivilege	372	chrome.exe
Token: SeShutdownPrivilege	372	chrome.exe
Token: SeCreatePagefilePrivilege	372	chrome.exe
Token: SeShutdownPrivilege	372	chrome.exe
Token: SeCreatePagefilePrivilege	372	chrome.exe
Token: SeShutdownPrivilege	372	chrome.exe
Token: SeCreatePagefilePrivilege	372	chrome.exe
Token: SeShutdownPrivilege	372	chrome.exe
Token: SeCreatePagefilePrivilege	372	chrome.exe
Token: SeShutdownPrivilege	372	chrome.exe
Token: SeCreatePagefilePrivilege	372	chrome.exe
Token: SeShutdownPrivilege	372	chrome.exe
Token: SeCreatePagefilePrivilege	372	chrome.exe
Token: SeShutdownPrivilege	372	chrome.exe
Token: SeCreatePagefilePrivilege	372	chrome.exe
Token: SeShutdownPrivilege	372	chrome.exe
Token: SeCreatePagefilePrivilege	372	chrome.exe
Token: SeShutdownPrivilege	372	chrome.exe
Token: SeCreatePagefilePrivilege	372	chrome.exe
Token: SeShutdownPrivilege	372	chrome.exe
Token: SeCreatePagefilePrivilege	372	chrome.exe
Token: SeShutdownPrivilege	372	chrome.exe
Token: SeCreatePagefilePrivilege	372	chrome.exe
Token: SeShutdownPrivilege	372	chrome.exe
Token: SeCreatePagefilePrivilege	372	chrome.exe
Token: SeShutdownPrivilege	372	chrome.exe
Token: SeCreatePagefilePrivilege	372	chrome.exe
Token: SeShutdownPrivilege	372	chrome.exe
Token: SeCreatePagefilePrivilege	372	chrome.exe
Token: SeShutdownPrivilege	372	chrome.exe
Token: SeCreatePagefilePrivilege	372	chrome.exe
Token: SeShutdownPrivilege	372	chrome.exe
Token: SeCreatePagefilePrivilege	372	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe
372	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 2476	4568	msedge.exe	86
PID 4568 wrote to memory of 3296	4568	msedge.exe	87
PID 4568 wrote to memory of 3732	4568	msedge.exe	88
PID 4568 wrote to memory of 3732	4568	msedge.exe	88
PID 4568 wrote to memory of 3732	4568	msedge.exe	88
PID 4568 wrote to memory of 4968	4568	msedge.exe	89
PID 4568 wrote to memory of 4968	4568	msedge.exe	89
PID 4568 wrote to memory of 692	4568	msedge.exe	91
PID 4568 wrote to memory of 692	4568	msedge.exe	91
PID 4568 wrote to memory of 692	4568	msedge.exe	91
PID 4568 wrote to memory of 1172	4568	msedge.exe	92
PID 4568 wrote to memory of 1172	4568	msedge.exe	92
PID 4568 wrote to memory of 1172	4568	msedge.exe	92
PID 4568 wrote to memory of 4772	4568	msedge.exe	93
PID 4568 wrote to memory of 3152	4568	msedge.exe	94
PID 4568 wrote to memory of 4772	4568	msedge.exe	93
PID 4568 wrote to memory of 4772	4568	msedge.exe	93
PID 4568 wrote to memory of 3152	4568	msedge.exe	94
PID 4568 wrote to memory of 3152	4568	msedge.exe	94
PID 4568 wrote to memory of 1360	4568	msedge.exe	97
PID 4568 wrote to memory of 1360	4568	msedge.exe	97
PID 4568 wrote to memory of 1360	4568	msedge.exe	97
PID 4568 wrote to memory of 3404	4568	msedge.exe	99
PID 4568 wrote to memory of 3404	4568	msedge.exe	99
PID 4568 wrote to memory of 3404	4568	msedge.exe	99
PID 4568 wrote to memory of 2756	4568	msedge.exe	100
PID 4568 wrote to memory of 2756	4568	msedge.exe	100
PID 4568 wrote to memory of 2756	4568	msedge.exe	100
PID 4568 wrote to memory of 4184	4568	msedge.exe	103
PID 4568 wrote to memory of 4184	4568	msedge.exe	103
PID 4568 wrote to memory of 1812	4568	msedge.exe	104
PID 4568 wrote to memory of 1812	4568	msedge.exe	104
PID 4568 wrote to memory of 1752	4568	msedge.exe	106
PID 4568 wrote to memory of 4652	4568	msedge.exe	107
PID 4568 wrote to memory of 4652	4568	msedge.exe	107
PID 4568 wrote to memory of 4652	4568	msedge.exe	107
PID 4568 wrote to memory of 5476	4568	msedge.exe	108
PID 4568 wrote to memory of 5476	4568	msedge.exe	108
PID 4568 wrote to memory of 5960	4568	msedge.exe	115
PID 4568 wrote to memory of 5960	4568	msedge.exe	115
PID 4568 wrote to memory of 5960	4568	msedge.exe	115
PID 4568 wrote to memory of 6068	4568	msedge.exe	117
PID 4568 wrote to memory of 6068	4568	msedge.exe	117
PID 4568 wrote to memory of 6068	4568	msedge.exe	117
PID 372 wrote to memory of 1064	372	chrome.exe	121
PID 372 wrote to memory of 3352	372	chrome.exe	122
PID 372 wrote to memory of 2712	372	chrome.exe	123
PID 372 wrote to memory of 3352	372	chrome.exe	122
PID 372 wrote to memory of 824	372	chrome.exe	124
PID 372 wrote to memory of 824	372	chrome.exe	124
PID 372 wrote to memory of 5156	372	chrome.exe	125
PID 372 wrote to memory of 5164	372	chrome.exe	126
PID 372 wrote to memory of 5156	372	chrome.exe	125
PID 372 wrote to memory of 5164	372	chrome.exe	126
PID 372 wrote to memory of 5440	372	chrome.exe	127
PID 372 wrote to memory of 5440	372	chrome.exe	127
PID 372 wrote to memory of 5616	372	chrome.exe	130
PID 372 wrote to memory of 5616	372	chrome.exe	130
PID 372 wrote to memory of 5612	372	chrome.exe	132
PID 372 wrote to memory of 5612	372	chrome.exe	132
PID 372 wrote to memory of 5564	372	chrome.exe	133
PID 372 wrote to memory of 5564	372	chrome.exe	133
PID 372 wrote to memory of 5940	372	chrome.exe	134
PID 4568 wrote to memory of 5660	4568	msedge.exe	137

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://xeno.onl
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffd232cc188,0x7ffd232cc194,0x7ffd232cc1a0
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,971623727954722885,11779552308760481392,524288 --field-trial-handle=2200,i,16177833630425516698,5058069444305567484,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,4145067873972060460,9377729322499032301,262144 --field-trial-handle=2200,i,16177833630425516698,5058069444305567484,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,17367183645703847506,16142913820610742811,524288 --field-trial-handle=2200,i,16177833630425516698,5058069444305567484,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,4606118265710772532,17743141868610504232,2097152 --field-trial-handle=2200,i,16177833630425516698,5058069444305567484,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,1061071557987380255,10781135279329021148,2097152 --field-trial-handle=2200,i,16177833630425516698,5058069444305567484,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,6166650415373586334,16977788432390870666,2097152 --field-trial-handle=2200,i,16177833630425516698,5058069444305567484,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,15288220442531324033,5763883432767733073,2097152 --field-trial-handle=2200,i,16177833630425516698,5058069444305567484,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:2
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=1676,i,14807007747030552678,10103545567437451284,2097152 --field-trial-handle=2200,i,16177833630425516698,5058069444305567484,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3440,i,12487247476357065036,16371311047101996155,2097152 --field-trial-handle=2200,i,16177833630425516698,5058069444305567484,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5180,i,15786345907581070884,15930455457849055524,2097152 --field-trial-handle=2200,i,16177833630425516698,5058069444305567484,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,10584784971767438023,16743023451358950702,524288 --field-trial-handle=2200,i,16177833630425516698,5058069444305567484,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,15995002594821238046,13379721949174265338,524288 --field-trial-handle=2200,i,16177833630425516698,5058069444305567484,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:8
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,15351043059833917995,15304295593707407649,524288 --field-trial-handle=2200,i,16177833630425516698,5058069444305567484,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,15351043059833917995,15304295593707407649,524288 --field-trial-handle=2200,i,16177833630425516698,5058069444305567484,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6688,i,1244056851840899326,2999437099264119111,2097152 --field-trial-handle=2200,i,16177833630425516698,5058069444305567484,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7048,i,15763794960437106591,15908436480133546802,524288 --field-trial-handle=2200,i,16177833630425516698,5058069444305567484,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:8
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=2556,i,6488283541827603712,10105647746233871732,2097152 --field-trial-handle=2200,i,16177833630425516698,5058069444305567484,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:1
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4512,i,7588337784512276740,14319035744030149487,2097152 --field-trial-handle=2200,i,16177833630425516698,5058069444305567484,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:1
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7020,i,13979790518135945177,12549694168597693430,524288 --field-trial-handle=2200,i,16177833630425516698,5058069444305567484,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:8
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,17967488566671475498,9083147055770571567,524288 --field-trial-handle=2200,i,16177833630425516698,5058069444305567484,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:8
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,17689369419424139991,15478336202675599445,524288 --field-trial-handle=2200,i,16177833630425516698,5058069444305567484,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,4088508197519691774,12255312638242287371,524288 --field-trial-handle=2200,i,16177833630425516698,5058069444305567484,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6484,i,5476071669958363853,9568978836166069793,262144 --field-trial-handle=2200,i,16177833630425516698,5058069444305567484,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6956

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd2366c728,0x7ffd2366c734,0x7ffd2366c740
  2⤵
  PID:1064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1792,i,17914824160440595847,1841207797344923292,262144 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:3352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,10038470005473083576,211542235452281275,524288 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,15856984766743173588,3542701364569658847,524288 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,12979615925540337373,3955325344154119384,2097152 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,4546914584300679333,533923918331562381,2097152 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:5164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4480,i,15388456413868492554,14253694484948575030,2097152 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4460 /prefetch:2
  2⤵
  PID:5440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3840,i,6581607232440460108,2118780764883243662,2097152 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:5616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4932,i,4666273778607475537,12346299836094735322,524288 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4916 /prefetch:8
  2⤵
  PID:5612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5068,i,8745882957406919626,6578514560452908467,524288 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:5564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5560,i,13815778087573640427,5758114801488487891,524288 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:5940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5804,i,14493401042098988364,8323030218018123625,2097152 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:5716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4668,i,16932120336357265980,2190130108284287477,2097152 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3352,i,12051473446735817950,2683297603168329940,2097152 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:5400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4652,i,17243807175770130276,18401917050102039828,2097152 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:6080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6172,i,14427945643430903254,4292187511185813652,2097152 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:5648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6336,i,206048435385646956,15415636524605939881,524288 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:5692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6400,i,17807023022409068465,16039163543777347644,2097152 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6548,i,13222214114126667739,8008983122098072742,524288 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6396 /prefetch:8
  2⤵
  PID:396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=240,i,4817219207988629726,6733899207728174638,524288 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  PID:5792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6544,i,6276048549402652459,3671766656753148562,524288 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  PID:2244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6320,i,1723714953571822912,14100181291322900761,524288 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6656 /prefetch:8
  2⤵
  PID:3128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4584,i,11376446890804615393,17273599769575265371,2097152 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6568 /prefetch:1
  2⤵
  PID:396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6536,i,9906235170948155504,1035967462966141243,2097152 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6420,i,12412561413372798215,17769232575201104356,2097152 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6676,i,11897428228298305599,7702991712916219422,2097152 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6752 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6628,i,15311297923940183741,15895470829617028322,2097152 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6484 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6148,i,1597666003014232607,6528053576922095526,2097152 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6120,i,17341182158063546272,16811846064253355991,524288 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6504 /prefetch:8
  2⤵
  PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6176,i,3052769590117432838,3545734726002004372,524288 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=240 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6912,i,868192252936365288,18231624475941687894,2097152 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:6412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6964,i,5947425280352484638,1103577973792214185,2097152 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6544 /prefetch:1
  2⤵
  PID:6676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7104,i,5639358183623078596,12479413254365888125,524288 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7072 /prefetch:8
  2⤵
  PID:6716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=7272,i,2356495611643050313,11885771433251934979,2097152 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:6724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7428,i,5723764486904334280,12122626959268186310,524288 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7444 /prefetch:8
  2⤵
  PID:6804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=7216,i,4212945460910180061,2582822337074763933,2097152 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7164 /prefetch:1
  2⤵
  PID:7016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=7288,i,16448093684455900017,10658813839964919157,2097152 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7528 /prefetch:1
  2⤵
  PID:7072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=4720,i,7800085621228272134,10762172182087848760,2097152 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:6348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=7124,i,12343135840202471928,16130491159355807786,2097152 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7332 /prefetch:1
  2⤵
  PID:6536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=7244,i,1636408699729107571,13786374982772867994,2097152 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6904 /prefetch:1
  2⤵
  PID:6604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=3308,i,4200625760046298799,11552491453703521555,2097152 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7600 /prefetch:1
  2⤵
  PID:6708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=7788,i,8944836484103502099,1632196850202529711,2097152 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7784 /prefetch:1
  2⤵
  PID:6804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=7604,i,4734151787948630757,12676941665869137067,2097152 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7908 /prefetch:1
  2⤵
  PID:7004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=8032,i,11169828516506537795,12791324513715211004,2097152 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8072 /prefetch:1
  2⤵
  PID:7012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=7564,i,4571529537884685501,17984356643308464422,2097152 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7864 /prefetch:1
  2⤵
  PID:6460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3524,i,7718542745498838949,15399268728266015795,262144 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8108 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=7752,i,15236287344692562876,4332060179153870176,2097152 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8088 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=7952,i,17050621645933856001,12567977133601191953,2097152 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7816 /prefetch:1
  2⤵
  PID:6604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=6936,i,12498904948250532942,12766783476791302012,2097152 --field-trial-handle=2036,i,15909521376588061898,12342392818879966436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8008 /prefetch:1
  2⤵
  PID:1280

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b3e2e341ca6e2df71ad90a2eef743e93e31233f4891f4660d393bba44a972e48
MD5 d21ab38cf24cbe9359d391aaa48a3b4d
SHA1 2af196e09981437b801410be2249a7b89b1b55c9
SHA512 b46cd76d9b773d0aaa63d45781e4ec7769a7f0c246ffdf7a4a5c72f3be1e52e4dfde94096fc5785212a2f5ff6d8d2dadcd34c42c65de0fdcd0832f4ea6896c4a
TLSH
T130E02B65C861DC6B28FD0719B0141781DB55136B2A80994F7A3D810D8FB5A764986D1C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 68KB
SHA256 6dab77d2ec69288c4f4741b0c3027b813a2036250c07fcae68cde0418ba95f0b
MD5 512e2113d1eff6310b55271c63dd0432
SHA1 af48469adf72d32ae5a2dad3bc36b957fc1d28b5
SHA512 a07fc56c343ea79d6f481d2020d7b705827e2f70d5cc4d84620e26dab6c27f2825b674b987f7e255e30bff6c8d4a704a9e3ab34e852b0eafcd7028fdf559fb72
SSDEEP 1536:lDPR7dSxFOXUpA5bgLz+XmcOZkET3VWRgd6T8hEPZ9uJ5cNN02Or:b7jXUpvmXwZP3VWRZQhEPZ9q5T
TLSH
T12763016498DB1B6C40B71F13482662FBECA706DC48FCBC896677E493AC46527B2BDC50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 21KB
SHA256 dbdf3b6aad04b0df219665567bcb861a374446b3a856214fc61a0cda2c124105
MD5 731012545a876e6638735cce383d2001
SHA1 dae425ed4acf3e622791e05d79731e0c0c734700
SHA512 97cb5c16519f5af0d2aa8f4202ec4fa55421db5f0a29301a65571fd91cde173f5e30277140856e3574bfe49eee5494cbc7ecff27ecae5d5446d8aff30820b3cd
SSDEEP 384:NNCDGoDQXaDAxLM6kTKWKKpiqym1eUWUozrXOcSWt09i5XDHK:NMDGpXdxg/mcIqyae4E6cSts5XjK
TLSH
T17AA2D0FD01672D3006570400B8D061CCE5EAE5EB1BAE2B6BD8BCBE165B87287851D3B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000013

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013
Size 23KB
SHA256 4d374f815118157d4ec62c285937df74fec28c75d9eec110f48d3e04cb321ba8
MD5 ce7b262351203b245322fe75044fb61e
SHA1 46fc201fa3a9a56cb91f3a08f4a380f6d2283e0a
SHA512 0af2f8fa0171107ca26b73d1eeed9599c0b67953e163441bf65dc3a5bae5c9aa82bdcc54255996e8d1d472db1b09ba3286859d595619f1706a8e61c464081dff
SSDEEP 384:zApz2RXdsOYVa2CE00K/4dJfoLdmiJo0zADElg9jIKauH6CwJ6k5zRv2LbFq:oamOTZE0hAdJfoxmiJ9zdC9SpCwJoFq
TLSH
T130B2E1833404A6947BFF27130CF66A08E6B2B67BF63273054465483E42B52FA5B5977C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 ae1cf3dccbd976c190cff2c4d678be1e629c460f42e99c1b0b682d9c85c95d59
MD5 d8ddeb05ecb73839feb040372565e995
SHA1 5577e01e911f4081f822ee860d20fbbed6ad2cb8
SHA512 ee90f1c0418f99f47676553864a1e10585b5873ccca3d54988bc70d940f5e56595b7ac7d9e5d3444915b7da7cd787424aaf94f64fa40c920bfd05d96b2c7a51c
SSDEEP 192:Dt6vFoWDFvaIHykWzuCf/sCYiij8/3wjhndR42U+xJ:Dt6vFoWDFvaIHykWzuCf/sCYiij8/3wj
TLSH
T16CE1ADF7C3E4866DD91156F4EA102E1BDE6D0A15832C3D56C9E4AF0FA3F28B1E25064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 a3580ed0ff96d21100048bca0b889848c838cf856bc8b693fe316b8ca82cfc9b
MD5 8b3b4a24f8389c0a8a701b3d4e4009ae
SHA1 b33fa820309dc3886b2bb9c78e878a899216d29e
SHA512 61a027ac178f0b7f96490a761b77f79280f826ee584e4cb1074c9b692cad05653f409c21b5adf69df9fc42471e13c4cf207721752705d27979a68c4e334cddd3
SSDEEP 192:BREjGmvXFTv70TwPRpmd4tXm9+Hsb+WNpUyP1/YGE654Kw29rAkwMaQox0VyIsnB:BREjprgWX+8wTlni2+saQoqe
TLSH
T1C362D62BA9606E7B9CDAC229FD15B722E7F5102269D01E48E7FC8B2C05D7ACD3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 67b54ce7cb3868ade2b18e09defd482c68cf3b8fbba97e630f2679e8eae1e070
MD5 0060f3469f8cb095e033cd25893d0bc7
SHA1 62d9f2a7bc61e9a4f1750a483419adbb494d01bc
SHA512 7529a0f608b690b155d9404c1b83ec1087302f833de00057637d7af5c560992a64aa1419cf0831417a641a8759452b6dd793d3f68dd78980593653d75dd6dcdf
SSDEEP 192:BREjlmvXFQv70wAPRp2d4mm9+Hsb+WNgyP1/Pt4Kw2mrAkwMaQoxeVyIsnAUgraJ:BREjqMgBXj8wVNi2bsaQoge
TLSH
T12852C52AAA506E7BACDAC229FE257713E7F6102235D42E44E6FC8B2C05D79CC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 c53bb972b28315ac53257d4295adfcfcb2391edfd693a15b7c66595160de5b1b
MD5 f8af6af51c4e07d0aa547d462c3f3eed
SHA1 eee1447d3bf88223b66b75a1328fb08c71a4883f
SHA512 328e859dfcc1604fb553e1cb05c267d5132390173903eac5ab9cc927abb31b0095b69418613f165377f054112d79fe05b662dc679c37daf531425131c0bfe0d8
SSDEEP 192:CREjGmvXFdv7rTwPRpmdoztXm9+Hsb+WNpUydiyYGE074Kw2qrAkwMaQox0VyIsB:CREjpd/WXM8wOMPi2PsaQoqe
TLSH
T13662C62BA9606E7B9CDAD229FD15B712E7F5102269D01E48E7FC8B2C05D7ACC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 9bcad437c76395afb495d3fecc96f70b82b9e4a9c456cba508f9264057d78a9b
MD5 de3d3d21f156598888a0da009f0df4a7
SHA1 bf9857034ecdd965b0111f5593a0dbf60c56209b
SHA512 35072e364a3511628f74295df9e93c4e37d402e5468f26f0157920c96886835398c19ae36a744eae7af050849239316333af9832c7ecffb52465f876788498e4
SSDEEP 192:BREjGmvXFdv70TwPRpmdoztXm9+Hsb+WNpUyP1/YGE074Kw2brAkwMaQox0VyIsB:BREjpdgWXM8wTlPi2QsaQoqe
TLSH
T13A62D62BA9606E7B9CDAC229F915B726E7F5102239D01E48E7FC8B2C05D7ACC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 6c81cb8fd3ef2f3bf1185565ebceff26a4f56172d84fddd433fd25ea8dbffc08
MD5 b6c64351b0773c0098c0de420a396b5f
SHA1 b4c3b4f12a89aa10da06c91053ffd0e895db2a02
SHA512 76925c173745ef9542e8da9125c16b6298d25c54244882607c74d6430e40d549863e2e82e5d815f86a74708cd073012141bc0f9944ec555e45edb675457aec77
SSDEEP 192:CREjGmvXIdv7rTwPRpmdjjXFyPHZtXm9+Hsb+WN4DXEkWydiL2gvMYGE074Kw2nc:CREj0d/WXS8wRLBmPi2MsaQoqe
TLSH
T15072C66BA9601E7B9DEAD229F914B716D7F1102269C01E48ABFCCF2C05D7ACD3217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 a9bb798bb4511405c2729f6408e69cc5dc82268a3cee4ca669f06a37314e7235
MD5 166f58acf4b9a416816669c402e0d9f4
SHA1 d96fb6b6fee25bc58b86e67cc3cac8afced2accf
SHA512 1cef045035f295b635ae318299757de34abb0fa8e8cfa5f16a3b27f745d7115fc0d496587c91f2405e0af7a1b2c9b254c2ee421e5a01af710f7acc380d66c3e4
SSDEEP 192:BREjGmvXFTv70wwPRpmd4tXm9+Hsb+WNgyP1/YGwKw2PrAkwMaQox0VyIsnAUgrK:BREjprg5X+8wVl62UsaQoqe
TLSH
T1E152D72AA9606D7BACDAC229FD557713D7F5102239941E48E7FC8B2C05D7ACC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 54534b9bf52c6950d84988a56653aa0b23b0ce9e3363e732449508eb5b604e2d
MD5 21ce7525f792bc6ab5dabb0e647b2385
SHA1 f6a610fe764efea4cc9eb4961e6502c6055c2258
SHA512 b500a770f1257df84fb175df489f02d2129d36a8e9753f0b05d6e6272368a6109fefb98723b4a4e039abb1adbcb362871f45b714a22f7d639d3f008da749c97a
SSDEEP 192:aREjlmvX8Qv70pAPRp2dj9+Hsb+WNnq40XrAkwMaQoxmVyIsnAUgtaJ:aREjnMgUX68wl0csaQoA8
TLSH
T14142C62EAA106D3BACCED229FE657753D7F5102235952E84E6FC8A2C05D75CC322741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Search Logos\logo
Size 29KB
SHA256 0642e1d4e94e15712784f3f23879e7c94a75fe62ad09e74c42bc246026b904b8
MD5 5b18436b83e6ed0d76cf5fc5b2dcc82b
SHA1 2745338548f9ced68117ab6e4eac4105220a1342
SHA512 aabcdd45c908f24550195805d342e7b6f880a35b4283e912bbd52c14129266fe683ca30bfbda3dc6d6a7be7b8a5d8c56c26ef1c7370bf57d7b33b6cab1a7c36a
SSDEEP 768:UJn5vAWNo5sdO3rFmOx1QkzkZ6V1A0Glgexs4tvEzYy:SoWW5sdO3XVz3TGvvzy
TLSH
T199D2F20E45F38974E0BA967680E50E1DBC096C80DD59B2136B76BF53B57F0A52C80F8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 b656bb32b6f0b39134feb919041630dc07fef999fe59d1d273312cb701cdd687
MD5 f9b1a9c73f6e5ea86399369fcbe9aff3
SHA1 2c9f2c7ccb3f9d28bec51ff73cd4de9b6b98a2e5
SHA512 d74933bd7762e68cda1de2ef511bdb6950a36b9db894c921e0d56ee883c7197342eb31fa3bd8611d39cd682dca0d87f2221d38db5db2d9627f2f67544b441bad
TLSH
T177B0129180019142C04207F4264A54C87318EF20A70A170543E4AD2A8D261508014090
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 b577034dc6b07770679709970fb151e8b29e10d20b76aefe8378edf2457b0826
MD5 f10dfc2f637b61a991496e760c3c37c3
SHA1 5615c14bccb18e38bb7de51149ef18aebc9a93fd
SHA512 35818233611244193547d1e723e5344f9319a0ca8ee8b261f7d26743a210eebcc4ff7448cbc24f7eb10f7efce0f8dcb28ec8ac275c2f449705f8c207ff689159
TLSH
T1C6C0128AD407E511C19A03F42543D8E8B13ADF30D60B234D83F41E22A83D3328026191
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590b51.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe590b51.TMP
Size 96B
SHA256 054d838d4f5eaed594eca64235c901890446ed401c3ac3bd5e83b3f8f0ceff5d
MD5 a415ae5f58e263ad4bd3cddec92451d7
SHA1 2ca352a5f9ea2c1b708db8444cf9ec05c09e662d
SHA512 8f616b92d2a220294d6bffc9ac4a3ec29d684fda8af268eeaac74764b8024d5d6d69211a5f968853ceac5f7bbdf879fd406cfe7b4dcfadb2c1bb742d15443d0f
TLSH
T12CB02223C2032302C08203F0288888C8B020CF2CC2030202C2F02E3ACC20220002A8B0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\cc6b161e-267c-4f54-8702-ecef78c6252e\index-dir\the-real-index
Size 72B
SHA256 d6c8cf42307e2c4ab2f58aa51d8c8b44ef1f389ccbab58b9ebd71be757da2b79
MD5 fe7c925f4b8156277613391309a968f4
SHA1 8507fefa3b6543c0fac119c84894b8c90c62dfec
SHA512 3e6fb43c8c6f389ca0438f52512047775cdf72582fa05c7733f9bd34c96c0077eb0a0e39e12ff7a75f1b1b14444e67996b5f80baa9585a819db3dea74ade2b6a
TLSH
T11EA0023243C61045D811127864C61BED3330CC9155010B0386A021CD8C942C4A956555
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a61d8.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\cc6b161e-267c-4f54-8702-ecef78c6252e\index-dir\the-real-index~RFe5a61d8.TMP
Size 48B
SHA256 60699091db5ccccc9edf34cd59bad83aee3e9d700520bd77a64988fa3cb79088
MD5 12812c802c07f700cce55779746aec3d
SHA1 1590068fa0aa1e3a009dd715c9abaea0a9a2baed
SHA512 68e4d878eb2a31dc2e83b9353ed1fd589e78fb20286a4eaf4c490a19f047c54381d86b7d040ce21731449edadcd37b8529354b63c0db59fdc84afbe8e5352709
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\index.txt
Size 95B
SHA256 4a7dcace54845160730fd2317ffcb42c67cfbe3e5b7f232879317d4f11a236fc
MD5 ad6cce1beda08c0214b2c4e6ba75b933
SHA1 e40baa8959d396c7a58124deb10e33c34a71ac8f
SHA512 91071d7664f9e8cb61ad0a11d250a1f56ab9f752137d2c97587f816907bd657713ced327fa058644bb11ec97a4f1eca79c7357e50bb352863f2313ef9247cd0a
TLSH
T18EB002BB454599951E6138E6414532DDC56262D85C85FE9994651055322096E5011924
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a13c8.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\index.txt~RFe5a13c8.TMP
Size 182B
SHA256 1411acfaf4701279072016a2ff68112ae6861367a5e9679cc5b8a257efbc1b9a
MD5 6318fbd2816c8d812f8162421e8f36be
SHA1 c0105c83af83b5d39a6d24ccce94aa33fb0ee561
SHA512 e5773c2c8281371c910c94f72ecef5b0705194bb63e8e2f0b4ba83e4f6404fd5e1f3ba4a69634a29539b093d259c525a1806178e6e66d41c589092266cc3085a
TLSH
T120C01277A460E6922A6164E6515933C9C6363FC80DC5F95D442130152135D6E4011A20
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 f8488c72791d98e4591d538c2e942123d5511c991fc61bb2e202b3d740425fd7
MD5 ca1d4136bda8e92cfbb7c9198effcfaa
SHA1 f3859f287663ed95a294c28c422d9d230c093644
SHA512 2c05b77d8ccb3d075e6d18be6ed52768be6cdefe443ff2af5cb262246c5bfa5bc17dc9fc46401d2b531dbb112edf2a4d396de290efe41f0ca16556bd7c85f898
SSDEEP 1536:bNLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:Xqfd7NtZL8cHQRZEQ6Sps3
TLSH
T1CDC30237ABC21F379E92CF64B9130FD657B644A99030D301AAAD37FB7C93591684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 c96c93cf1f37e846448fac00fd6428597bd1409412bf7bb351038a0dd71920c8
MD5 fc3ad8902b439fd75710910784a33233
SHA1 7fe8b4c7d1dbe9949db125f41a992042531424b4
SHA512 8abcf3a13e30cdc1c701d762dddc853b2d22ba318cd0c364d005f8c65f642cb3a142ab9ab074b40b30a3371e705c1b319dc116e6688d8cacc3e3d37d7983697f
SSDEEP 6144:TuwU4CMCLBorjzmX7z0J8/NgBM5z6CaqZ/ZLW3Exa:TuwZCM5fmggm+5ziqZ/piQa
TLSH
T162341373BFAA2C379F57EB24B1031B5D43B848D498B49107E82E79B721A3A50E003D79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 3c3d67828d0d8baa8d67570f24cf494a438bd003c323d37265558a355e0386f7
MD5 8efbdaa9b9b8506dc300e0565b8c5008
SHA1 a03bf2341f83ba91d7e131c86e6b6a4ae2a53ac4
SHA512 52bae3d296c0e66ffb8b476a2ddd42f52bb4676ea6cf93c2c2de31f23ced585d18edf529c16bd90296b83d23a30486851fbc2c6bd9f12d8cf3df7ba9eb6f3fdf
SSDEEP 6144:F6uwU4CMCLBorjzmX7z0J8/NgBM5z6CaqZ/ZLW3Exa:IuwZCM5fmggm+5ziqZ/piQa
TLSH
T159341373BFA62C779F57EF10B1031B5D43B848DA8874920AEC2D7A632153650E403EB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 6224cef42f49ce55b812bc6fcd1c5f7759c72925a33f88d69ea255be834a6c7e
MD5 1ddaafbc419453fc9bfe5d4c62d028a0
SHA1 8f6e4204b441791fa947a2b30471a12747386f64
SHA512 5564eac15c6332ff3e0e1da6da019f7ef6f3d8045c4b6c532d2ef0ea1b4235a013a17d38820f433312e17a6c91b2472b421fdfd3baa86db507c71998ef04faf3
SSDEEP 6144:AsuwU4CMCLBorjzmX7z0J8/NgBM5z6CaqZ/ZLW3Exa:JuwZCM5fmggm+5ziqZ/piQa
TLSH
T1CE341373BFA62C779F57EF14B1031B5D43B848DA8874920AEC2D7A672193650E403EB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 7346f4269be7c5c702e9dbb160c003cb63d06b74deeb945598c3055ad4ed7303
MD5 057dbf644359d75e367145ae8f5b6590
SHA1 771df0bc1617b8275831abb088afde3ebbc88c3b
SHA512 9d3020b6f030158375de1e52459646729363ae3b52d475da08b0710ecdb85ee69b08b21d20d8dfafca0256305b8ef9b8deb55500a6e76768902af0bfe8968b96
SSDEEP 6144:uuwU4CMCLBorjzmX7z0J8/NgBM5z6CaqZ/ZLW3Exa:uuwZCM5fmggm+5ziqZ/piQa
TLSH
T13E341373BF6A2C379F57EB24B1031B5D43B848D598B49107E92E79B721A3A50E003E79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 8f80b477caf8db15cb4d8119c64726e49b84b6dd28b9f69fa396854d41a8062c
MD5 0673ec554cbc93d7a232346520f11400
SHA1 7320f45b9b053811e4cde294741abb702c853530
SHA512 483b7c863307f54de460850550ba9f96aff040f522cc0511fd6e4be902e61191ba10e9252528a433d9a1603ec1d2dd088cae353a35ecd52135de68c1fb4cecd7
SSDEEP 6144:k6uwU4CMCLBorjzmX7z0J8/NgBM5z6CaqZ/ZLW3Exa:ZuwZCM5fmggm+5ziqZ/piQa
TLSH
T1AA341373BFA62C779F57EF10B1031B5D43B848DA8874920AEC2D7A632193650E403EB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 88874d9e95b5dc85414e77b4c7d12251c9225ca4e0dce86e996887fff265a3c7
MD5 dc37f564088900d7a6bc12a930a47eb6
SHA1 aa0e9ea6bb1b9c07f19c4db98823810c9dd0727a
SHA512 bae209cfc9a0cb2be33945de8f6e0e73083ea76dda7d4ef3d68d2164a2547ad4abde3c7815e8afb0dd783faf9dfc33a87ab7d1052fe6a7b2b9ab0bea46b309c4
SSDEEP 6144:muwU4CMCLBorjzmX7z0J8/NgBM5z6CaqZ/ZLW3Exa:muwZCM5fmggm+5ziqZ/piQa
TLSH
T1A1341373BF6A2C379F57EB24B1031B5D43B848D598B49107E92E79B721A3A50E003E79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 e81b6688ca7d53396421c45071da9245247c13cb476077f74fb5f3bfb146e283
MD5 a8297839f37d32c99858636df81deb8d
SHA1 58d6ab8cb818806f6d8475edf0f1aeb19c73720b
SHA512 03c3b8efc1217f1bdd0de5f24acf585683b4f87b91b88419fc42f651aa293b06a506fa6d0e8b457a014ec729730d5a7d05f0d41029ba18a3851a28023e68aeed
SSDEEP 6144:U6uwU4CMCLBorjzmX7z0J8/NgBM5z6CaqZ/ZLW3Exa:JuwZCM5fmggm+5ziqZ/piQa
TLSH
T127341373BFA62C779F57EF14B1031B5D43B848DA8874920AEC2D7A672153650E403EB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000fe

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000fe
Size 127KB
SHA256 e5f1dabe89a7a1d0ae94bd8e14a273cb5144a6541c34a54192411677c18c43a2
MD5 f944721bd55cbb39c452593638459aa1
SHA1 085940738cf5737b614a586d0f2005ff0445d6e5
SHA512 33c8c2882fc81062027733dc7f1d52f2194957cf94b34c6d71e393ed90f37a378a5c7122cbfe4dc35f7e63c26f7c4440886e9b3884663aea2a8183087611b3af
SSDEEP 24:5bglATIKl7DCmTpHTyxpEo1HM9kvfkzyfkmoyfkoRfkIRfkwhNfkm7usyfk6sRfn:qlg116z1+ukYkwkAkgkw9kugkxkY
TLSH
T107D3356D2F958FEAF0F12770E684BF4CB3D96E6251EFC35E1BCC1906BAA00D01048A85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000100

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000100
Size 100KB
SHA256 27bce9e85eaf3567a4695ba2b612e32615394d80d0a3a2dcb07b1fbfdfababc7
MD5 f134fda98a277b1c8f20ab8fbe2fbd58
SHA1 a922796190a1f5bbb3c410c6ec591502050df04e
SHA512 2b2e8338afb9b0ca9b5fa3d452dfd80368b5d17566120ae6351b6d03572e5a69cedb97f165fbc31ffb3addcc00506a3fc0761cf2404a5d9826a8448a7c4d9f17
SSDEEP 3072:fd/tI0TeVA5o0VgTuGmxrMRZ6aLxuC+Gtn5HBZ4I/:f81VAMuGMrMX6Mxu9+fCo
TLSH
T108A312846579CDBE5EDC1D06AB21ED4CA2BE53F66B5E367483100E054FF4FB49AB0288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 293716eb984dcd9b7b76b14ce0511bd78d601204c982d5deec1e0bd7be1427b6
MD5 d49f87c390ce6036d8844e4fc5d52c55
SHA1 a4c6c7978435989f43de7599e858c93159dcc4ab
SHA512 91641405690ef0f0aec13f1a4a85c070a263a6ed0664e7655bc395f0419aedd74855550bde137294c7372ec8ffcd99d40f77287b50d090e362dd6ab8d5270d57
SSDEEP 96:ktFYimbDqRJQpzrg66z03QhkHW718vUPaxVVsYxOTy0xleUsbCWEmj3tKXAyivVq:kcvq3Qxg66EsOtbCKXTMK0
TLSH
T134D1FDB3849AA456CF8449F3DFFA2C663FB34C590B025B3A4990943E582F2953E5D4C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58fbef.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58fbef.TMP
Size 3KB
SHA256 aea2116f1bcb9e59a8958d8773e9e04af20b68894d07149c9eb43905b4c18295
MD5 8a6ec12f1bea4f0e5fb5013a6d462271
SHA1 d19b7dc780d90ec3ed407fc4a05565cd8e9bad24
SHA512 d43d84be6c3f941ccc13b1961b509bec5d597443eaffe8f52ae271ae09d1b8f717fb5dda3f71dec69b45df43cc94572601f8b894e0e901a9dc674635f94e31a3
TLSH
T1B8716F340A923596E7D58AB3ECFD0E163C738C6E06134D310D50983D281F7627C6A547
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 ba93e2dc1fad9bc01b9618f9632f09a9bdc0eee41171e90a8e23ce1de49af6b5
MD5 4916d5b9c4167fea02bba31a1c53ffa1
SHA1 0c168ffdd9dac50db5b624688be165392fb8f5dd
SHA512 6d874e1463a55f6b50239c00c4d142767d660565e1d1bc053e2612babdb256eef0a75f79b1646bf0d03ba2af22d79b1e880563e883117446fa1d479daad40d6d
SSDEEP 192:Dsot+DBgE41kwvTIp1e2agD5HctfyXGHt2OkOMOVO+oEM3o9FUH/1i:Dsot+DBgE41kwLI1e2agD5HctfyXGHtn
TLSH
T1E7F1ECF3C3E5862DD81156F1EA143E27DE590905836C3D4AC8E4BF4FA7E54B0E221A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 69d9e87d93c36a4dca676d7712aab44f0cfbd7459ea1c2a54c80a144abbc69c1
MD5 459bce1b892e8f73f6e32e7972cc6ce4
SHA1 3b846e9aacc9e60e8b4c2c63e541390f7f400a94
SHA512 f140df2b281d7cfea72d4236c61bef424c4033e40047d958603978056ed866df24bbf479a5d737de211508b63b8e45b81e17ee856b838989787f35c8d7e34dc9
SSDEEP 192:Dsot+DBgE41kwvT0p3p1xagD5HctfyGHt2OkOMOVO+oEM3o9FUH/1hvG4x:Dsot+DBgE41kwL0p51xagD5HctfyGHt4
TLSH
T1C502DBF3C3E5866DD8111AF1EA143E27DE590905836C3D4AC8E4BF4FA7E54B0E261A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 053c6f049b5885dc8d2b2c4a3654c54002d994ee0d0598be9dc532636cb5f70b
MD5 582a36620012a1c1a6280542d0453b00
SHA1 e12d92fa8c82e5b2ba467fa1f544b90f8f54d08c
SHA512 def0bafe9b1ca19824c19cab9ecea0b89fa2e07b7997002704ba22570c2c8bb1b167970d7c8a8ddf4e17593f8983b9a79e81cfd303e017fe6aa0a449919f68e6
SSDEEP 192:sxZdQUnERoyM/jK1Ml8MkX/fcsyH0Obriddpm9raHW6+WNR3SIFL5B4A2/Y496pE:sxZ1nEGMX/fcsyH/c9HbUODu/6Hk
TLSH
T1AD72E8026934497B8CDBD21DF915BB53D6F81572EA900E58AAFC8A1C04E6BDD2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 bb7308f001b9fd40f45bd54612d73a19bd1dd4a31380967b386e5b581cf29940
MD5 4d8e6569558979318c0972f92f7074d4
SHA1 e0726a9756a168a44268b998f48b387eaf28363a
SHA512 adbc7827d3b3fba63f2dcdb4440ab4072ee324594914e0ca5999579a25c9fa467140e2ed32b393e28ba2949b5ea252e578cc17e8ba9a315fc62db725971ea0f4
SSDEEP 192:sxZdQUnERoyM/jK1Ml8UQSkX/fcsyv0Obriddp49raHW6+WNR3SIFL5B4A2/Y4kG:sxZ1nEGqRX/fcsyv/cXHbUODu/IHO
TLSH
T1F872D852A534497BCCE7D21DF911BB53D6F81572AA900E48AAFCCA1C04E6BDD2217C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 812525d2c913f9b8964e59cb2c5b3736ca06974df67b022936b0d9c2a9c41c62
MD5 942253eab6a71d18c8b7bc5b6f6a6215
SHA1 fae7ad4c2d3004442ee1f5ac4f8173bdd514b410
SHA512 63390822e4db0591d74418991dc6301d765ccaa44bf550ba2712250e4695d49a79a2d5cc0e03d0ebb94c4d4dc3420e838645955105b890b6b3d84bba4a7cc545
SSDEEP 192:sxZxRoyM/jK1Ml8MWOX/fcs0Hod/cdpm5aHW6+WNBSIF4A2/Y4YC6p+UIgrJ:sxZxGuOX/fcs0HPZHb0Ou/CvH9
TLSH
T17752E8026A34597BCCDBD20DFA55BB53D6F80572A6900D58AAFCCA1C04E6BDD2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 95f1d26eade59cebc69fa1d202f7eb19fdf6a8a8bb2dbb9536f2a2311597e9ae
MD5 1d39258757f0d950f683aeb041735e9e
SHA1 9e01c892c3a862ecd66f87e6b57ae5d697001293
SHA512 cfa362d83374198aa4393268322c7f9a5834865f4184b3c49608acd1398c25c9e91a2e001f85d0553638fa5d770796b6e0e5791583641e776c7d4f916bfd4347
SSDEEP 768:x58iJPNWvx78r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opd6rook1pUnX:x58iJPNWvx78ru1jahALocdx5pUX
TLSH
T163E2FA3B680CCB7E4F844E9CEC266F966DD801CB6B948D5447FA884C03C76EE512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2079e03b-da06-4427-af71-e6e1ddbd9ea9\index-dir\the-real-index
Size 72B
SHA256 d34bfe98c07475867763296ae361cfb75fca41da6bd885166d0afb4a1e341515
MD5 48243269d5f40ed88c8d39b684e9f277
SHA1 8d0f1168f8265c01d96687a79577d4520cb9552e
SHA512 e86ba7fcf5e8890eb3fd1775494be5daa8a7e38f0bb3078f874b9820f1cc262fe4155a451d4f2504cbf5c8d4c2c8cccf3d568b793508363a948720f363f505dd
TLSH
T1E2A0021683A0F015C0123AF326D60B7362185E900B0153354291044DCCF1B554A4164C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2079e03b-da06-4427-af71-e6e1ddbd9ea9\index-dir\the-real-index
Size 72B
SHA256 1df9205cadc7b48dada85e2f5b581a762aa838c0ada650df247b4cc64b757689
MD5 205d86c73654351a57d5529d9b5fd918
SHA1 73458d6d75320670b7568f49fdd1bc70b238953e
SHA512 e2a2d8938fa9e9558edbb7b7ec2b261292c137d6cc56deb94f7ba207799821fb7fdf6c242949bd530697c9227f45e52a5a1dec34186802d4a309ead2424528f4
TLSH
T102A002110390120BD11A13B115DF9645B308CC1412001B4B50957548DC54E844D4104C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index
Size 3KB
SHA256 f2103ce6c356ad38a0025e7202e22bdfdb3437305d723afb4317a61029473fb2
MD5 a4340ae47a78eb82897cc89a281e6eb1
SHA1 a98ed90c726cf4c1e732bd9e25bfacc51daac1ca
SHA512 9bf2cb0b38bf67032cc3ece029eea5fa0be5af00e36ec10f2f4c7bd97cf84cfaecc8e3c132e616ae8fb20ae8a1a6710bb0032e2589ed6337969cb96e5b1e5aa2
TLSH
T12A51C59E4C573B97CDAC117260B108883775B5DC2A448E27A4FC8038AC8732428AA75C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index
Size 1KB
SHA256 17e569c0965ad8b9897c5710767eec9d830fe2775c70ad96edb15678e9df85f7
MD5 2730fd41a72b565c58db9b9555726a12
SHA1 70dcbb4952583f8249f5f92a92c748fb8fc676c8
SHA512 3f35d349df9eacfa0970f2b7b853afa749cf4e27782ab7545fd6a8d5814cacbdbc41b1b9edb743cee0ef09a9e5cdb4a138cdd7d1badf4245202b5b438a08a947
TLSH
T10F2135484EA59DAFFDA045B20272A5A0737089DC1755B7136C3C31312E1775A2A479EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5889ad.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index~RFe5889ad.TMP
Size 1KB
SHA256 453c4e2ae6f1fbb1f392a0122b13d823f9ead37df6fd886c2fc6df5f475dd2ab
MD5 9e3cc895534d24ed54fcf7a9476b6acb
SHA1 67d7fdfdc5aeb73c4952b4bb9fe0fc5e7652c8c0
SHA512 a2177df6626b0fa48386698c8669cc03fd7f3f6d2abfd7664f78474d8f4a13ac4234f5deb96956e12a021752b4f513a37125337deb262bfc407b95cce3e3fccf
TLSH
T1CA21548A4AD08E0BF8C0507B0963B4F8733489409712B393A87C36395D25B8D2B4F0C9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 b4c01d346ad7ebc3e8b6d7bc366fb8972a0284462b904e4a14fffab8a772cc7b
MD5 61022178b181075ea2393b79dd0cbdd7
SHA1 71c8ead52b65763a167bab8821291b91eec9415c
SHA512 2293e6fa22034271bcc0ea91ce93b51c2eb8bfbb7d4281becd9b7d045b5195bdd508872c36606c970347048ae2c70eaf4f677e71cd4c44d3cdd7d2cfae18b375
TLSH
T169E0C0F72FFB2884FEBF63E10571A8B00242F459D544FC8F1416EB832461352340AC22
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 203ad706ac3040c2e90596334fefc8e55ade89884560920b0fcc178604c8be62
MD5 70a2a05bfa63547396c533a7901c58fb
SHA1 538990053388636a2a0b817916659229dca5e711
SHA512 761d16eb1c6881c210b7f3f5cedbdc25761546a62ffcae2d6ddd8874d6f1a4744d1dc210f19e3de5f0d0317df069b8fcdc2b0d051598755a0626cd4a37e61ba0
TLSH
T111A00227865802ADD04902F4B14109C52226C8100F05222170A48465A85414141B6047
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e356.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e356.TMP
Size 48B
SHA256 2c6065f3f15c0657f192bb3f84b66a83d6b10f2cad9a2f6e3d8f9a3ba13efe74
MD5 686f9fcce39e2efdda0a1d4a3881dc4a
SHA1 3e42c349dbc91a71aba7281f1f669c16e0c87c3c
SHA512 30a8b20e151d23a1af2a03568fe3beb8a45421e5120d36635fb3661cd83047b93f40166f2630bc472c80bc9447e28dda614be556fd822c80845e0eb4cbfc95ba
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b92a145370054a74298dfc4130a6ad004122fe2ea0ff625828fd6df14abe72e3
MD5 c83a376fdbb8e0d5ac0ac061a9779358
SHA1 8c67e8f203c45552d1e82c84a8fc774240770ca6
SHA512 478da705421942e4bf5d7d34b7401a1866a02203b79a31199bb7a323c312f7689cc284ab842163ac67da5d466042893fa11d827ff7e1e88c913db8006a76433b
SSDEEP 48:KgjIRKso8/yFdI5KWM8gLSL7LILcL6LsL4LbTLILJLqI4L0LbK9Li1LGLbpLSLLe:KgjuKsouWdKKWMhfqKMwaqz
TLSH
T1EB91624270BA17413C7E690D9261861B5B4130A7315A752B7FB814E22F27E284FFDEEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f161c2e9-5b0f-4737-a502-7f8860bc1ef4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f161c2e9-5b0f-4737-a502-7f8860bc1ef4.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a70e4c43d7e0bc42cba4ad78d3fb7ce2fd6122bce6ae43307a9e7bc7a3a3f9f9
MD5 9a7314164cfa3ab5ab90bc267a17e531
SHA1 fd9f38ba5ca184c0d158ba17a2f1fdc0cd38c27a
SHA512 e772badd8ab3dd6128c69f1428ed9367bc16d78d62552f0779a20ff28ff7507605fef92fa1701f6370c807266f79d86ec9ffadbad135bed27aa56b742b4f7eb9
SSDEEP 384:uiF1tNn/s3n9S8qsNO8TUNTUlIl/TBudIs2ktC2B3qITGT0IQlx9v:FF1j+9y7wgL9spl3qi+0/vv
TLSH
T1D3C22AF248E7993AD99E4747B73D2E164EBCC067BA806E51B3C85A0CCC861BFC246D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 92e3e5cecade1a9a3b58b07eb5c8857516c4723b55109a8b8902bf5ad1ddfb32
MD5 5ccb430e2a21fa1276a074273ba6715c
SHA1 2041e4f002e6dde0539657d2998c8f1917a87a90
SHA512 ad69cca4089ef3822b0c919df22c0621afe11219117a799afd2bc4b9039af3901968169a2bd2c57b33f7498a129a02bf04c90cc2dd9e9ae79c80cb6b3f34c8b4
SSDEEP 384:JtNn/s3n9SWsNdU/TBudks2ktC2BiqITGT0IQlx9v:Jj+9dfBspliqi+0/vv
TLSH
T1AB929C725838AD6F0ED3908AF50A361B1FB441ABDBC52F95D5EC6F0C08CA6D8134BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a7a4b2ea357e92bc4be568e3abaed550aa4a593bb2c6132ab7430223c7a6d411
MD5 5a55bcda1ff36e84b9b19b127abb88ac
SHA1 70f11c6f3a9f2e1491f1be09f23517ba7774627b
SHA512 a4d417c51edc2a5fc83ad7ad4b53a9338f4e4101f7f779be30f7ac5379a0cfcfef53865633e3dffc3621a3e1c4da3d468f52a77a020000d1f9c0b263105b05c1
SSDEEP 96:ZqONkPQsjpfmUTmDK5ih/cIPURHl8h4otop5Z5DdBhPwivh50xy0SFYKBAxseYoP:gONn6kDfQmiUyrDZ903kC35Qi70wU6
TLSH
T1A8020935A8786CBB8EA3AE49F4473B275FA5213BEAD12F84D9E41B1C04C764C1306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9c6626fd94f956c6ab3cf615f6af0f7cc486d58ade77e9b371c0c6dcc22df2c2
MD5 18984250223abc4bbb6c6d809a6a7d54
SHA1 81198c988f622f751955cff9570ccabf294c3321
SHA512 61f90bf1f37f09c857d4bf42decedc9f0dd6d3d3e446d6ea171636411106819b111fe3115fb1bd61106658ff4d8a09b4d2da531d4c90f225ebfc1586ad4816e0
SSDEEP 96:gqONkDQsjpfmUTSK5ih/cIPURHl8h4otop5ZEDdBRPwivh50xy0SFYKBAxseYoWB:LONP6kDQmiUyoDp903kC3GWEXcRNqbU6
TLSH
T1C9123932A878AC7F5ED3A845F48336134EA5412BEFC96FD1D5D82B1C05DB998030AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c56754494e4cd44e0363a1345c637027ae1e20d35f9192e1a1393ad6526e4aea
MD5 fa9c2e96c337060970461d47f70a9ee8
SHA1 b80bc57e1b24774f06390f21e3eb1030af092297
SHA512 320f3e5a81aea7715493dabbd44c2900bbba5a567ce8d18e72bd90daaee4669e904779009df4c72d6e71164ecf4eab0e3133e15783e80864f99c36b5d070efa4
SSDEEP 384:/tNn/s3n9SfsNdUmTBuKMs2ktC2BiqITGT0IQlx9v:/j+9USQspliqi+0/vv
TLSH
T1F2928C325838AD7F5ED3508AF50A361B1EB441ABDBC52F95D5EC6F0C08CA6A8134BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ea759c729259d61be9406dfbb89f8cd57bfd7bd3a09795ad772bb5149f44d3a6
MD5 d334998c7c4c56300c841f3b1c28ebab
SHA1 e9f814997fd1e2a341d3f2b8633bad6499a7cb0d
SHA512 03203767ae7f3ab286b5a4f9d4dbbe88f101da0b1edcda249dace40dd8b9f95dae5d2f076d000fdce13590978e87c745fe9dd766a9db3ba4f203dffb5f149908
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe58bdec.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58bdec.TMP
Size 392B
SHA256 87cd2f4b9db29ffb286bf42de203a903dc7f0fa7c173cf638348638295f8d65d
MD5 148f634aa74d4b55f85dec9f62dfa183
SHA1 c1f5e094eb537035553620f0271f28f856663491
SHA512 4d9ea4c89108e34ca8df430d9a51be85c57e2cf36b85d3faaf0a7178ad664018769ad66edd0942ee7a7098ace0b5dcdd09936679479721d86948fc90f5274df2
MD5 SHA1 SHA512

Submit Download

65bb8242-8a10-40bd-86bd-e1e7a1ae98fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\65bb8242-8a10-40bd-86bd-e1e7a1ae98fd.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7a0e41d8e6e2499ea059b210c081da4b09670c9d9fd9a6dfbde2bcea6ad8a669
MD5 f698c452371caa4974a9db28fde96d02
SHA1 ca4c79e53334cdc5bb073cd19a364fb6c04cb0ab
SHA512 b9bb1ceaa2784a29e2545eaf5fb280683f7f032e276baea6a24f651d6b32a11305f267f91df6bb6b2330b9d10b6e509c3dec570f549a51f0d0b7aa98048464ee
TLSH
T1A1412758B6F91108B3B6AF569BF6A8AD487BBC372E06D45E10120D4F0672B40C872B37
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download