hxxps://work[.]ink/1YWW/xeno-executor-v1355-new-ui

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/06/2026, 03:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://work.ink/1YWW/xeno-executor-v1355-new-ui
Sample260623-eabwbsh14k

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5260	chrome.exe
4388	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134266598439157564"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{19B18922-09B9-4160-B906-22C0EF597A2B}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{E58A300E-442E-44EF-AB63-682342377195}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3772	chrome.exe
3772	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 708 wrote to memory of 2976	708	msedge.exe	86
PID 708 wrote to memory of 4388	708	msedge.exe	87
PID 708 wrote to memory of 4308	708	msedge.exe	90
PID 708 wrote to memory of 4308	708	msedge.exe	90
PID 708 wrote to memory of 4876	708	msedge.exe	88
PID 708 wrote to memory of 4876	708	msedge.exe	88
PID 708 wrote to memory of 4876	708	msedge.exe	88
PID 708 wrote to memory of 4352	708	msedge.exe	91
PID 708 wrote to memory of 4352	708	msedge.exe	91
PID 708 wrote to memory of 4352	708	msedge.exe	91
PID 708 wrote to memory of 1680	708	msedge.exe	92
PID 708 wrote to memory of 1680	708	msedge.exe	92
PID 708 wrote to memory of 1680	708	msedge.exe	92
PID 708 wrote to memory of 4748	708	msedge.exe	93
PID 708 wrote to memory of 4748	708	msedge.exe	93
PID 708 wrote to memory of 4748	708	msedge.exe	93
PID 708 wrote to memory of 4384	708	msedge.exe	94
PID 708 wrote to memory of 4384	708	msedge.exe	94
PID 708 wrote to memory of 4384	708	msedge.exe	94
PID 708 wrote to memory of 3996	708	msedge.exe	103
PID 708 wrote to memory of 3996	708	msedge.exe	103
PID 708 wrote to memory of 3528	708	msedge.exe	102
PID 708 wrote to memory of 3528	708	msedge.exe	102
PID 708 wrote to memory of 4548	708	msedge.exe	105
PID 708 wrote to memory of 3348	708	msedge.exe	117
PID 708 wrote to memory of 3348	708	msedge.exe	117
PID 708 wrote to memory of 3348	708	msedge.exe	117
PID 708 wrote to memory of 1020	708	msedge.exe	118
PID 708 wrote to memory of 1020	708	msedge.exe	118
PID 708 wrote to memory of 1020	708	msedge.exe	118
PID 708 wrote to memory of 536	708	msedge.exe	119
PID 708 wrote to memory of 536	708	msedge.exe	119
PID 708 wrote to memory of 536	708	msedge.exe	119
PID 708 wrote to memory of 4872	708	msedge.exe	120
PID 708 wrote to memory of 4872	708	msedge.exe	120
PID 708 wrote to memory of 4872	708	msedge.exe	120
PID 708 wrote to memory of 3768	708	msedge.exe	122
PID 708 wrote to memory of 4948	708	msedge.exe	123
PID 708 wrote to memory of 4296	708	msedge.exe	124
PID 708 wrote to memory of 3940	708	msedge.exe	125
PID 708 wrote to memory of 3940	708	msedge.exe	125
PID 708 wrote to memory of 3940	708	msedge.exe	125
PID 708 wrote to memory of 5440	708	msedge.exe	126
PID 708 wrote to memory of 5440	708	msedge.exe	126
PID 708 wrote to memory of 5440	708	msedge.exe	126
PID 708 wrote to memory of 5508	708	msedge.exe	127
PID 708 wrote to memory of 5508	708	msedge.exe	127
PID 708 wrote to memory of 5508	708	msedge.exe	127
PID 708 wrote to memory of 5524	708	msedge.exe	128
PID 708 wrote to memory of 5524	708	msedge.exe	128
PID 708 wrote to memory of 5524	708	msedge.exe	128
PID 708 wrote to memory of 5704	708	msedge.exe	130
PID 708 wrote to memory of 5704	708	msedge.exe	130
PID 708 wrote to memory of 5704	708	msedge.exe	130
PID 708 wrote to memory of 5796	708	msedge.exe	131
PID 708 wrote to memory of 5796	708	msedge.exe	131
PID 708 wrote to memory of 5796	708	msedge.exe	131
PID 708 wrote to memory of 4144	708	msedge.exe	132
PID 708 wrote to memory of 4144	708	msedge.exe	132
PID 708 wrote to memory of 4144	708	msedge.exe	132
PID 708 wrote to memory of 4336	708	msedge.exe	133
PID 708 wrote to memory of 4336	708	msedge.exe	133
PID 708 wrote to memory of 4336	708	msedge.exe	133
PID 708 wrote to memory of 5328	708	msedge.exe	135

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://work.ink/1YWW/xeno-executor-v1355-new-ui
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa9024c188,0x7ffa9024c194,0x7ffa9024c1a0
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,5612810203870722608,2684433565180365042,524288 --field-trial-handle=2332,i,14946229724935222537,3890045134438051539,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,9296903213664062216,2804461503945344143,262144 --field-trial-handle=2332,i,14946229724935222537,3890045134438051539,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,2806410051071062236,15756219158559036286,524288 --field-trial-handle=2332,i,14946229724935222537,3890045134438051539,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:8
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,2078156492857603293,8042053078008370059,2097152 --field-trial-handle=2332,i,14946229724935222537,3890045134438051539,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,5131320126825001201,3457702644425338138,2097152 --field-trial-handle=2332,i,14946229724935222537,3890045134438051539,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,10249207787916702430,12863351823748619332,2097152 --field-trial-handle=2332,i,14946229724935222537,3890045134438051539,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,16443532526121064585,6390304915438620430,2097152 --field-trial-handle=2332,i,14946229724935222537,3890045134438051539,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:2
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,6743000882577974630,549266210759916953,524288 --field-trial-handle=2332,i,14946229724935222537,3890045134438051539,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,17980070371967145236,8705863963273188297,524288 --field-trial-handle=2332,i,14946229724935222537,3890045134438051539,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,8913484151151808614,12323869847355172770,524288 --field-trial-handle=2332,i,14946229724935222537,3890045134438051539,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,8913484151151808614,12323869847355172770,524288 --field-trial-handle=2332,i,14946229724935222537,3890045134438051539,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4992,i,17322698113307647374,5876702718012172810,2097152 --field-trial-handle=2332,i,14946229724935222537,3890045134438051539,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6232,i,3444132909248037915,15900986719446009795,2097152 --field-trial-handle=2332,i,14946229724935222537,3890045134438051539,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3496,i,17351208867633805075,9143899470766565508,2097152 --field-trial-handle=2332,i,14946229724935222537,3890045134438051539,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6428,i,1627290900903797882,1428962654929436038,2097152 --field-trial-handle=2332,i,14946229724935222537,3890045134438051539,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,13856234331246961060,1064115735803339007,524288 --field-trial-handle=2332,i,14946229724935222537,3890045134438051539,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:8
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,8268936053134129192,9461957612367377802,524288 --field-trial-handle=2332,i,14946229724935222537,3890045134438051539,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4172,i,15921964701118654431,15941545159841687868,524288 --field-trial-handle=2332,i,14946229724935222537,3890045134438051539,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6580,i,7552257335119014426,5245858318721015347,2097152 --field-trial-handle=2332,i,14946229724935222537,3890045134438051539,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3948,i,12575812226646144131,6399356567635531782,2097152 --field-trial-handle=2332,i,14946229724935222537,3890045134438051539,262144 --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:1
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6784,i,7208098867740937827,14157333254110879342,2097152 --field-trial-handle=2332,i,14946229724935222537,3890045134438051539,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:1
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6896,i,7517021948491256456,13230742579643507417,2097152 --field-trial-handle=2332,i,14946229724935222537,3890045134438051539,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:1
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5200,i,15734474465795042179,13197749178419547847,2097152 --field-trial-handle=2332,i,14946229724935222537,3890045134438051539,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5384,i,11096174239107576943,4271937546353823356,2097152 --field-trial-handle=2332,i,14946229724935222537,3890045134438051539,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:1
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5192,i,2465934996059822225,15657019235787875609,2097152 --field-trial-handle=2332,i,14946229724935222537,3890045134438051539,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6884,i,1689454326896284615,10264701432157255721,2097152 --field-trial-handle=2332,i,14946229724935222537,3890045134438051539,262144 --variations-seed-version --mojo-platform-channel-handle=7292 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7492,i,256113866019814584,17351457757718079743,524288 --field-trial-handle=2332,i,14946229724935222537,3890045134438051539,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:8
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7496,i,13842530825184027766,11775488273870560936,524288 --field-trial-handle=2332,i,14946229724935222537,3890045134438051539,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,17049226793309386646,4532180050477503560,524288 --field-trial-handle=2332,i,14946229724935222537,3890045134438051539,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:1348

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2608

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa8f85c728,0x7ffa8f85c734,0x7ffa8f85c740
  2⤵
  PID:6020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2028,i,13574994988645420688,8652684031795361770,524288 --field-trial-handle=2140,i,497533751435393836,11539763269127048139,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1808,i,2685524240725539041,5166868223600511840,262144 --field-trial-handle=2140,i,497533751435393836,11539763269127048139,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:5256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,7191609098261027218,17443436400071655311,524288 --field-trial-handle=2140,i,497533751435393836,11539763269127048139,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2364 /prefetch:8
  2⤵
  PID:1260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3272,i,2975664115793966620,13409824077273203706,2097152 --field-trial-handle=2140,i,497533751435393836,11539763269127048139,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3364,i,15977844037842892071,15032102887103100361,2097152 --field-trial-handle=2140,i,497533751435393836,11539763269127048139,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4360,i,2078785174144612404,18372592303465214807,2097152 --field-trial-handle=2140,i,497533751435393836,11539763269127048139,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4364 /prefetch:2
  2⤵
  PID:5604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4776,i,10562032206382758353,14809411715530663935,2097152 --field-trial-handle=2140,i,497533751435393836,11539763269127048139,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:5656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4916,i,5083554631529869468,12221806006459880225,524288 --field-trial-handle=2140,i,497533751435393836,11539763269127048139,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4948 /prefetch:8
  2⤵
  PID:1872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4940,i,14436599921508870790,17367623114901721575,524288 --field-trial-handle=2140,i,497533751435393836,11539763269127048139,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:6048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5460,i,3236062076439046336,6090791015791273312,524288 --field-trial-handle=2140,i,497533751435393836,11539763269127048139,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:5360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5492,i,10102240550926607456,18439541820212012616,2097152 --field-trial-handle=2140,i,497533751435393836,11539763269127048139,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6108,i,7332202718466201789,11005794622379256555,524288 --field-trial-handle=2140,i,497533751435393836,11539763269127048139,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3456 /prefetch:8
  2⤵
  PID:4172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6104,i,5602706495839320309,10928902091929232190,524288 --field-trial-handle=2140,i,497533751435393836,11539763269127048139,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3964 /prefetch:8
  2⤵
  PID:5420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6100,i,8377277570966802249,12681655890240332255,524288 --field-trial-handle=2140,i,497533751435393836,11539763269127048139,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3612 /prefetch:8
  2⤵
  PID:6120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4380,i,5719325287248176208,3464630267190768735,2097152 --field-trial-handle=2140,i,497533751435393836,11539763269127048139,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4468 /prefetch:1
  2⤵
  PID:564

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e33d95c5db1c2db87c8f1a7f8076a8108714bee9e1432ca6f494efa335ca6a57
MD5 404281adf19a5255e1e8a970a25d73bd
SHA1 b503f0320d8b17134b5c9562761131274a846b28
SHA512 4a279b5659c37298bde271f724e38c599475905671630c59c699fba1053cf6edd7bb773ea3235e659a0f138b46e1bd7fa47697a96b9faeac982709a05f4d3544
TLSH
T179E09BAACC619C2709FD5B2870545689E75113177FD0C91F3A3D82088FB5A7A8566D2C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000019

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019
Size 21KB
SHA256 bb915f6e3e29924292b507c72c064b60c4f82b3f97ae287747dae1535bf82e9f
MD5 669f4950d396755d3eb21e25e9168e21
SHA1 98ac48cfd56f2d6060e20990ec6388ac924e416f
SHA512 1a897cb58ce40dfa56fd5cae0b0dbff25e8d7acf9bf3fb57b913a26bca39be4e145fd439f5143d1e03ce2d668e760f8924de1b71c6dc85e6ec2dbefb1e7dec40
SSDEEP 384:DaNpMRbIcXAochrXEDjn/O79+B9X96iHHxeh+Pv2ky:DaNpKbIcXchrYDWB+Bl5sh+32v
TLSH
T10AA2E16F1E4E1544866FE9E1E48F23503535779C7AC8B8453B8F861BEA26973F09C40C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8eafa899310dfb4238b6c0f0d082d73235b196448f3ebf376735ca76c06e5127
MD5 1ab3048f12ed73626a3f8a5508134c8f
SHA1 1aa53ad751c9ceef7c5aa26f3a67b92dca5ac5df
SHA512 273d3d80828f7b9ab1224823ee764da548cb91b94c6d5ed568d5044377046a1b90b23d57b1681adc350d39988d020e4540824f58e5d163e95f8e81b52ef41e57
SSDEEP 192:ARUFYNcTZgv7cpAPRp2qg9BHsb+WNnMk0KrNwkwXaVx+VyIsnAUgtaJ:ARUFqk8wUXlgrwf0B3aVx28
TLSH
T1C542C92EB950657B5CDAC21AFA167B53D7F5103236D42EC4EAFC8A2C28D75CD221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3e6ecf14aee1817ed3ae3e655948ec1b766593988fe353255cb185e82586479e
MD5 bd6a0d265186f240f22d86a66d793e64
SHA1 00e2a5e0db420554198293a4e674701195a29731
SHA512 fbf6b12b362771bdb6f7573fbe21064653bdb7b74ff6ee093e7a0e310f7f69cb64b377ae579b1b02613d06fdde076fab48f8983794e7913b9a0a2dd06f8337e2
SSDEEP 192:ARkcBzFYNcTZUv7cpAPRp2qFz7R9BHsb+WNnMk4NM82ErNwkwXaQx+VyIsnAUgrK:ARkmzFqkQwUXlJRrwfs2r3aQx2e
TLSH
T16F52C92EB960657B5CD6C219F9167B53E7F5203276C42EC4E6FC8A2C24E79CD221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
MD5 248039e3512518ae98cef47428956f17
SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
TLSH
T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 402934d3a31b9e40b6a5dc5cc328de0b6abf4bb0b8fe990b1578c6526a934aeb
MD5 bfa898901711edcd0819e725f8fd4679
SHA1 c8f1c45bec54c0c21a463ae0fb463dd710c1733b
SHA512 34677da6efe25587e1a73ece51c35ab1118ecffd88123534c7b22919efb5aaf5db1d46292bbb7b3876dec30a9a7cf4ef15d3e8b3439842dde598461686bd570b
TLSH
T169B0124180015102C05206F41146948873349F10EA1A270143E4BDA28C296508328050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a6ad1.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a6ad1.TMP
Size 96B
SHA256 e341d1d9145ac390aa815087fe70f4ad8cb354152be6829614f2fac425f75020
MD5 df293e3526da85629983f422b0a7f65a
SHA1 1629466ea4f0ccc7c3f7b229d70dabc2bec5d35f
SHA512 33cac0d75c1d867d6f1a194600d171e0c11401d13879b6331cdadad1825724689239bf9ded7b1e15c080649b2b4c1d1116dfbf08b0fdbdac4e8155ec7b05ed10
TLSH
T1A2B02222C0822302C08223B02CB0A8C830B8CF38C203020AA2E00B22CC22A3002280E0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 b87a5e791fa73e6eeda20bcfd682ce32eb09f5962bbb76eee4f1e1b9470c3f60
MD5 cd79c36d0e59aaad76d1d29487ae5bea
SHA1 70e0b960f8f710f9c41f40fb4f941edb67def9eb
SHA512 ffc7a4422a6c275c3470f8970242c30c128ad984b5879a41ae456e218e5d8c6f793fe03066cf12b766f1ac0063e3a1d5f4c15587d058b1ed7cbbe2d41b527a46
SSDEEP 3072:SKFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:fFmUi21rSm8uUVNSlzY/
TLSH
T139C31300BAE3E8F2EE5930447BEE2A145D6C4D818291C6415273AD419DEF3C71FAAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 cc76a1ab333ffa20054f0ee4159be02d41f06149bac2dbedd7739f1fa0934e3f
MD5 51a7ff9531851c61aefc2091ccad7c9c
SHA1 1f6f67a8c63fd6da85cbe735b2c9c102e25b58ae
SHA512 fb25b5fc360c1c95a1f35470da335fe6bc5fc81a0b971bbb96fcc2ada68b13467a88d42622000a4fe5bd08eba06fb1c8ac20fc3f13c3d52ed3816e9a0a62c3c8
SSDEEP 6144:KbzvK8j24ooO/u4DAk42FmUi21rSm8uUVNSlzYV:CBoduBGfi21b8j8z4
TLSH
T1193423107977E833AD0EA0B873FE6D185E658D50D691C0E047126DC6D8AF3C72D6BA35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd
MD5 3406d3b708dcef0116bffd8eaa181ad4
SHA1 3df64b48bff2b9d4160d900e91a7670046a24340
SHA512 d22d05c221bd19bc3b07e9a5ed722fbf8fbf75d695302fe8ec441d6d1e653bd63b3751a9608b344cc859feb79c5869aaeedd08bf846dc01a522b3a0dbb1637d9
SSDEEP 12:sUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T18F727886B34494FFC8C35A7189BE27902374F6DE5F02836B6A3A7A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 083d78ea5ea69126b24164f2e05fc467ce21fdcdf2ec67f8e94c4366a1284886
MD5 da79f81681859af2b76762aa37a5f73e
SHA1 53d69c959eb46848bc7ed7b5c480df864295389e
SHA512 f647681c342e36fa2f41fb9d54d089303f98b802703a42609226ef5755aafc91ef00af41a82f980c0f2819709322c59ef6cd1c18725ef5133691894902fc44c1
TLSH
T1FCD09B7077CDAC11D5450471D45547535D96CA4C24D7DB076011801D68557D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 38cbf5b6a486ee67c58f888162c4b1efc73934f894d8c8462a1c1a39d1b30632
MD5 66a0f3aa6408ea757521465ce118ccdf
SHA1 fb52b5c1b41c3d2d991460584025a99538470d98
SHA512 05d2f868c0717a99c0517d94ee0fc4d82c92c243f52729cb715cc5e34e940e5ac2bf3b72d8d96667282a3e5da4563755f5768150c86f290b4409047310f4fb8e
TLSH
T1EBD097303559BCD1C038007084210220AD99864B22A2820B3000840AC8A62C0B2C68A3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000064

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
Size 375KB
SHA256 431a3251deb71c9c6d19db7ece22c26583f9d8fdba96fdfbb6a5b27d4214e31f
MD5 a3e719f84f525e2c6689b3f6ac73c402
SHA1 e3e93bf2c5aa88529ea3c1e524d2350245e91515
SHA512 0816380a9e625ce2e34fef598104a90a2724096b4d627bbe790c58008eeb3c50c732aa24500caa54fdc46c7f63216533adfb46d119a74aff4ed421b9f381ddbc
SSDEEP 6144:bk02i6NJqyLQCeqg5Vici0bU4rCHA9Q9lkOmEeWxF9Mh+kLNYr7tHLh:bMNJqybeqYvxCHAmXmEevbK3Bd
TLSH
T1A4842368F4BFE4A2AE8449215E5E0D746F487EB21740540AFB7DE2BB2415C493B6F203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 6e4e96b0029e4aa486c4daa3f4dd0eec69c45d2e91a4edd0626d6b42cd2d505f
MD5 713aa9d43a7e8cc7fb1e96f7b7db65a0
SHA1 de91910b56344ed82c85d9fe5ab290d7383856f5
SHA512 20a1359de3e371972491743cf860b336670477241388b84ce6fca6d5a9a9247ab24e1da9e773ea76f5aea6ba722c1769c26acf3c4f79a0bcaced08d6d9db0093
SSDEEP 96:DxecXR1O8ntaO6OHtLOt/KYQIMmVDd7YafVA0vUReAtFYfyn7FCg5xFCQ92CuWlc:VecXR1O8taJ+tLOtK/IrVOa9A8UReATU
TLSH
T151C1A59696BA6212CB590E72D2CC0F85337672B8185F6F9A0154657F2F3BBD0839D06C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2a32faaf52fc5b84d3b2686813e8f764a98027121ee76a29175821eb61761705
MD5 27abfe7aeb9d25b6cf48daa708aa1f18
SHA1 a85fe97bc86af204810022d385bbd4e1d1de8259
SHA512 2e5b40b568855b694ef8dcd16046bcc62dd1116ae0502e464c55e61d928523177a1d7ed7743e4630996993085a387fde2ea17f718052f083b2a15fd79f312466
TLSH
T1F361291A83696053EB9E1632C0DD4B023572B5FD595BBF2A0980B07F6537BA1D7A904C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 cb6909dbd12b03944e7a6d4b573b79236bd501321d32858d24560abd2a2914b6
MD5 f959a222ab1bedd9f40c73461a77267b
SHA1 bfd857f467e044f88d82ca3cb6a0d2e531e1c4ef
SHA512 ae758b33872f0fc8be3187c4e3cefa8a022a823608a6a23b0f61156a1f17471047bcb36171ffc421f4341dbec9b3828a26d00408fad96cfdd1bae5fc44355b7d
SSDEEP 384:DoNw6lnX/WIsjLe5eGhAIJVBeqQe2JIJ+LZh5BTvz2TMX3XIGnXWnX8XGo7yXWks:cPuusnR5+isdMV
TLSH
T145727AF7C3F8C62ECC5162F0AA643E17CD591915432C3C4B85E6AF4A97F24B0E291A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 edd4727f258732e81d314ac48fe41a6869d5d7a76f88c1fb2c2e613b3406f978
MD5 02972b6d7cedcdc354878e330c45df30
SHA1 d4de7d7a136635f8bceef3f146fa1e2b51aa13b2
SHA512 2d2264d9b4696cb1f4b2f292b136e6a3ad563c0f89bf0b1ca7adc4054df95b85481657b2660d03b8cdeeb5430873c9bd2d4c8b83a8a9cc8e8075f301607532e3
SSDEEP 192:sxZQRhyM/jK1Ml8ikm/fxs2WpV2vCuIdprEJqatHW6+WNjrrHLUGMXYIHl3LIgbs:sxZQXgm/fxs2Wv2q/SHbXSXTQ
TLSH
T1DE62E902A634997BCDDBD219F941BF53D6F51562E2D05E94AAFCCA0C01E6BED220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 49e8a6ba30d568c7f4af5f8fb0b153abfa9bce9d34ce632dd14d8e0a3082385f
MD5 4f6de96c0c6dbca674de00c557aded6c
SHA1 8598a48f2cc605cd48cd5bb1b9bcaa5264551019
SHA512 143260afcd400c68fd81bd903ce0981c8e1d344d9421ce3564ce757a3365a496ad35c429e4b9dfd85bfc927babaa5f15eea2fba11a4e8006e99eb50e344c88ad
SSDEEP 192:sxZQRhyM/jK1Ml8Mkm/fxsCvCPIdprEJqatHW6+WNFrcohWGMXYwBDDpNIg5IJ:sxZQXMm/fxsCqgSHbCy0XbPm
TLSH
T1FF62E942A6349977CCDBD219F941BB53D6F54572E2901E98AAFCCA0C05E6FED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2f102f988d19de04878c0c4936103be7165d49c10c9b0d8bd587cde64ccbb422
MD5 3f059a974a222a5e666646431cf82d6b
SHA1 b05e4697c47028029d35bf706378b059d0f2e8be
SHA512 7939e0b35f505edd62191ad6c2f5036ccc411e3539563bfda5083e57da06f1fc2f3d3e40031be7b196027eb917141166b7657f7d4c70cbabce1603d8cf10179b
SSDEEP 192:sxZhRhyM/jK1Ml8Mkm/fxsCvCQIdpqRtHW6+WNrWgar/Ywl905NIg5IJ:sxZhXMm/fxsCqxiHbY/Em
TLSH
T1D452FA12AA349977CCDBD219F941BF53D6F54572E2900E48AAFCDA0C05E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 80f59509dc4bbaccf65760f9c0a519de6c703717c7c63a7ebfddffb472987de7
MD5 0ae1fa9181b84c535fddb41fbca62a42
SHA1 5a6a61f0083af126abb076667ad8f65b9be68510
SHA512 bff468289f8f80b6200ebb49e972c859fd0e6a8557fcb4f91f7644211fd86824612a3cc03cbb04231aded63dbf6e22be76112a1b100ca2ecf9a87ad17c5d06bd
SSDEEP 192:sxZhRhyM/jK1Ml8Mkm/fxs9v+oIdpJHW6+WNGYw825NIgrJ:sxZhFMm/fxs9WZJHbGl9
TLSH
T1AF42E7026A349977CCCBD209FA55BB53D6F94572E2900E48A9FCDA0C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 495953cbe34531ef3d43dcba166ed9a7243d02cfbb8390712116029481fdd798
MD5 07c7614d8943c8dfe8c91bd260d7e0e6
SHA1 fbeb29a9e41e403fc177a122bebfb92849d56aab
SHA512 b7942bbbb50c844fa35a0a453d033c8855973193f38258a31ac6d3c41d0cbe31252ebb07efaff3167389c9b28b6abdf2d043ad0f54d4fe678aae4d25e00b16f5
SSDEEP 768:bc4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+d8rohVcAaS:bc4jeXmWvmKLEu1jacPLZQdnEe
TLSH
T1A0D20A3B244CCF7E4F844E5CEC26AE976ED802CB6A584D5447FA494C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 17927d1220bb8146209496f4cfad6b221c4a558877a082e3f395cca035252d3b
MD5 3397cdbd0860948316c7ff19fa65b53f
SHA1 4313ba506ce1dabd541e1f92c39d69dd1d6695d2
SHA512 6b89af7337a95c7bd5e2a89931a28cfd81a06759557d47a9f3fc01d2a90354f2b95b533f9e78e57516881932d462c2bf34b94844f7e0b823109509bce0c57461
SSDEEP 24:KdWf5qra4dsYU4M4+fIjuUKiXhaYU1E2ESmKMb8WJyXYafNWHacdwMI44k+bIjyB:K4TINKEkY7yFTI1KQE447I9Kgsw3yZ
TLSH
T1B691B30D71FF03153C7D691CA6A19A9B4B8176633405E43B3BA900A61E27E680DFDDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe595615.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe595615.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 c3f9b23e062ce3088e992113ad4bb269ea8cb269d6e25d7294e11a2c2f112d07
MD5 73da4ae7c445d1c0d41460914836509b
SHA1 67fe211d9e0eb75eac82952a4fc42fa2a018a591
SHA512 b52e8d06a7aecbf7c7403150f032b38ad467755580a559b48b4a6d65b4221a09b61af48bf646601c1c6092c7bb85975bc4cdaaf4267898b63ba84d9873097d61
SSDEEP 3:MsEllllkEthXllkl2zE/lKn+l:/M/xT02zvna
TLSH
T15A4404047FD5044FD50055304051CF501370F51017135743347305337DDD7C04C00400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 51d26e41793563d5d298d4d715a42a75ed104781ab4bfa05357d053b0c851bdc
MD5 e93e283beda8f284fbdeddb3e4c35879
SHA1 08abb5fa7d23949317bda1fa0dc2eea851fec6be
SHA512 c63734df9156aee1970883fa96868c4624040e103ee36563d01f03fd6880b464b57df9bbbf77ab54a629adbf0c836100d8a43155be467fd3c92247a08519edcb
SSDEEP 192:uUw2LsNahLQrMfZEL1NQmiU1ezgD4H/+jVQO1LKc+2BG5cFTGjqRU8:ecsNadQMOJL2gsf+uOdKc+2HFGmU8
TLSH
T1AB320836A868DC774DE2A654F44736138EF41167EAC97FD4E5ED6B0C00DAAAC230B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 626b6af556a5ef9f51735d9c19927cda2728ea5c172689a1e2be0fc5372065c7
MD5 a696962fdde6aee13288700ebb00426a
SHA1 8de79e64125f5ef61c659019d7ba6bd6700d1303
SHA512 74d52ed5b0befc27e4875e37e214ad53fb9c2b9c13ebbdde5c6aff26ed6f15fc7ca4789e4f8683c491f2844a2d8d05e7de28ff2875ec8ba74959f27b1e05bcc1
SSDEEP 768:aYFYj+9N6wgyMMR+HgsjOAclXMrnXqtzi+0FaBvp:aq9NHBXsQA6tzi0Bvp
TLSH
T17AF26DE284C78CB6C85C97C7A73EAD0619BCC173B4895548B3E86A2CEC4B5BFD346811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cb70325fdc4c05420eaa4188ea096726b3b7a8395a2ada63837bd3d36c53e418
MD5 299ecafd72c0b2a5d9558a92047bacbf
SHA1 93c9a71c56b749a7b1121ec8af3fcdb06890480d
SHA512 e9215b126a0e0c1f5192aa120837e1d1e6ba5cbf3583193a04187616cacba0acfbae3c91c6853b5b5ad4e14bea70f1d1c66661ae146aaa78c5d3261179635de6
SSDEEP 192:EONo6hZ0QmiUyoGpc/+jVQO1L75wOZGbx1WU6:EONo6ompu+uOdC2GLWU6
TLSH
T1B102D8356868AC778EE2AE45F48737235FE5117BE9916F84DAE85B1D00C769C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c1e5f6a2cda627acfe883bb45748bfd115e8a464bf28db906b6892c1efde0313
MD5 71fac004d224880322c85c3f1a6e7951
SHA1 fc2202e38dd694cd53b591f4caea83b07f68e53b
SHA512 6c269c6a4faf7572b527d9a96f8b75588c0b1c54a13a79c8c5305cfe09216d509647e7b214d1befdbbc99e9050116203e1d13198d4b05bb37f564991907b827e
SSDEEP 384:i0tNn/s3n9SfsNa7QMOJL2gsf+uOdKc+2HFGmITGT0ICaBx9p:i0j+9UGMMagsjOAcllGmi+0FaBvp
TLSH
T14A926C326929EC734DE1A195F40B36174EF412A7D5C67FC8A5ECAF0D04CA6AC234B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 13fcd8b2334b90e2adfd0db04be68715accf4e094b86fee3692132ab2aac6f07
MD5 f2f7d73275e80ca321a4dd67b2a87a66
SHA1 94633d7ee64ff177aeafd40579bdab514300a1a9
SHA512 b027cef065e2eaeeeca0444235faa0c03e684265d926a52b6252fae9aa6f84c15d9965fc777a10ac3347e34b25e224f616c324deba9a374969043bfe632fbab8
SSDEEP 768:aYF1j+9NjwgiMM++bgsjOAclrGmi+0FaBvp:a/9N4BosQ4mi0Bvp
TLSH
T187C229F244D78836D9AD4757E73E2E174EBCC1A3F4816A94B7985A0CCC861BFD30A901
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8e301064d7f3d696065bac34bc7acffabf23fab3a70116ded7c770340ba1a5ee
MD5 e8f335492b5b3ba57276be4e91a567dd
SHA1 0aaff3329451be41704c0858a3afe9835e8404f3
SHA512 0dd623c16941b0959d3ca3c01200542cf1b0d94f2708698ff7581d9f088775d69d41fc58736f65c556e1f11093ea6e2d882aaeaec8350e379cec06e15ec5363d
SSDEEP 192:gEONj6hZEZQmiUyDGg8c/+jVQO1LKc+2Bn5cOqGjqRU6:gEONj6Q3Lg8u+uOdKc+2c9GmU6
TLSH
T14B120B366868EC774DE2A555F48736138EE55227EAC67FC4E5DC2F1D00DBAAC230B812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c4d19d00ee1b0dbf927153b6eea37ff0c7106890e80c421272d0d3b79e8b9852
MD5 cfeb430b5602a363c40c4e13f7bc0a08
SHA1 6b6dc4aa8fd4ac1b132d7b77a900d71062f2d706
SHA512 ac6d819f8439c3c348342b352bca7135879d01c7463d53cb515043abb21a60d16b938f87f8a01ab92ee805896e8264eb20b8e11054fa43686e2b38ef280e9f9e
TLSH
T190E0010AA20045AAC029873040871B602AEA902016B206454A62056C6D233002D30F40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 434626554616113ea5e957d6758ae04dda2623444f0368a30675cbe638000ace
MD5 a9f2d8591085fae3b142b1b21c8f7ebd
SHA1 62b0b5f2d2db38392215b343b56f4b7138983847
SHA512 592c29b0772eeea2924bddd9b731c5e5e025e12d760cf350b3e9a49aa07d84dca5bf07626a5ba9d0989817d6131304c5f18dbb1f50c19b798462557bedbcf81d
TLSH
T196E0020561004178C02C473044071F600EC9801014F005444B72055C5D332003A30F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe596826.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe596826.TMP
Size 392B
SHA256 e8b3bd7f34ac200d940614b21205c29bc2c008b7611c77749ad4caac67065bec
MD5 c654865bad9a8e7d057f44cd41d11053
SHA1 a9b8f88f111cb4553bc8a7632c37e75bb6f7b91e
SHA512 70b4bf7d4c1e2334832f1a96cc556dbfbf8de92f7ccff6033eb9f460905f64de417b837d453bbf5ae895b491db105bd401765754b445f498c164ea7a54e69f4f
MD5 SHA1 SHA512

Submit Download

13a8fa66-6661-499f-ab94-282cabc6cd41.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\13a8fa66-6661-499f-ab94-282cabc6cd41.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b06ce31d2b762a500cab1569a160d3dce91f6e263190721fdeb3bd03dbb34b20
MD5 b698497c81d0afcd4657e17e840e81af
SHA1 57bc18ef43283e01698690eafc4b2ca70086510b
SHA512 91c2a752a954cc84cfd04a58a9232928f78ba8cda84e09b60af4a595cade222519db07ff490e2aa3bce801247007cedf2f26c70841edcb6f01a9ad0a1422f398
TLSH
T184413D98B6F91144B3B76E5AAFF6986D447FB9732E47D08D10110E4E0A62B40DC62B37
MD5 SHA1 SHA512 TLSH

Submit Download