hxxp://bs-pu[.]fi | Triage™

Resubmissions

20/07/2026, 17:48

260720-wdevtsby913

20/07/2026, 17:46

260720-wcnrcah19l3

20/07/2026, 17:44

260720-wblwcsby3z3

Analysis

geolocation tags

eueuropefrfrance
user interaction
yes
max time kernel
299s
max time network
295s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 17:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://bs-pu.fi
Sample260720-wdevtsby91

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2136	msedge.exe
5100	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290433076852803"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{ADC753F9-191C-4DB7-99AA-72909A09EF50}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
5808	msedge.exe
5808	msedge.exe
5888	chrome.exe
5888	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
3796	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1920	chrome.exe
Token: SeCreatePagefilePrivilege	1920	chrome.exe
Token: SeShutdownPrivilege	1920	chrome.exe
Token: SeCreatePagefilePrivilege	1920	chrome.exe
Token: SeShutdownPrivilege	1920	chrome.exe
Token: SeCreatePagefilePrivilege	1920	chrome.exe
Token: SeShutdownPrivilege	1920	chrome.exe
Token: SeCreatePagefilePrivilege	1920	chrome.exe
Token: SeShutdownPrivilege	1920	chrome.exe
Token: SeCreatePagefilePrivilege	1920	chrome.exe
Token: SeShutdownPrivilege	1920	chrome.exe
Token: SeCreatePagefilePrivilege	1920	chrome.exe
Token: SeShutdownPrivilege	1920	chrome.exe
Token: SeCreatePagefilePrivilege	1920	chrome.exe
Token: SeShutdownPrivilege	1920	chrome.exe
Token: SeCreatePagefilePrivilege	1920	chrome.exe
Token: SeShutdownPrivilege	1920	chrome.exe
Token: SeCreatePagefilePrivilege	1920	chrome.exe
Token: SeShutdownPrivilege	1920	chrome.exe
Token: SeCreatePagefilePrivilege	1920	chrome.exe
Token: SeShutdownPrivilege	1920	chrome.exe
Token: SeCreatePagefilePrivilege	1920	chrome.exe
Token: SeShutdownPrivilege	1920	chrome.exe
Token: SeCreatePagefilePrivilege	1920	chrome.exe
Token: SeShutdownPrivilege	1920	chrome.exe
Token: SeCreatePagefilePrivilege	1920	chrome.exe
Token: SeShutdownPrivilege	1920	chrome.exe
Token: SeCreatePagefilePrivilege	1920	chrome.exe
Token: SeShutdownPrivilege	1920	chrome.exe
Token: SeCreatePagefilePrivilege	1920	chrome.exe
Token: SeShutdownPrivilege	1920	chrome.exe
Token: SeCreatePagefilePrivilege	1920	chrome.exe
Token: SeShutdownPrivilege	1920	chrome.exe
Token: SeCreatePagefilePrivilege	1920	chrome.exe
Token: SeShutdownPrivilege	1920	chrome.exe
Token: SeCreatePagefilePrivilege	1920	chrome.exe
Token: SeShutdownPrivilege	1920	chrome.exe
Token: SeCreatePagefilePrivilege	1920	chrome.exe
Token: SeShutdownPrivilege	1920	chrome.exe
Token: SeCreatePagefilePrivilege	1920	chrome.exe
Token: SeShutdownPrivilege	1920	chrome.exe
Token: SeCreatePagefilePrivilege	1920	chrome.exe
Token: SeShutdownPrivilege	1920	chrome.exe
Token: SeCreatePagefilePrivilege	1920	chrome.exe
Token: SeShutdownPrivilege	1920	chrome.exe
Token: SeCreatePagefilePrivilege	1920	chrome.exe
Token: SeShutdownPrivilege	1920	chrome.exe
Token: SeCreatePagefilePrivilege	1920	chrome.exe
Token: SeShutdownPrivilege	1920	chrome.exe
Token: SeCreatePagefilePrivilege	1920	chrome.exe
Token: SeShutdownPrivilege	1920	chrome.exe
Token: SeCreatePagefilePrivilege	1920	chrome.exe
Token: SeShutdownPrivilege	1920	chrome.exe
Token: SeCreatePagefilePrivilege	1920	chrome.exe
Token: SeShutdownPrivilege	1920	chrome.exe
Token: SeCreatePagefilePrivilege	1920	chrome.exe
Token: SeShutdownPrivilege	1920	chrome.exe
Token: SeCreatePagefilePrivilege	1920	chrome.exe
Token: SeShutdownPrivilege	1920	chrome.exe
Token: SeCreatePagefilePrivilege	1920	chrome.exe
Token: SeShutdownPrivilege	1920	chrome.exe
Token: SeCreatePagefilePrivilege	1920	chrome.exe
Token: SeShutdownPrivilege	1920	chrome.exe
Token: SeCreatePagefilePrivilege	1920	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3796 wrote to memory of 820	3796	msedge.exe	87
PID 3796 wrote to memory of 2136	3796	msedge.exe	88
PID 3796 wrote to memory of 864	3796	msedge.exe	89
PID 3796 wrote to memory of 4380	3796	msedge.exe	90
PID 3796 wrote to memory of 864	3796	msedge.exe	89
PID 3796 wrote to memory of 864	3796	msedge.exe	89
PID 3796 wrote to memory of 4380	3796	msedge.exe	90
PID 3796 wrote to memory of 3940	3796	msedge.exe	92
PID 3796 wrote to memory of 3940	3796	msedge.exe	92
PID 3796 wrote to memory of 3940	3796	msedge.exe	92
PID 3796 wrote to memory of 4352	3796	msedge.exe	91
PID 3796 wrote to memory of 4352	3796	msedge.exe	91
PID 3796 wrote to memory of 4352	3796	msedge.exe	91
PID 3796 wrote to memory of 4180	3796	msedge.exe	94
PID 3796 wrote to memory of 4956	3796	msedge.exe	95
PID 3796 wrote to memory of 4180	3796	msedge.exe	94
PID 3796 wrote to memory of 4180	3796	msedge.exe	94
PID 3796 wrote to memory of 4956	3796	msedge.exe	95
PID 3796 wrote to memory of 4956	3796	msedge.exe	95
PID 3796 wrote to memory of 3856	3796	msedge.exe	98
PID 3796 wrote to memory of 3856	3796	msedge.exe	98
PID 3796 wrote to memory of 3856	3796	msedge.exe	98
PID 3796 wrote to memory of 4700	3796	msedge.exe	100
PID 3796 wrote to memory of 4700	3796	msedge.exe	100
PID 3796 wrote to memory of 4700	3796	msedge.exe	100
PID 3796 wrote to memory of 1760	3796	msedge.exe	101
PID 3796 wrote to memory of 2228	3796	msedge.exe	102
PID 3796 wrote to memory of 1760	3796	msedge.exe	101
PID 3796 wrote to memory of 2228	3796	msedge.exe	102
PID 3796 wrote to memory of 736	3796	msedge.exe	105
PID 3796 wrote to memory of 1720	3796	msedge.exe	114
PID 3796 wrote to memory of 840	3796	msedge.exe	115
PID 3796 wrote to memory of 4320	3796	msedge.exe	116
PID 1920 wrote to memory of 4280	1920	chrome.exe	120
PID 1920 wrote to memory of 2308	1920	chrome.exe	121
PID 1920 wrote to memory of 2308	1920	chrome.exe	121
PID 1920 wrote to memory of 5100	1920	chrome.exe	122
PID 1920 wrote to memory of 368	1920	chrome.exe	123
PID 1920 wrote to memory of 368	1920	chrome.exe	123
PID 1920 wrote to memory of 1648	1920	chrome.exe	124
PID 1920 wrote to memory of 1520	1920	chrome.exe	125
PID 1920 wrote to memory of 1648	1920	chrome.exe	124
PID 1920 wrote to memory of 1520	1920	chrome.exe	125
PID 1920 wrote to memory of 5224	1920	chrome.exe	126
PID 1920 wrote to memory of 5224	1920	chrome.exe	126
PID 1920 wrote to memory of 5420	1920	chrome.exe	128
PID 1920 wrote to memory of 5420	1920	chrome.exe	128
PID 1920 wrote to memory of 5500	1920	chrome.exe	129
PID 1920 wrote to memory of 5500	1920	chrome.exe	129
PID 1920 wrote to memory of 5536	1920	chrome.exe	130
PID 1920 wrote to memory of 5536	1920	chrome.exe	130
PID 1920 wrote to memory of 5828	1920	chrome.exe	131
PID 1920 wrote to memory of 5828	1920	chrome.exe	131
PID 1920 wrote to memory of 5940	1920	chrome.exe	132
PID 1920 wrote to memory of 5940	1920	chrome.exe	132
PID 1920 wrote to memory of 4944	1920	chrome.exe	133
PID 3796 wrote to memory of 6128	3796	msedge.exe	135
PID 3796 wrote to memory of 6128	3796	msedge.exe	135
PID 1920 wrote to memory of 5524	1920	chrome.exe	136
PID 1920 wrote to memory of 5576	1920	chrome.exe	137
PID 1920 wrote to memory of 3348	1920	chrome.exe	138
PID 3796 wrote to memory of 5808	3796	msedge.exe	139
PID 1920 wrote to memory of 5888	1920	chrome.exe	140
PID 3796 wrote to memory of 2712	3796	msedge.exe	141

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://bs-pu.fi
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffefc57c188,0x7ffefc57c194,0x7ffefc57c1a0
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,5521344091495326746,8498350722110877909,524288 --field-trial-handle=2716,i,5337860074693102962,13561347692871221502,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,12304721763098862532,9278816179212074676,262144 --field-trial-handle=2716,i,5337860074693102962,13561347692871221502,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:2
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,6919511925743457443,3438477300876927386,524288 --field-trial-handle=2716,i,5337860074693102962,13561347692871221502,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,2541033174250926284,10792314473550256082,2097152 --field-trial-handle=2716,i,5337860074693102962,13561347692871221502,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,3423555467024658819,3634326977060591224,2097152 --field-trial-handle=2716,i,5337860074693102962,13561347692871221502,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,2470466234273572391,11454829002264617905,2097152 --field-trial-handle=2716,i,5337860074693102962,13561347692871221502,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,15358302971301399634,8366272568364263543,2097152 --field-trial-handle=2716,i,5337860074693102962,13561347692871221502,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5100,i,1153660076555604314,7398981682189608076,2097152 --field-trial-handle=2716,i,5337860074693102962,13561347692871221502,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5264,i,17106934300352725789,8612963729144545336,2097152 --field-trial-handle=2716,i,5337860074693102962,13561347692871221502,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,731326832375171651,853729803871906458,524288 --field-trial-handle=2716,i,5337860074693102962,13561347692871221502,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,10678771627000031069,16455375790789517829,524288 --field-trial-handle=2716,i,5337860074693102962,13561347692871221502,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3764,i,18392022464288941614,8597795356446303616,524288 --field-trial-handle=2716,i,5337860074693102962,13561347692871221502,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3764,i,18392022464288941614,8597795356446303616,524288 --field-trial-handle=2716,i,5337860074693102962,13561347692871221502,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:8
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,8069107771760169484,14831551240433557287,524288 --field-trial-handle=2716,i,5337860074693102962,13561347692871221502,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:8
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,2620838303052199923,10640143086898881061,524288 --field-trial-handle=2716,i,5337860074693102962,13561347692871221502,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4172,i,13130721049455237509,6057893696358804827,524288 --field-trial-handle=2716,i,5337860074693102962,13561347692871221502,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,12506310848960943541,9200309876475192593,524288 --field-trial-handle=2716,i,5337860074693102962,13561347692871221502,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6072,i,14171081944058691730,5110811843948612960,262144 --field-trial-handle=2716,i,5337860074693102962,13561347692871221502,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,2205317792524314407,7391690747225329090,524288 --field-trial-handle=2716,i,5337860074693102962,13561347692871221502,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3968,i,5236075268698413450,17338421309227993658,524288 --field-trial-handle=2716,i,5337860074693102962,13561347692871221502,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,3384963100861758074,14738996908824435429,524288 --field-trial-handle=2716,i,5337860074693102962,13561347692871221502,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:2644

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4032

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffef8b8c728,0x7ffef8b8c734,0x7ffef8b8c740
  2⤵
  PID:4280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,16026209574907547385,1004382640392323058,262144 --field-trial-handle=1996,i,17417795672196471687,8202374550786154261,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,7779484068761757200,10221527731971692607,524288 --field-trial-handle=1996,i,17417795672196471687,8202374550786154261,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,9120977545035661964,9372087100555471173,524288 --field-trial-handle=1996,i,17417795672196471687,8202374550786154261,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,17162700416669933842,13414704260999441459,2097152 --field-trial-handle=1996,i,17417795672196471687,8202374550786154261,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,12707577819743131191,13901511688254709972,2097152 --field-trial-handle=1996,i,17417795672196471687,8202374550786154261,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4456,i,7698756678376130357,11709470299913021277,2097152 --field-trial-handle=1996,i,17417795672196471687,8202374550786154261,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4468 /prefetch:2
  2⤵
  PID:5224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4708,i,14382445433293232325,13653763518442396965,2097152 --field-trial-handle=1996,i,17417795672196471687,8202374550786154261,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4920,i,2609866490837084939,14284612445903665824,524288 --field-trial-handle=1996,i,17417795672196471687,8202374550786154261,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4904 /prefetch:8
  2⤵
  PID:5500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5024,i,2421153017506753311,16706961692942816569,524288 --field-trial-handle=1996,i,17417795672196471687,8202374550786154261,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:5536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5072,i,6250066071474012136,10134959968778991064,2097152 --field-trial-handle=1996,i,17417795672196471687,8202374550786154261,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:5828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3340,i,17959962799999237054,6556797452089064108,2097152 --field-trial-handle=1996,i,17417795672196471687,8202374550786154261,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:5940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5812,i,3606207380241818455,17887939849500907268,524288 --field-trial-handle=1996,i,17417795672196471687,8202374550786154261,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5712,i,16904187867808316209,14778292327535763033,524288 --field-trial-handle=1996,i,17417795672196471687,8202374550786154261,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:5524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,3415787416888855306,7291384073231476861,524288 --field-trial-handle=1996,i,17417795672196471687,8202374550786154261,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:5576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5540,i,16652733662865003455,335071640464083169,524288 --field-trial-handle=1996,i,17417795672196471687,8202374550786154261,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:3348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5768,i,17701369628141628141,12645703806957585014,262144 --field-trial-handle=1996,i,17417795672196471687,8202374550786154261,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4676,i,4098626357671127831,13701444396216823938,524288 --field-trial-handle=1996,i,17417795672196471687,8202374550786154261,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:3804

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 96f6cd024cd21f08033efc81cd5047a9175fef1680ba85e0ab4ebc897e8123c0
MD5 d93c7df47fa8f27545d0d743c202f50e
SHA1 a65badbf873a271e5ed3f78803cd61a2dd8ac07c
SHA512 dba66bdbc52b1953e0da7fe1169d91ddc227a0f032865cb0575545c3859f6d75750bd7e2d7202455dd009c47af49c961893f21721b37d833b7fb0984fb33819c
TLSH
T18BE02BAECC219C271DF91B2C70100645E7401316BF90CA0F7A3EC20C8FB5A3A4266D2C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 21KB
SHA256 f8a6a0a8a6474e36f509acb50a94afd09fc313b1c61b36eb738b0210cfed0717
MD5 1a7029f66ee56c52f59f1b068c8a8bc8
SHA1 ef6f5a4aaad4eaa2bde329583571493bd7633784
SHA512 74fed3072f88230402389dc56e105960ae96f3ed6b868382d5b1be273e0bf4d4049daf8dd1f1be9d639e8dc70035e87561a83d3fde727a192b6cfb9ee577b8a5
SSDEEP 384:XNMRlKlaAR8kKNsZleV2wtu52k8B7lt5mhgXr29hAwg7t9h6HYUOt+527Ut:eRlKl/RM6lI2jMlmhgXr292wgh3atOto
TLSH
T1B1A2E1778C629FA43915CB6CC6856585FDEA33141BE7ACBF1DA90AC4273392F231170A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 576B
SHA256 863e0f8acead31c123ac902ddf4932c3bbcbb8614d694bed16228cdad2d383cb
MD5 a86c56d4408cac62969fd327caf7c095
SHA1 2cdaf9e704d6a873a451e6e687b44a800bfcbe50
SHA512 f3a9ad4a4441522b4a9777835ad7420d711e6431181edc933847b31725662065fad0ce768a82838d236727659cede2920a4ba98b7ad80394dfea38100f515cf2
TLSH
T143F0A98F64F19207CFCC03B48BA1ED4EBB21B76D454FAF634081A0E49876BD2355E100
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 be1ef078da75a1eaf435acda34f97935e4fa7a0be2439c6e2bf16f955979a728
MD5 fb4581c48cea032a6450ad724ebbc87a
SHA1 c526efeabb6739bb0692e45918bee9803d74270d
SHA512 fa839d58240f505c3facad80cf0a8a6ff4da9be217d3d1d3ddf8ea95e0249f50e0217c3b42006b0c1c15846cf56c240866025c571d372ddc99cc771ae94a8f3b
SSDEEP 96:DSXdQdfWoaIyeG7O4d0dFdqwdNFdQdcSdVK:DSXG1WoaIyeG7O42TIwrFuqS/K
TLSH
T1CFB1ADF3C7E8856ECC0161F9AB243E1BCE2A0915532C3D16C9E4AE5F67F2471D251A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 cdaa8739c2583fb4df18ea527fbd1aa4a6e970615660550b278676351f7217f2
MD5 edf2cba41affeb1f3b3de3da59bfcc25
SHA1 cc6f469fc0afb70f1ab334a3be5af955d0b11bfe
SHA512 5ae4bc44bf2276ead3bc671ee87a06e4e01b892fe23bdd87252eb587a88d48b399dcf8f65de12c5e195db6b6700fccc2b520718a50f924056a377ab24c3b7104
SSDEEP 192:2iRIFHSbp/A8gXRmOXz6h2v7cpAPRp2qeIt9BHsb+WNnIFJDIBx2Exw64fj4cjVY:tREytLUBwUXlPrwcM2acnF8
TLSH
T16342C72EB91069BB5CD7D229F9257B13E7F5202126942EC4EAFC8E2C15E76CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 eb9884dc8656eaa1a5dd7378cffb0b4da314acde1c47ca105980f510ba17069f
MD5 5ac6128365829ea9331e462f6804c635
SHA1 d825ed19501c0cdc890c66bb32ab940557c59403
SHA512 2c589a476b6525d7e9ea939aebb86090bcb257f26a9e7b18460daa4148ed1910b5d5baf9e4a3f2960dbd361b0e189ac7fc4363a40b39d661fccf9fb6ce910c8b
SSDEEP 192:2iRIFHSbp/A8gXRmOXz6/2v7cpAPRp2qeIt9BHsb+WNnIFJDIBx2Emw64f84cjVK:tREytLUTwUXlPrwcM2xvnFe
TLSH
T1E252C72EB91029BB9CD7D229F9157B53E7F5202226942EC4E6FC8E2C15E76CC231741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
MD5 248039e3512518ae98cef47428956f17
SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
TLSH
T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 2a56be3a53dfe44b55e1c364823cff2e11d346fc58fafbe2ac7bedbba48491b7
MD5 8580664b3cad972d5abb1b02acf27803
SHA1 db5fdcc5c3345e74c34fb226127ebb7a6716797c
SHA512 0f2eec10b1b631237fdd89620dedf2a51bea45f0ec4066b9e952adac4526d632d43d74ac9d2a6abbf345ce812076797a300a306252f9c1ff971be9831af4cd69
TLSH
T1E1B01210C8439113C14A02B421C6588873E4AF19960F170143E0A923CC356758018060
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59af70.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59af70.TMP
Size 96B
SHA256 8b26bdf10dcf7626718ba5a55b042dac508dde89a35c12a5a49f6a7726c8801d
MD5 be12763d72b829e8907ddf1653ee9e7a
SHA1 592c4a4fd5cedbf68eded1d3b8dc77f8793ae069
SHA512 eb761c97e577c550e6ca7abf3704dd5bbfa32e325626f4f3c4a7e618523a12e7a73f23cfefbb457179a4fdc9fff6fe5fea97126459975309a0d0dd4368e80ef8
TLSH
T1B6B00295D2176316C04243B065BDAED97170DF25C6071613A3F05E7ADC2B6B16A25160
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 9554293c0a0434973978b7979908003bd07b765808c7eba5205710dd123d4b2e
MD5 7e7b18eef84589e961a9c36735c57df1
SHA1 e2207c3ee7221468eb8933d27538896b35a10146
SHA512 8818e1593261c2cc89bf4ef498bb1db18f1b4b6f73b429177d3d3133b88c7bee4be0f2db77c8456ecbfce74ac1cf7a1b2a7e3a42bd8f85985bf5b48bf69d2eed
SSDEEP 6144:kTGnwcaReQfFcCcr3cd9jrQhFmUi21rSm8uUVNSlzYN:mePa6zfi21b8j8zI
TLSH
T1B8341331BAA769B2DE6DA11C3BAF67067D610C91C649C64561023E029C9D3C23FB7F2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 9777d047e75a14f31f5e413e35b6ebbb9cbbd5700913115d42cb9100a196cd9f
MD5 6fdab4827cd092c3baabb4a246198814
SHA1 f31a7681ef7cd9395fb87f93c18c8319741e00e3
SHA512 12fdeab645990dfe267f2df48e257dc7d185710b7f1d1839d4426b232765dcbf28d00382121a7167ea8c391d7dbc54b50fcf056bee56b9417295cdb2292d3036
SSDEEP 6144:4GnwcaReQfFcCcr3cd9jrQhFmUi21rSm8uUVNSlzYN:AePa6zfi21b8j8zI
TLSH
T158342311BBB76972DE5DA11C3BEF560A7A610C90D689C28162433D02DD993C23FB7B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 9c7e9419b7e0fa906157e945aca58866a7437d001f4a6e90085b61d704cb8aad
MD5 e5d9dd7611383c62dd28bbce5841d26e
SHA1 0c682a53576a2fa34e55f8968c64ffa63cd6afe2
SHA512 dbdb11954e4411abc37abce83d301c165937dedd161ab2e14111e8a7589760dff007026134f5798b55c635aec44ddd22504be9e697b118ea6fc2144f7282c9b9
SSDEEP 6144:gTGnwcaReQfFcCcr3cd9jrQhFmUi21rSm8uUVNSlzYN:CePa6zfi21b8j8zI
TLSH
T1D3341331BAA769B2DE6DA11C3BAF67067D610C81C649C64561023E029C9D3C23FB7F2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 59ef0e29177bf841d21bf538c772d37ebd39cdb7b15810c50a806e3622f2de2c
MD5 b557d1dd8f00bc7e5903d10a4d9238c9
SHA1 1e64e6626fdd78bcecf9c3c87a9835640a5cd99b
SHA512 6a91ae668006e8408adc8f9773bce71a7bb52d42b9580657015b56466780f106b2a98c8fd17be3b376bbf15e20aec135c48fe9cfb9b58802943580f6b790469c
SSDEEP 6144:ZGnwcaReQfFcCcr3cd9jrQhFmUi21rSm8uUVNSlzYN:PePa6zfi21b8j8zI
TLSH
T14C342310BBB76972DE5DA11C3BEF560A7A610C90D689C28162433D02DC993C23FB7B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 db380f68e89c4bff51b661ab8f036c421d562be23d36d3fad861aae5a0b0fd94
MD5 06c6f21e9b935173995ad77c581ca261
SHA1 1fb2f4ce6276ef67c07667bf8a7b44a6f24724bf
SHA512 66c494e739afdef46e433870b8227f0fe3504b7bb86e19f157c3e1b6cfa342eab716d63158c70847448ee4d7c2358d5e4698ec95f0ed16dbf4567f853577a5dd
SSDEEP 3072:SPFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:6FmUi21rSm8uUVNSlzY/
TLSH
T170C31200BAE3E9F2EE5930447BEE2A145D6C0D818291C6415273AD419DEF3C71FAAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8bd193269cbc0101b18807144d6cd741576381f849ecee6df4fd3079b1e2a2ea
MD5 7f4cc8bd47cae9e9cfcbdc3a9dea31d4
SHA1 6406135db9fdcf767dc9e78333ef0cb8dfd551a1
SHA512 894acd81265a2f42a77360eaacfcdb7e50c7d9b0a2718871318cc1ab538e27cb24b8d3dba4cdc1a6de030a8f0012aac3b2f7e8fbaaf939ef83c5f7ce1469a61f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 fde1fecea85e476db67af0e3bff468cde3ab4006f25be189bd46c11ae696d23c
MD5 d7f89dd87e621a785ffc33fa3467ba39
SHA1 5b6c5ba4872f5462f6daa4249b43d0e857a21c51
SHA512 9b664ea641b6861bc02e6f9d952039dac0f99df95301591271464ad312cb71c9ee59c22bfd335e8e2505c4b267f8c30625ccaa6ba4856aee4ba2b5cfde5d1eff
SSDEEP 96:X8dkbuyjHSCPE3SwHYEo6BCB/zvXDfAj3HH:Xn3jS0E3Jor3c3
TLSH
T18D812B5881F20F41E7766FF1CFD21ADA3D334D888A9B8D3A02849B7D9A73B6064DA105
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59640f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59640f.TMP
Size 3KB
SHA256 50db692f13cda9b10a4d5ccc9f20a49479233d1b589978e85dbd0db777dd1595
MD5 2f7a7714ae04af3865aab3605671292f
SHA1 8092533202f74848b080bc70c973643856306d16
SHA512 991ee53297a8c4eafc1f43fc6f375fc708fdc1b8e3f3b577ab34244d58b61ef4c48976efcec8d37b36c01e210be63ddef4e822fcb011b6c8db2162ddfb8cecae
TLSH
T16D713C1805F10F91E3B26FF2CFE216DA3D734D888AA74D3202C49BBE593772084E5545
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 01c1bdc3210ce57dbe16f72f3f06dd0ff53bb34a35482c9c5b01d752540e09a3
MD5 fb3dde85c77473fe5231b45161ac666d
SHA1 ed7ed37bb9bb407c4ad3017179524109ca5de674
SHA512 6c09535e47e828067a01c821a19c25493428494fec9701ec0a21bbd39fcdc39b5503d20c4c8ba8bacac862cbf1bdb85084a0b0a0012053b7b7cfb36051ff51a8
SSDEEP 96:DnOdGdidwUdiidzldVdodLdywBdhBdybldLbGwQ:DOE8eUgidp/21UkZEblxbGT
TLSH
T1E1917AB7C7E4816ECC1112F5AA247E2BCE2A0506935C3C1AC5E4AF8FA7F2431E15195F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b2856df0070e2b0b8a62b33fde63853e3e584d34ec65a0d73dccb930cc6eeeeb
MD5 577d4f3fca6e49c4e0b281774b469a6f
SHA1 75c99ed0cc77c565d5ab6a1cd6def9c83f1ec16d
SHA512 6e6bc1d010e7d8bb1b28e55675ab92541882af45a3b46289b13323137dbaeda2764bdc3034f5f4c59cd6ee68225ea0c69b42fe6512b7c72e47a2a5f157eebea3
SSDEEP 192:sxZISG/RLpJyM/+K1Ml8Mkb+/f7vsgsg4IugTEdpvIkHW6+WNkINg/YwnGIzzu27:sxZiUMi/fLsgsg4D1RHba/C09
TLSH
T10742D816AA34597BCCCBD219FA51BB53D6F54462E6900E4499FCCA0C05E6BED2313C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 27c939a404dbe0513be8cc2b806c10b5841df61bbb4a8c156625d1124f66f78f
MD5 d7247e477fe28e3128315b4777257821
SHA1 a1af54f24a39c43484a43a6f4f1b0537a6349d34
SHA512 a4abccdf14b2443ce14f01cdbb8107812bcb665f19eb6dc9c8f02f16e6ada0f268e09467dce700fe2b7ef693137794945a5de297f7a222d6664d0101fb850be7
SSDEEP 192:sxZISP/RLpJyM/+K1Ml8UQbvkb+/f7vsbMsgBCIufTIdpJIXHW6+WNkINg/YwnrF:sxZ/UqAi/fLsIsgoD0wHba/R0Ed
TLSH
T19B52E816AA345A77CCDBD219FA51BF53E6F5446296900F449AFCCE0C05E6BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 647cd3614fe30e5138dee0f5683916deba7118063146ac37cae77b56c6b6cf07
MD5 1005ecb7911b31e61c13c6f153a87cc0
SHA1 35c36bd21da8221c56108a89e90458fd42ec8e3e
SHA512 8a2b32642688b8ecb57856310b5f9ef294c3cd28a96b903ac525551da386ab79bea7388f19c0ccbab32c613924360ccce0353a60043f5f1634cc209f0fd40a13
SSDEEP 192:sxZISP/RLpJyM/+K1Ml8Mkb+/f7vsbMsgBCIufTIdpvIXHW6+WNkINg/YwnNIrzQ:sxZ/UMi/fLsIsgoD0OHba/v0Ed
TLSH
T1C952D716AA345A7BCCDBD209FA41BF53D6F5546296900F449AFCCA0C05E6BED231381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5947c9e3d03fbd787b06e1c576bc6608ca9a0a63260d369b14546dc09d3575fd
MD5 b6d68de2d81c9a5860b3608bca99409e
SHA1 928b370530dbe8e51628dd8e7eacc6217d210d85
SHA512 9db84d6ea8a766a5e1171512e9330a6a0346466f944b735d663604996e0cb111f01ae418c202a5e303699a3e3a37d6a5cc0572ecd8b57b3fc42b46a40cd58656
SSDEEP 24:Kd2fZKLaYdM404sY+/IjO0Ki3ha401EWkSmqM782yyXYQf3kVaadCC+4SO+lIjYF:KA7IVKMMAQyFpIxKCkUiEIPKt2cHyz
TLSH
T16A91A81277B712123C7E29299255EA1A4B81B1A7304DB47F3FAD10725E27E640CFE5DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd42f624-3429-4bca-bbc1-600e0425fa65.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dd42f624-3429-4bca-bbc1-600e0425fa65.tmp
Size 30KB
SHA256 e82c311724875956a1673c008344c2206083e21031787b7b2962ba14a4314007
MD5 e2e8d7c6075ca64c6ad1292f53b33dc1
SHA1 7a6606627aef1d935314889fbb4411102c303fde
SHA512 9fa4cd702a86000141aae981fc417eec51b444e28a21a56f81e324fedd4c1d28304df77861ef9ec4931d6845c08888d8334838f0605dd081d4f5fa9b89a2221f
SSDEEP 768:LI4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOPLlrZ+dgrohbcrak:LI4jeXmWvmKLEu1jaTPLZQdrmP
TLSH
T1C4D20A3B240CCB7E4F844E5DED26AF976ED801CBAA584D4447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59aaad.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59aaad.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 2090a9373d40a5b1de3ceffad3f2f9ff9a9fac7ff54d3d2af1a5cdaf5066ec3f
MD5 3ae921974efb56be6d81ea6d959c5e13
SHA1 6a04c2a93bf227968a4e291492a2623a3676e0b1
SHA512 a8eaf80a21f45f92716832e59bd32af86299d0a5afcf3528f115c818b43f532e1d697aae3856c3ecdb1b7428ac771d1733687470f05267d0e81b30499e080703
SSDEEP 384:NtNn/s3n9SBsNFzcuz6XZf+o8hy9XPGF6RjrGo41+:Nj+9uRh3P46Rjao41+
TLSH
T14D929D366828ACA748E69688F1073A535FF8416796CA3FC4D5FC9F0D05DE6AC0307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 cb097cce1125417b144abc6686310abe6a9e417231ded4c802511a99812eb323
MD5 df3180502119625a68af86928c497331
SHA1 1743c5c17580dd220db27f3a40545f1f707fd573
SHA512 dc1961dd23f513657de13bcf08af002e61edd758012a3b0ffdbb68895e22710a1f292e07ba858ddc65860f79d4efc12d8a6da7b233a999fb75692580a087a2bf
SSDEEP 384:7iF0tNn/s3n9S9VsNFN8TUNTUlIlcuz6XZf+o8hy9XPoF6RjrGo41+:WF0j+986wg0h3PW6Rjao41+
TLSH
T135A26B376858DDBB9DE68A84F60A36135EF44167D6C66F94E6EC9F0C019B2AC0307D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 29df35e8b24915ec6306beb5769b9392fce0807f7dcaa1938693469d2c814976
MD5 7f19b9393680ee66643f81311ff60855
SHA1 18c553bfa53a7b6b59e44e1371cc425d18e1c7d3
SHA512 3da8128b4abe15d8097d8de4d2d4e99752c7e5305a853b27597bb50185848b4b5ce28df58c0828bf92b22b68bba8b0c63265fa76d534024724337174e1f8eabf
SSDEEP 192:EONT6hZ0QmiUyI4IWpc/+jVSjzorh8F45wOZJYjU6:EONT6o8pu+o8hyH2UU6
TLSH
T11402D83968687C678EE2AE45F48737235FE5112BEA956F84DAE85F1D00C769C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 1ed6d50a707690fb4753206122ecdbc948850a9a460f4221e98e52673910236b
MD5 45a71fe32aaa5f770fc9dfd6bce97c11
SHA1 f1230103fb3ed4aae31125a3d76744f153ec8707
SHA512 0acb404f68fd1ad7d48e990d8139f5579392abcea8546cd45004d185737dac585d2255dc58491813f38c5e76fd4303cd070ef97b4d522ad046d4fadf9c1480ff
SSDEEP 384:etNn/s3n9SfsNFzluz6QZf+o8hy9XPbF6RjrGo41+:ej+9UVh3PJ6Rjao41+
TLSH
T10C928D366828ACA749E69688F1073A531FF8426796C63FD4D5EC9F0C05DE6BC1307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 27e22fa12377b453e7cb6b0236b7e015a9216701407204d9c1df2e30a82199f1
MD5 53eaaef0c4601fbef20953fd6aec8fdb
SHA1 2afdbe5e7dbd9726b218d7eff65761dd40b1494f
SHA512 3c7c464e553aaa394d696b65738f9292e903aef3b2f26c42d32dd9acc9ea1056847236de46ca55a7bee6f6d2ca42d08faf4465a2a2b2b2fb5f8806c7d4eda2c2
SSDEEP 192:eTONSuy6hZiqQmiUyI1IWe8c/+jVSjzorh8F9XME15cOqJsqqU6:AONxy6T5bu+o8hy9XPw96U6
TLSH
T12D12E9366868BC6B4DD2A985F58736135EE55127EEC97F80D6EC1F1C01DF6AC130AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 88c7ef0a81f1f94d080bf7a5b0a5421840284291622a509f08f7276b69e57cad
MD5 4bea42da885c634009de0424f98ae6a5
SHA1 017b103b4d1eb939bfec26cb2c19272eac3d6be2
SHA512 1832b43dbead08545117370874cfedbbd92cc03f3e552b8b8e2e7095443a97cd40926b0032548d672cc1a7acc11c8ad50feeaeef5b8c45c90ae124b161727277
SSDEEP 384:ytNn/s3n9SBsNFzYuz6XZf+o8hy9XPGF6RjrGo41+:yj+9uxh3P46Rjao41+
TLSH
T168929D362828ACA748E69688F1073A531FF8522796CA3FC4D5FC9F0D05DE6AC0307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

198b3c43-9c87-4b8f-b3a6-e5e0650ebce7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\198b3c43-9c87-4b8f-b3a6-e5e0650ebce7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 cffaa20ebbd8d0843dd718dbd7f9d0f9b016d529493521ab005a61d3a5f6df13
MD5 35247b3e60222f4273a5e57be43b7451
SHA1 df7959d439ccb421515a090b01b17710931305b7
SHA512 6a376c5526d545f393c9d4faefc90e965b757f945c52992e60b7ad4e2d2983ba4e33eca6a2aa343f8eeb1bc138820146844d176dc93eb64203b23af5ec6f4416
TLSH
T185412A58A6E91108B3B76E1AABF7A86E847F7D772E06D45E10110D4F0A23B44C971B37
MD5 SHA1 SHA512 TLSH

Submit Download