d4a0fe56316a2c45b9ba9ac1005363309a3edc7acf9e4df64d326a0ff273e80f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 00:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
processhacker-2.39-PORTABLE/x86/ProcessHacker.exe
Size 1.4MB
Sample260727-arc3hatvbv
SHA256 d4a0fe56316a2c45b9ba9ac1005363309a3edc7acf9e4df64d326a0ff273e80f
MD5 68f9b52895f4d34e74112f3129b3b00d
SHA1 c5e2018bf7c0f314fed4fd7fe7e69fa2e648359e
SHA512 1cd875f9d0301b14645ea608fe61560a229ee395fa061f32675c3d84e41916998f887278d8497a5e875be22ba8fcbcfcbd878a5e2ed1746dc75430b7aed5fede
SSDEEP 24576:fsmjNvgp+pxECAucO9iWFT0z7rLuUhFP3MGX:PFgpAiIiWdzUz35X
TLSH
T1F9658DA0B1E78120EBF25D3255BA7B25A5793E1A0F3488CF6684787D18706D1EAFC353
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_4148_349898680\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_553892191\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_553892191\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\sq\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_553892191\smart_switch_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_716884896\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_716884896\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1518198646\_locales\ca\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ProcessHacker.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2964	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ProcessHacker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ProcessHacker.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134295856342824127"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{0CC4B7BB-4E09-4881-830E-177CC948FB5F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	ProcessHacker.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	ProcessHacker.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	ProcessHacker.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4608	ProcessHacker.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4608	ProcessHacker.exe
Token: SeIncBasePriorityPrivilege	4608	ProcessHacker.exe
Token: 33	4608	ProcessHacker.exe
Token: SeLoadDriverPrivilege	4608	ProcessHacker.exe
Token: SeProfSingleProcessPrivilege	4608	ProcessHacker.exe
Token: SeRestorePrivilege	4608	ProcessHacker.exe
Token: SeShutdownPrivilege	4608	ProcessHacker.exe
Token: SeTakeOwnershipPrivilege	4608	ProcessHacker.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4148	msedge.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe
4608	ProcessHacker.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 4108	4608	ProcessHacker.exe	98
PID 4108 wrote to memory of 4148	4108	msedge.exe	100
PID 4148 wrote to memory of 4272	4148	msedge.exe	101
PID 4148 wrote to memory of 2400	4148	msedge.exe	102
PID 4148 wrote to memory of 2964	4148	msedge.exe	103
PID 4148 wrote to memory of 2400	4148	msedge.exe	102
PID 4148 wrote to memory of 2400	4148	msedge.exe	102
PID 4148 wrote to memory of 1844	4148	msedge.exe	104
PID 4148 wrote to memory of 1844	4148	msedge.exe	104
PID 4148 wrote to memory of 3808	4148	msedge.exe	105
PID 4148 wrote to memory of 3808	4148	msedge.exe	105
PID 4148 wrote to memory of 3808	4148	msedge.exe	105
PID 4148 wrote to memory of 3036	4148	msedge.exe	106
PID 4148 wrote to memory of 3036	4148	msedge.exe	106
PID 4148 wrote to memory of 3036	4148	msedge.exe	106
PID 4148 wrote to memory of 4240	4148	msedge.exe	109
PID 4148 wrote to memory of 4240	4148	msedge.exe	109
PID 4148 wrote to memory of 4240	4148	msedge.exe	109
PID 4148 wrote to memory of 3968	4148	msedge.exe	111
PID 4148 wrote to memory of 3968	4148	msedge.exe	111
PID 4148 wrote to memory of 3968	4148	msedge.exe	111
PID 4148 wrote to memory of 4448	4148	msedge.exe	112
PID 4148 wrote to memory of 4448	4148	msedge.exe	112
PID 4148 wrote to memory of 4448	4148	msedge.exe	112
PID 4148 wrote to memory of 2848	4148	msedge.exe	113
PID 4148 wrote to memory of 2848	4148	msedge.exe	113
PID 4148 wrote to memory of 612	4148	msedge.exe	114
PID 4148 wrote to memory of 612	4148	msedge.exe	114
PID 4148 wrote to memory of 1976	4148	msedge.exe	116
PID 4148 wrote to memory of 2124	4148	msedge.exe	123
PID 4148 wrote to memory of 1548	4148	msedge.exe	124
PID 4148 wrote to memory of 4404	4148	msedge.exe	125
PID 4148 wrote to memory of 2588	4148	msedge.exe	127
PID 4148 wrote to memory of 2588	4148	msedge.exe	127
PID 4148 wrote to memory of 5420	4148	msedge.exe	128
PID 4148 wrote to memory of 5420	4148	msedge.exe	128
PID 4148 wrote to memory of 5660	4148	msedge.exe	130
PID 4148 wrote to memory of 5660	4148	msedge.exe	130
PID 4148 wrote to memory of 3108	4148	msedge.exe	134
PID 4148 wrote to memory of 3108	4148	msedge.exe	134
PID 4148 wrote to memory of 2032	4148	msedge.exe	136
PID 4148 wrote to memory of 2032	4148	msedge.exe	136

C:\Users\Admin\AppData\Local\Temp\processhacker-2.39-PORTABLE\x86\ProcessHacker.exe
"C:\Users\Admin\AppData\Local\Temp\processhacker-2.39-PORTABLE\x86\ProcessHacker.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://processhacker.sourceforge.net/downloads.php
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://processhacker.sourceforge.net/downloads.php
    3⤵
    - Drops file in Program Files directory
    - Checks SCSI registry key(s)
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7ff8451ac188,0x7ff8451ac194,0x7ff8451ac1a0
      4⤵
      PID:4272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,17147649315124617398,17889920675844288314,262144 --field-trial-handle=2312,i,5125985248482414929,950211680670093017,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
      4⤵
      PID:2400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,714346592728180769,7383154327195458286,524288 --field-trial-handle=2312,i,5125985248482414929,950211680670093017,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:3
      4⤵
      System Time Discovery
      PID:2964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2660,i,4421573058226302108,1607374301318907660,524288 --field-trial-handle=2312,i,5125985248482414929,950211680670093017,262144 --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:8
      4⤵
      PID:1844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,18332711019182956444,1332093251801494559,2097152 --field-trial-handle=2312,i,5125985248482414929,950211680670093017,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
      4⤵
      PID:3808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,2132341874332149842,12647656942355482302,2097152 --field-trial-handle=2312,i,5125985248482414929,950211680670093017,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
      4⤵
      PID:3036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4956,i,2555530781190181169,1228107117754051708,2097152 --field-trial-handle=2312,i,5125985248482414929,950211680670093017,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
      4⤵
      PID:4240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3532,i,18211474359106411728,2854726050169353354,2097152 --field-trial-handle=2312,i,5125985248482414929,950211680670093017,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:3968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5128,i,11101398333530902517,907183605773075726,2097152 --field-trial-handle=2312,i,5125985248482414929,950211680670093017,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:1
      4⤵
      PID:4448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,5499960812363730363,17508200152159337121,524288 --field-trial-handle=2312,i,5125985248482414929,950211680670093017,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:8
      4⤵
      PID:2848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,11980680635341919761,10454010809270537438,524288 --field-trial-handle=2312,i,5125985248482414929,950211680670093017,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
      4⤵
      PID:612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,17087616481700817657,740602600765926728,524288 --field-trial-handle=2312,i,5125985248482414929,950211680670093017,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
      4⤵
      PID:3516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,17087616481700817657,740602600765926728,524288 --field-trial-handle=2312,i,5125985248482414929,950211680670093017,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
      4⤵
      PID:1976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,9548898816525690701,10361715618358532409,524288 --field-trial-handle=2312,i,5125985248482414929,950211680670093017,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
      4⤵
      PID:2124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,14529660148402043823,3264783331892864776,524288 --field-trial-handle=2312,i,5125985248482414929,950211680670093017,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
      4⤵
      PID:1548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,9172895180980186782,1259681964681941305,524288 --field-trial-handle=2312,i,5125985248482414929,950211680670093017,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
      4⤵
      PID:4404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3068,i,10138016484392139115,10315111722374760451,524288 --field-trial-handle=2312,i,5125985248482414929,950211680670093017,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:8
      4⤵
      PID:2588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,15536939201541110599,16543973148176396731,524288 --field-trial-handle=2312,i,5125985248482414929,950211680670093017,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:8
      4⤵
      PID:5420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2180,i,17146777955288102642,15339300219849877168,524288 --field-trial-handle=2312,i,5125985248482414929,950211680670093017,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:8
      4⤵
      PID:5660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,8140152839204588613,15572327826482798458,524288 --field-trial-handle=2312,i,5125985248482414929,950211680670093017,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:8
      4⤵
      PID:3108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,6927749017415464596,7405839800447763573,524288 --field-trial-handle=2312,i,5125985248482414929,950211680670093017,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:8
      4⤵
      PID:2032

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

llm_user_input_extractor_config.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4148_553892191\llm_user_input_extractor_config.json
Size 4KB
SHA256 2056ee7ed0e7adb69344c93a024158ee4e2332ecd50d183dbad7595c4d588ed9
MD5 7736ccfaf720ef9b0db919dd01c4bf8c
SHA1 24b48ec2dee093b8e4384ad1e25ad8f12af0831e
SHA512 f044ed3b6fee483d211328df83f26b98dfe47890c05409c65c7f7333fde1fc043cd1c05d18250e8ee8731f355c13b3a0aedc0e60b82a26c42a7f209a69ad4781
SSDEEP 96:a0y3Cmyjw2w61skd7GZrlWqPZ96vOim87Ai:wyOy7k5rx0WVS1
TLSH
T11F91DF3BD8A15C2B00F3B225B87A7642F534A35B27C05C5B7A7C5A1C8FB6D312582F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4148_553892191\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4148_716884896\manifest.json
Size 53B
SHA256 6954daa257636bd6d9563ff3568dcd9845bf9b99e587d490da2306bf0938b684
MD5 caf17c4608f6bf58bf0d56e1e63c1570
SHA1 5cbd60bf29e30e477627bb8d094272a35a3cfa65
SHA512 92126322986cdc0ce8ea76ed1ee484b9955aa3dc061156f2e0012d9f1bd5b1583f9f2e4d9eebaa6db250c95de6b1cb44b30a4a3180a01f2724947fffbb9ebd18
TLSH
T1D59002604414951716D10E5066B0B8819391661995850D1D04451559029546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c7e7a108448e33e545ad6ca32aed6ce9cbe1e8459b8c2f23ea50a8654dff93cc
MD5 a4ca6590eed95ba00c55d32eaa843394
SHA1 89672b0b3a6644710fab2adb8e38bac4f8bb96ed
SHA512 0729d4cd5f02c0c52baa3c387fbf6c707c4af16a8f0b39faf264276e642db0f55fdf8658f26a950c8efec4984cfc6b7e8bdde07603c49caafa01d1ef3b8da4d3
TLSH
T112E02BA6D861FC2B1CFE071860094656F75113273A40495F7A3C81498FB063649C6C5C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 d100f5a05314528b0569fd59db03fceb9f11c5c99778a7487f700c47548f001a
MD5 392db65ec7a766d106c9349567eda241
SHA1 489c7f6397fa99147d86cc22b8af61d2b17745e5
SHA512 c0884f034e776d55f59f3a3a2c70f8c2225d5d93745e1f20b25e2748407c2c38ccb3657b73a078605984c0e942726e11431f7fea4bd8d4bc53f3b197762817cc
TLSH
T1C5613C35F901C878EB63037185E07E18B9B481E8FFEB5EF209A054753DC9B18435D298
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 990b7c6f60f5755b6b2c3664bfec6276e1b66aaaafdf7d7af0f0cb8b6d94d39a
MD5 a8b133ddfa97db5cda08a1dd748f358f
SHA1 f0589db18e4785771e560de786a0700623038371
SHA512 ee299edc101a227fb1a57690cfa64f717ac65b3724a2b87130471c0be224f08ef205b62b3e9fc1e314feb6e8ca8f214e34fbe4779fbffeeea6afce0e755d5ff4
TLSH
T15461CDF7C7E8C66D896157F0AA147E2BCE5D0514832C3D6AC9E5EF4BA3E2470E101A4E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 4c9257d60e3d59c8bfc2c138a0ae7da95d158da9c79d34f0809124368c717dd1
MD5 a43e9b695109dca13a33a9fe91724f33
SHA1 697b03db0ef649eb4d8d6acc708e6d3ecdffcdb2
SHA512 6d1e5df15f750507352346143fa6875a695fbd0f665fe1dc586653dac382cf079fa85b326e738905d20f1ea250a442adc99fc97600554c088582f4d2927f9e19
SSDEEP 384:sxZr7u7eG/f+YssXIazIKYavMHbm/c5oje:sT78eG/f+gXIazTUHb8cD
TLSH
T1A972E956A934597B8DD7D209FA45BF53D6F91122E2944D8899FCCB0C04E7BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 48592ed188ed76974f8cb083c89ddde88b57beef48b9fb80f78547aaad974c2c
MD5 c69db04d95c1256df7d89a8c416c24ba
SHA1 abed60cda6124bdb4ef17f4403e670f8b9855991
SHA512 c05dd8d3760a3bddac0cca9f87b52296d42b698e602404cb5b2fd1c030a653eebdcf61c7564d1843cf8dd75cb18e19f2cf95f0a7c13e3e7655d90a9d78587d4d
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvQX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEysy10LlQ:eY8Od/HEnFhWvFvQXu1jawt10Lm2NuoC
TLSH
T1CBF2FB3B6C0CCF7A4F844E9CEC2A7F8A6DE802CB5698895447F9844C02C76EB56175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 81f2625c3f8a9398b2197c4218c802ca62e0ea8f719c652bf63c86a81d268959
MD5 839c8f280e273661f5e8243bec21d43e
SHA1 5b6e436d4d56a7abaabba582ecc34889bf886219
SHA512 82182d13541c7e8e2950d3dd0fce726391d3e11d02ee3913a9f25c37036dbc4de3d9f779d28803095857517bedf88d2699f468945cc6cef79a0ba4144e35f128
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGR:05ppxnY753RNBvRJJdt7p5J91dX1
TLSH
T175B26C5A703A0212397E3988B39696364F4135A37058E4AF7FB814A54F27E225CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.18\data.txt
Size 150KB
SHA256 5f26dcaf93bdd5d99e3f6f8266c06378a2855b74daf896788becd9c3f8f47799
MD5 6465a9ebed80863ed27fef7a65fceba8
SHA1 d950817d5f1c64daf8d7eb834c5dfc3384f9ff78
SHA512 e88e87a5f4d5afbcc5fbb867e640f94d3b4aa0a435e1c79056ac54fa221ba12fe094cf5290e86e76033cf0965aac56a2a24fe5db38fc56d3f74526a3e9baa451
SSDEEP 3072:aPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEhpu4aQDo6j+UJ9:WX1aI5aZoKzMJ07Nh+QDoE
TLSH
T102E3021089C44FD9DFAC292C50BE0F1D53E1C69E842B6986D763FD4EBF9BA0496270D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 a85a8a333bb837ce6359c18d9f84979f1855cca428ade6a79d17484772d5172c
MD5 fb73d1d64a5726b77373519e0e3aa312
SHA1 a63a397e45b491ffb7e7130e9fd9bd39cb001958
SHA512 b039edaa3afa7ec50a3128c761feacb76593f83bf211fb000f94a1895f3daa56ac9496ccea3045509f32ae90a78ec47e4abe00ea0396e284bb1f579154dd4ac1
SSDEEP 384:nGiFiZcISqw3sNy8TUNTUlI4UQckCrFw+RphiftGWE3jY4GWOObjI9G6w7r+ty/l:tFQy3Hwgzkd+voGWO5GW29MJ
TLSH
T118F2D3F6A8D78977E8AE4B97637D2D0299FCC123B5884A84B7C84D0CCC960BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 b7215373630796465f175ab00fc6bd63b5dac85a13990d35cae350ce853da354
MD5 db2ed9754c192dc733232dfa3931c50f
SHA1 93c8644b7134ae8e196b20a2baf4b09232074e4c
SHA512 07dc907a0a69de773ea9c587522b5bd03fcde2c69902ccf34a1a588f46632253a59c91f98c89ca39f97e8169de10cd8f6a1529ffca91cd855ca19e6e96a15668
SSDEEP 384:npDiF9CcmyWCs3sN88TUNTUlIm2QckCr9l2KphiftGWE3jyzphe4KV8p0xHDty/8:puFccps35wgbkUgkoGWOWPI8p0hvV
TLSH
T154B26C36EC68CABBECE74F99B74A7A03DEE0527785D85AD4CAD84D4C009719C070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 2dcd18d3e84f81fff5255545bf851dbff195884dfc06eb1d3af0bc4a2aa5bcf0
MD5 298b0d10ba350998993d6a5415ceaa52
SHA1 ab1f3f409415fd441da4934b55e37fa511a5c9ad
SHA512 ae9211d1371da39cd397ea0f7dc67b8cf9d688bf60710eeb479f7fad20ac4c140bf9d68a29f6870e95fcfe8856a551afbbeb1b8d8abdff204df4622af32ac47b
SSDEEP 384:np2iF9CcmyWCs3sNO8TUNTUlIm2QckCr9JLhSphiftGWE3jYcGWe4KV8p0xHDty0:pdFccps3XwgbkURhcoGWORGWI8p0hvV
TLSH
T187C26C36E858CABBECE74FD9B74A3503DEE09263869C5AD4CADC5D4C00DB1AC470B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 3d184ba5f2b6680a0e347573e376db2a97532a2a4db70d274a58dc419b2b8924
MD5 c91a4900829ae417ded27b40f466a6e5
SHA1 8dc6784350035ea5863668e978fa9b322eb7dfca
SHA512 f14499a1029dbda930237ae28ec139c729bedf5012c52d17708a5d8bf4a61260b809173a4a49c2b42eda292154f75286bec930a7b3b612ca4ee6b12ee578d90b
SSDEEP 384:npUiFiZcIy3sNy8TUNTUlI4UQckCrY2wBRphiftGWE3jYvGWOObjI9G6w7r+ty/l:pvFQy3Hwgzkj1BvoGWOgGW29MJ
TLSH
T1CCD26B36EC64CABBEDE74F95B74A3A03AEF08163C6DC5AC8D5D99E4C00971AD0707816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 03a186ffb96f21e2ab4153b1d2a6a3a7d7453a8c6c6aeddc3fc6122ec927730c
MD5 df0487925c0a7e8b3c16f6df12a2f0ff
SHA1 ed868715f7871317a825c97a31bbb77272030f94
SHA512 419600c0db30d95afd5593e629f11e3cadd2a946473d539ccf4ba0748eae55f3a230565f022f2d1f172b77b8ca00e907c80ce436b32fc1334b0ea224dd49d8f8
SSDEEP 384:n7iFiZcIy3sNy8TUNTUlI4UQckCrFwBRphiftGWE3jYvGWOObjI9G6w7r+ty/7IC:WFQy3HwgzkdBvoGWOgGW29MJ
TLSH
T171D25B36E864CABBECE74F95B74A3A03AEF08163C6DC5AC8D5D99E4C00971AD4707816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 3ab1b87c1e625db2cedaeea5e977d771d32cbb47dfac85aa436bca73f9ed40f4
MD5 77dca84069af9e48200c71fedcc4d7d4
SHA1 3ef2db6f147d22dcb8de0a6a1210b6afc91a2b0c
SHA512 cff5362f3ddd650d64548e7d2da125ca5dad5b10c805181f91d9364d914bb058928970bc59fc2a9602a5f434bbe59f7a532cd86dc5f3e344d4062c4be0369d00
TLSH
T16E4121D15C385AD2C4BD0E7EB4DB38FC85E8D625F2E0307E6858EA944A7DA4E648143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 14f35ec7b58aed84db5865e482d1758b3ab8f73734f321dc1dfe70f8d6c41133
MD5 1e87c35fd0979dc081ee539945000f40
SHA1 7288cd61033108306bf372e20c3809496f3622fc
SHA512 b1d850e81f53efb8feabfffe937863acd33910ecf4c4c7f8bb2ad0323cd78b870a8330a459fee91325b82c0bc79a6d862d81133f717d03fb7345a671671a0a75
TLSH
T1854141D15C381AE2C4BD0EBEB49739FC85E8D725F1A0347D6898EA940B7D94E648143F
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4b95ce0d3f189c15eb9601a74de0ddd768f0fff7cf45ee1873ca2397ddbea7c4
MD5 92f91d48174f0cff107cf6fcc75a5516
SHA1 6b2741c02061f814c6b6e71e1b54a5c9c9b8b59a
SHA512 c81a6041ef1b79c17e721c7627fa4817c3edb6412855b78c7cd1e57a695c8498b13b9d60943dd1f5b3f2367a529ff27fe6dd1c7cd104cc51fb2cc2e7c966912d
TLSH
T1FE412A58BAE91114B3B76E5AABF7A86D487FB8771E17909D10010E8E4722B40C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1976-178-0x0000026590AE0000-0x0000026591AE0000-memory.dmp

Download