hxxps://web[.]archive[.]org/web/20070202170622/http[:]/www[.]roblox[.]com/Setup/Roblox[.]msi

Analysis

user interaction
yes
max time kernel
899s
max time network
899s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 02:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://web.archive.org/web/20070202170622/http:/www.roblox.com/Setup/Roblox.msi
Sample260802-cr474abg87

Score

5^/10

adware discovery persistence privilege_escalation spyware

Malware Config

Signatures

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SRU\SRU.log	svchost.exe
File opened for modification	C:\Windows\system32\SRU\SRUDB.dat	svchost.exe
File opened for modification	C:\Windows\system32\SRU\SRUDB.jfm	svchost.exe
File opened for modification	C:\Windows\system32\SRU\SRU.log	svchost.exe
File opened for modification	C:\Windows\system32\SRU\SRUDB.jfm	svchost.exe
File created	C:\Windows\system32\NDF\{E32E631A-2639-48EA-AA5F-0CA95619F179}-temp-08022026-0325.etl	svchost.exe
File opened for modification	C:\Windows\system32\NDF\{E32E631A-2639-48EA-AA5F-0CA95619F179}-temp-08022026-0325.etl	svchost.exe
File opened for modification	C:\Windows\system32\SRU\SRUtmp.log	svchost.exe
File opened for modification	C:\Windows\system32\SRU\SRU.chk	svchost.exe
File opened for modification	C:\Windows\system32\SRU\SRUtmp.log	svchost.exe
File created	C:\Windows\system32\SRU\SRUtmp.log	svchost.exe
File opened for modification	C:\Windows\system32\SRU\SRU.chk	svchost.exe
File opened for modification	C:\Windows\system32\SRU\SRUDB.dat	svchost.exe
File opened for modification	C:\Windows\system32\services.msc	mmc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4120	chrome.exe
5152	msedge.exe
5280	msedge.exe
5496	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4032	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301107933107444"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client"	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\usercpl.dll,-2#immutable1 = "Change user account settings and passwords for people who share this computer."	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\FFlags = "18874369"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByDirection = "1"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-1#immutable1 = "Default Programs"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Rev = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\LogicalViewMode = "2"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-2#immutable1 = "Change default settings for CDs, DVDs, and devices so that you can automatically play music, view pictures, install software, and play games."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-1#immutable1 = "System"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\Speech\SpeechUX\speechuxcpl.dll,-2#immutable1 = "Configure how speech recognition works on your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-1#immutable1 = "AutoPlay"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupView = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "2"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\HotKey = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\FFlags = "18874369"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\Vault.dll,-1#immutable1 = "Credential Manager"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\intl.cpl,-2#immutable1 = "Customize settings for the display of languages, numbers, times, and dates."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-160#immutable1 = "Uninstall or change programs on your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-101#immutable1 = "Recovery"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\accessibilitycpl.dll,-45#immutable1 = "Make your computer easier to use."	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\IconSize = "48"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "18874369"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\telephon.cpl,-2#immutable1 = "Configure your telephone dialing rules and modem settings."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-2#immutable1 = "Recovery"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\DeviceCenter.dll,-2000#immutable1 = "View and manage devices, printers, and print jobs"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\ShowCmd = "1"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\Vault.dll,-2#immutable1 = "Manage your Windows credentials."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-51#immutable1 = "Date and Time"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\usercpl.dll,-1#immutable1 = "User Accounts"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fhcpl.dll,-2#immutable1 = "Keep a history of your files"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\IconSize = "48"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\LogicalViewMode = "3"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-2#immutable1 = "Conserve energy or maximize performance by choosing how your computer manages power."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Vid = "{0057D0E0-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WFlags = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\Speech\SpeechUX\speechuxcpl.dll,-1#immutable1 = "Speech Recognition"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-101#immutable1 = "Customize your mouse settings, such as the button configuration, double-click speed, mouse pointers, and motion speed."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-102#immutable1 = "Keyboard"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\accessibilitycpl.dll,-10#immutable1 = "Ease of Access Center"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-1#immutable1 = "Troubleshooting"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3844	explorer.exe
3844	explorer.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4052	chrome.exe
4052	chrome.exe
4088	sdiagnhost.exe
4088	sdiagnhost.exe
4696	svchost.exe
4696	svchost.exe
3176	svchost.exe
3176	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3844	explorer.exe
5404	mmc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
1196	msedge.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
3844	explorer.exe
3844	explorer.exe
3844	explorer.exe
3844	explorer.exe
1224	msdt.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5404	mmc.exe
5404	mmc.exe
5404	mmc.exe
5404	mmc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 5036	4052	chrome.exe	85
PID 4052 wrote to memory of 4448	4052	chrome.exe	86
PID 4052 wrote to memory of 4448	4052	chrome.exe	86
PID 4052 wrote to memory of 4120	4052	chrome.exe	87
PID 4052 wrote to memory of 4360	4052	chrome.exe	88
PID 4052 wrote to memory of 4360	4052	chrome.exe	88
PID 4052 wrote to memory of 4320	4052	chrome.exe	89
PID 4052 wrote to memory of 3944	4052	chrome.exe	90
PID 4052 wrote to memory of 4320	4052	chrome.exe	89
PID 4052 wrote to memory of 3944	4052	chrome.exe	90
PID 4052 wrote to memory of 1008	4052	chrome.exe	91
PID 4052 wrote to memory of 1008	4052	chrome.exe	91
PID 4052 wrote to memory of 1116	4052	chrome.exe	98
PID 4052 wrote to memory of 1228	4052	chrome.exe	101
PID 4052 wrote to memory of 1228	4052	chrome.exe	101
PID 4052 wrote to memory of 2472	4052	chrome.exe	102
PID 4052 wrote to memory of 2472	4052	chrome.exe	102
PID 608 wrote to memory of 2496	608	control.exe	104
PID 4052 wrote to memory of 4832	4052	chrome.exe	105
PID 4052 wrote to memory of 4832	4052	chrome.exe	105
PID 4052 wrote to memory of 2508	4052	chrome.exe	108
PID 4052 wrote to memory of 4556	4052	chrome.exe	109
PID 4052 wrote to memory of 1324	4052	chrome.exe	110
PID 4052 wrote to memory of 3184	4052	chrome.exe	111
PID 4052 wrote to memory of 3184	4052	chrome.exe	111
PID 4052 wrote to memory of 3172	4052	chrome.exe	112
PID 4052 wrote to memory of 3172	4052	chrome.exe	112
PID 4052 wrote to memory of 1328	4052	chrome.exe	113
PID 4052 wrote to memory of 1328	4052	chrome.exe	113
PID 4052 wrote to memory of 856	4052	chrome.exe	121
PID 4052 wrote to memory of 856	4052	chrome.exe	121
PID 4052 wrote to memory of 2404	4052	chrome.exe	124
PID 4052 wrote to memory of 2404	4052	chrome.exe	124
PID 4052 wrote to memory of 2312	4052	chrome.exe	128
PID 4052 wrote to memory of 2312	4052	chrome.exe	128
PID 4052 wrote to memory of 5088	4052	chrome.exe	129
PID 4052 wrote to memory of 5088	4052	chrome.exe	129
PID 4052 wrote to memory of 4332	4052	chrome.exe	132
PID 4052 wrote to memory of 4332	4052	chrome.exe	132
PID 2236 wrote to memory of 4540	2236	control.exe	134
PID 4052 wrote to memory of 4664	4052	chrome.exe	135
PID 844 wrote to memory of 1196	844	msedge.exe	144
PID 1196 wrote to memory of 2372	1196	msedge.exe	145
PID 1196 wrote to memory of 5152	1196	msedge.exe	146
PID 1196 wrote to memory of 5160	1196	msedge.exe	147
PID 1196 wrote to memory of 5160	1196	msedge.exe	147
PID 1196 wrote to memory of 5160	1196	msedge.exe	147
PID 1196 wrote to memory of 5208	1196	msedge.exe	149
PID 1196 wrote to memory of 5208	1196	msedge.exe	149
PID 1196 wrote to memory of 5272	1196	msedge.exe	150
PID 1196 wrote to memory of 5272	1196	msedge.exe	150
PID 1196 wrote to memory of 5272	1196	msedge.exe	150
PID 5588 wrote to memory of 5752	5588	msedge.exe	156
PID 5588 wrote to memory of 5280	5588	msedge.exe	157
PID 5588 wrote to memory of 5364	5588	msedge.exe	158
PID 5588 wrote to memory of 5364	5588	msedge.exe	158
PID 5588 wrote to memory of 5364	5588	msedge.exe	158
PID 5588 wrote to memory of 5724	5588	msedge.exe	160
PID 5588 wrote to memory of 5724	5588	msedge.exe	160
PID 4052 wrote to memory of 5528	4052	chrome.exe	165
PID 4052 wrote to memory of 5528	4052	chrome.exe	165
PID 4052 wrote to memory of 4628	4052	chrome.exe	166
PID 4052 wrote to memory of 4628	4052	chrome.exe	166
PID 5320 wrote to memory of 2680	5320	msedge.exe	171

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://web.archive.org/web/20070202170622/http:/www.roblox.com/Setup/Roblox.msi
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffff0f2c728,0x7ffff0f2c734,0x7ffff0f2c740
  2⤵
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1732,i,16993764756239773013,4284396730483187806,262144 --field-trial-handle=1996,i,3517229122981950582,342983977870419417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1580,i,12152460946222292422,6312643174514194609,524288 --field-trial-handle=1996,i,3517229122981950582,342983977870419417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,13372380320345015688,1830166871609492715,524288 --field-trial-handle=1996,i,3517229122981950582,342983977870419417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3136,i,17870932050379390410,158923360043722295,2097152 --field-trial-handle=1996,i,3517229122981950582,342983977870419417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3140,i,9598759668323606218,17218994932577219377,2097152 --field-trial-handle=1996,i,3517229122981950582,342983977870419417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4048,i,5652533036098710836,7518718459314823245,2097152 --field-trial-handle=1996,i,3517229122981950582,342983977870419417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:1008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5304,i,18191306336054002938,6263916698074984812,524288 --field-trial-handle=1996,i,3517229122981950582,342983977870419417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:1116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5516,i,6635402089749722822,7842751968688706270,2097152 --field-trial-handle=1996,i,3517229122981950582,342983977870419417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3220,i,5184077374785294504,6216788964349381352,2097152 --field-trial-handle=1996,i,3517229122981950582,342983977870419417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5660,i,5149292728888015873,1160068097098280800,2097152 --field-trial-handle=1996,i,3517229122981950582,342983977870419417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5464,i,8489080716741784312,12469699438467809079,524288 --field-trial-handle=1996,i,3517229122981950582,342983977870419417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:2508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5608,i,2918525772463228877,7723062283427064658,524288 --field-trial-handle=1996,i,3517229122981950582,342983977870419417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3140 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5516,i,17483088012183627144,2184042722618236344,524288 --field-trial-handle=1996,i,3517229122981950582,342983977870419417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:1324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3412,i,6113910846442473144,1534534193291036756,2097152 --field-trial-handle=1996,i,3517229122981950582,342983977870419417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5668,i,3632576220027703570,15320026306769712361,2097152 --field-trial-handle=1996,i,3517229122981950582,342983977870419417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3228,i,5718138522442020233,14657858702105096655,2097152 --field-trial-handle=1996,i,3517229122981950582,342983977870419417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5932,i,10983217667458218806,11050156359050224074,2097152 --field-trial-handle=1996,i,3517229122981950582,342983977870419417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5876,i,14151665804324962943,10074205317041968386,2097152 --field-trial-handle=1996,i,3517229122981950582,342983977870419417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5680,i,6081402581347333327,4669516198139264215,2097152 --field-trial-handle=1996,i,3517229122981950582,342983977870419417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5892,i,11889653908060329228,14911820369128592230,2097152 --field-trial-handle=1996,i,3517229122981950582,342983977870419417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=3376,i,14456934849380356153,4082944256567971593,2097152 --field-trial-handle=1996,i,3517229122981950582,342983977870419417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4396,i,9705396317095761602,12948642452153650809,262144 --field-trial-handle=1996,i,3517229122981950582,342983977870419417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1692 /prefetch:8
  2⤵
  PID:4664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4668,i,6111748068922192464,7932770454180662737,524288 --field-trial-handle=1996,i,3517229122981950582,342983977870419417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:5528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5616,i,18160940081227606415,12550164357591666848,2097152 --field-trial-handle=1996,i,3517229122981950582,342983977870419417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1532 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=4320,i,17108224186151644287,5780330103224640119,2097152 --field-trial-handle=1996,i,3517229122981950582,342983977870419417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:5400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=3188,i,6450936838242184938,2764077249324154555,2097152 --field-trial-handle=1996,i,3517229122981950582,342983977870419417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=4388,i,4211486846499842437,13785003723495298613,2097152 --field-trial-handle=1996,i,3517229122981950582,342983977870419417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:4008

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4692

C:\Windows\System32\control.exe
"C:\Windows\System32\control.exe" "C:\Windows\system32\inetcpl.cpl",
1⤵
- Suspicious use of WriteProcessMemory
PID:608
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Windows\system32\inetcpl.cpl",
  2⤵
  PID:2496

C:\Windows\System32\control.exe
"C:\Windows\System32\control.exe" "C:\Windows\system32\inetcpl.cpl",
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Windows\system32\inetcpl.cpl",
  2⤵
  - Modifies registry class
  PID:4540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault9f8f43d2hbbd9h4cd3hb11eh3f67e8141816
1⤵
- Suspicious use of WriteProcessMemory
PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault9f8f43d2hbbd9h4cd3hb11eh3f67e8141816 --edge-skip-compat-layer-relaunch
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7fffdd4cc188,0x7fffdd4cc194,0x7fffdd4cc1a0
    3⤵
    PID:2372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,3994423946076240385,1399248630906008589,524288 --field-trial-handle=2264,i,10296792353565537514,10939802941499124157,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,6497296533190295860,13134507281859265064,262144 --field-trial-handle=2264,i,10296792353565537514,10939802941499124157,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
    3⤵
    PID:5160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,13178718044842681898,15891772976516551510,524288 --field-trial-handle=2264,i,10296792353565537514,10939802941499124157,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:8
    3⤵
    PID:5208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3384,i,1875606573868604119,11933092811266036805,2097152 --field-trial-handle=2264,i,10296792353565537514,10939802941499124157,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:2
    3⤵
    PID:5272

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault6835eba9hac54h4614hb0cfhd2934d159ac0
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x254,0x258,0x25c,0x250,0x30c,0x7fffdd4cc188,0x7fffdd4cc194,0x7fffdd4cc1a0
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,2051409384177969359,15298144271970291923,524288 --field-trial-handle=2244,i,8350396637463281862,4680440014651493872,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,2283938567900845108,7665369303258794979,262144 --field-trial-handle=2244,i,8350396637463281862,4680440014651493872,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,8591455873007412802,4899144663656052979,524288 --field-trial-handle=2244,i,8350396637463281862,4680440014651493872,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:5724

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault64e4f6c8hc59ah49deh8e4ah55d4cff40508
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x254,0x258,0x25c,0x250,0x298,0x7fffdd4cc188,0x7fffdd4cc194,0x7fffdd4cc1a0
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,14704860255994309024,3076434262054786104,524288 --field-trial-handle=2156,i,8178662787357701331,5964160448943405560,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1772,i,6253022123282558312,2909131037784213660,262144 --field-trial-handle=2156,i,8178662787357701331,5964160448943405560,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,17329127023955074557,18173830492257142193,524288 --field-trial-handle=2156,i,8178662787357701331,5964160448943405560,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:1772

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5504

C:\Windows\system32\control.exe
"C:\Windows\system32\control.exe"
1⤵
PID:3604

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:3844
- C:\Windows\system32\msdt.exe
  -skip TRUE -path C:\Windows\diagnostics\system\networking -af C:\Users\Admin\AppData\Local\Temp\NDFDiag.tmp
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:1224

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:3184

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
- Modifies data under HKEY_USERS
PID:5828

C:\Windows\System32\sdiagnhost.exe
C:\Windows\System32\sdiagnhost.exe -Embedding
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4088
- C:\Windows\system32\netsh.exe
  "C:\Windows\system32\netsh.exe" trace diagnose Scenario=NetworkSnapshot Mode=NetTroubleshooter
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5044
- C:\Windows\system32\netsh.exe
  "C:\Windows\system32\netsh.exe" trace diagnose Scenario=NetworkSnapshot Mode=NetTroubleshooter
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5148
- C:\Windows\system32\ipconfig.exe
  "C:\Windows\system32\ipconfig.exe" /all
  2⤵
  - Gathers network information
  PID:4032
- C:\Windows\system32\ROUTE.EXE
  "C:\Windows\system32\ROUTE.EXE" print
  2⤵
  PID:2072
- C:\Windows\system32\makecab.exe
  "C:\Windows\system32\makecab.exe" /f NetworkConfiguration.ddf
  2⤵
  PID:5492

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork -p -s DPS
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4696

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s WdiServiceHost
1⤵
- Drops file in System32 directory
PID:3944

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost
1⤵
PID:5308

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\system32\services.msc"
1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5404

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork -p -s DPS
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3176

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s WdiServiceHost
1⤵
PID:4508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NetworkDiagnostics.debugreport.xml

Path C:\Users\Admin\AppData\Local\ElevatedDiagnostics\460911090\2026080202.000\NetworkDiagnostics.debugreport.xml
Size 134KB
SHA256 02b44e4e0d35986c40062363225051925ea78f7a3be70799c62ce12bf3064a27
MD5 cda01c6a55ae1ba43bb80617f57ca5dd
SHA1 ed22eb7062cb77992085b9a781f7ac76a973397a
SHA512 3b2c77b92b2b1dc0530a233d8d94756a7cc7d59ac2b997778d94dcdba5de30ed40a6730be448e45bc01c8de3b72f83cfc24fca51218947d37ecde4011f2a8c48
SSDEEP 384:szpiiV045i+iV0Mxx5XlPxgXuPxMXkACmv07a/RV/RB/RxGOA/zOA/wOA/5OA/H3:sN1sAj9jPQDPhcq3IsRjPQDPhcq3Is1
TLSH
T15BD3F182B94A7BD04517BF53A4B9B1C60A74F50F1196B2E949BF23D421CBA91EFD3220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResultReport.xml

Path C:\Users\Admin\AppData\Local\ElevatedDiagnostics\460911090\2026080202.000\ResultReport.xml
Size 37KB
SHA256 b16b1246a53c08e12012bf0e1b1ffe308fe921263bb21b056ea6fc5b6dd31314
MD5 8e9e7c182bc48ec0d893d77beae4b6c1
SHA1 dd9bf3f910862267bb9eef9d1b0186df18d72278
SHA512 7ca7450e8b30ec66f346e1829861373100ae337f180b2dfe62f5c3c3ad2e6ad6a7b4b8e2c7050d0a7c15ef82b024068b7a39186ed6217444ab8770920a1e7719
SSDEEP 384:sxgJiVHnVHnrVH0bapkVXNapkVoNapkVlNapkVLVH8hx1kVfhx1kVshx1kVdhx1o:sUt73yxoGyro13UIPGY
TLSH
T14903E111E57A1A40C85F13AB496CFA417E78677E12DAE18E3DEC9110658EF84FF2B342
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

results.xsl

Path C:\Users\Admin\AppData\Local\ElevatedDiagnostics\460911090\2026080202.000\results.xsl
Size 47KB
SHA256 67401342192babc27e62d4c1e0940409cc3f2bd28f77399e71d245eae8d3f63c
MD5 310e1da2344ba6ca96666fb639840ea9
SHA1 e8694edf9ee68782aa1de05470b884cc1a0e1ded
SHA512 62ab361ffea1f0b6ff1cc76c74b8e20c2499d72f3eb0c010d47dba7e6d723f9948dba3397ea26241a1a995cffce2a68cd0aaa1bb8d917dd8f4c8f3729fa6d244
SSDEEP 768:hUeTHmb0+tk+Ci10ycNV6OW9a+KDoVxrVF+bBH0t9mYNJ7u2+d:hUcHXDY10tNV6OW9abDoVxrVF+bBH0tO
TLSH
T16723CCA4B09CDF394BB5716BD8F2A582F61BCC366B356091F0FDB233029DD245622627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8aeba5db79597d653118c0f9b601f279e154af053baf76757ad4b59eec390386
MD5 32e71feac6b26ae8f7b18042055ca9d5
SHA1 3181ced4f512e095b180b10030d9308eb44c5487
SHA512 e09f7a0735ddb97837662bfefbf435f83ce7e647e191805ec86aaee4e1339f06922615cf829e5f3797063242f57e51393ffd0c6a4e8712083c4145a9bf5163e8
TLSH
T12DE02B96CC75AC771CFD172810914706EB6613162A81592F3F3DD20C8FB163E4586C5C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1d1ef610ba2fd3cbebd6720c7d476c38d639cf3b6491367ca9bee4434e02e0b3
MD5 9eec065d3192d73b2e3577d4b074c623
SHA1 d5414d8f4f06222e83491165c121851594170d85
SHA512 1e0eb81b8ecaf21c30fc16f9702baa4a1c8e2665dd882bdaa5ac0edcb2bce612b5af413a8a937947999a5ea028133625a5a2aa71cf32b550d6a6220079b2a6dd
TLSH
T163417BF793B4997E8A1192E4EB156F2FCE690524032C3CA689D46E1B43F2972D14079F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 82fcc847fa197488b4748bc5c5a19713cabdbdb6d511d924ce03f2f05c7a12d0
MD5 a488b83153af0b36e223a08ee232373d
SHA1 8a5a083c79a7a51039738a6ba58eb5f8ce99321d
SHA512 42ade928dc8f145719dbec7f44cc88afad011793fb3ac76faac98ccc47523b5ea394fbe2ba5240e350f83e6fc41bdb4f76747aef374560ccb6dadecc4c17f3fa
TLSH
T1B0418DF793B4957D8A1196F4EB156E1FCE6A0524032C3CA688D46E1B93F3872D14478F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 990ac870b8a9c47c3189947ad6fcb770a81c665ecbfdcda1b5f22f6563aeeb97
MD5 0dbbe401940722f6c5adeff3ee0b9f74
SHA1 3b2ecc2642663c1d2a26231b81a9f9e8d09182b5
SHA512 eb31cfc4a974813c2a0fac67e7ca4b1ba12837a793c92080eb3406d08f546ce0ef405bd28f84ad24525cc0da2da3f702fd9a8166d162f1f6f3aa2642c74ea942
TLSH
T1D6418DF793B4997D8A1196F4EB156F2FCE6A0524032C3CA688D46E1B43F2972D14079F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 2a96ed31b7219dda6c4a9a8ae3d967cabfabd0a696ae604e602f80ba33a91c5c
MD5 42d53038677389c6b2e7bcb524d155b8
SHA1 34f6bdb6daf605e3db83ffe5c835f97f0d09d7e3
SHA512 c597c4c85cbe7534414fa71194a1e002671453437d63b90350f1e2bf77d5bae8060eb129b8d9db3809cbcc32d540c05e3ba945b77c1c6919763cb2d44c97980f
TLSH
T13F418CF793B4997E861192E4EA156F1FCE690524132C3CA688D46E1B83F3872D14479F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 96225e77d5b6620f60c60addfa2c3ec11bf4332c6a1fafbdb198d3535a9a0b75
MD5 d03a026a8d8d082d7eb7fa4d8bbbe909
SHA1 8d38d017c840a1782bfdf5473f1e05fb08da6a05
SHA512 d0ef06b41fc0249ff1e03d15ef896f3c85b75ddefdf2881536223f3f82e0cf4e0b907b2ea3546926044765f47fed0350ee8d2c79c1805060fc5d08093e6e3af7
TLSH
T11BF05067D77EB067517D85F71D057C0E25B57431069068F5CE6A416EA0814E71B12067
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 29ef93ae255d342fc68c44fe013ecdf2333e2ba8ed17acbaf367f7241753367a
MD5 e004d19f0398510384941974971b6322
SHA1 a7426193e8b324bc2f914a3354cf913a4e9ddec7
SHA512 14b195f7dd6afd08864f93c1c99b2c36a4b342251734867074831b58146a6cfa60c0b7606ebc061c35bd933539cec23f7221fd09cdedbef225896696a7436093
SSDEEP 192:LRn8/LxzpmcDtIgv7hphPRpBQr95Hsb+WNna8PzvzIkwlvv+VyIsnAUgE:LRn8jLy89/X8rwZPD0Zv2E
TLSH
T12D52C72EF91029779CCBD21AF9167B57E7FB107225A01E84EAFC892C15EB9DC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 bc560591913405c38366e5b8e9fd6eeb17ef01abd9abb4c737ea1a469dcd19be
MD5 27c8bfcfbd2221d43c7d826adfdecbcd
SHA1 0c4307604530c32ee7b3a393885bbd0599c5f1a8
SHA512 b41f2582f1a21f1de000cdc68d87d1f6bb8f48f991c13aaac5f1d714d06dd6893773028dec2f5b7ea4c3ce89502d8d09ece70ebefb21f8afc599a21c0f6c43b5
SSDEEP 192:9Rn8/LXzpmcDtIov7hphPRpBQr95Hsb+WNna8PzvzIkwlvv+VyIsnAUgE:9Rn8jly09/X8rwZPD0Zv2E
TLSH
T19052C72EF91029779CCFD21AF9167B57E7FB106125A01E84EAFC892C15EB9DC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ad2a26d734741257adf11fe5872ab85eae062957f1d1b361c5f0413dce7fcb3c
MD5 f205d0fe2df06d7f61212652e8b225b5
SHA1 e8aee465a506824a6661bcc202fbd2bd30544aae
SHA512 0e6d8379e7add9d39f6e751ce33b270c8c0649bc6bad39a02322f61f29e5f8799ef1d70d177fb63c58d9496be3a993bfe45ba3a1888dc3e7b23902c5df36110e
SSDEEP 192:9Rn8/LxzpmcDtIgv7hphPRpBQr95Hsb+WNna8PzvzIkwlvv+VyIsnAUgE:9Rn8jLy89/X8rwZPD0Zv2E
TLSH
T17052C62EF91029779CDFD21AF9167B57E7FB102125A01E84EAFC892C15EB9DC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e61d1e978ae0f98d08901cd90dabc4a95ffb0b821447954353806ca6d593ef3f
MD5 2feab975d475ba7d51e76889dffe3942
SHA1 088e91970b598d246ad8595fe9539540b167ebee
SHA512 ce7a1836efb63cddccf25909ec24c04fe17059a02a826fe794e51965d0c815f62107fca88f564e3af45ba6a409079d664e26a2e099a2380303196920ac9ccea8
SSDEEP 192:LRn8/LxzpmcDtJBv7hphPRpBQK95Hsb+WNna8PzvzIkwlvv+VyIsnAUgE:LRn8jLrR9/X5rwZPD0Zv2E
TLSH
T1B552C62EF910297B9CCBD21AF9167B57E3FB103125A01E84EAFC892C15EB9DC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 542d5a7a897b458890a987c6a21ae3ee80ede17f23955ac71adba35f790bfef6
MD5 f663dd948df017928cbcec802859bea6
SHA1 ba666c05113b77c740af54b1962015b99d7b772c
SHA512 ea15df7c26f18e32b1dcd2859d7137057fe9d050bcdd00e2ca7318a588a312ffda64efed363bb99915434e698fc4fb557bf20c36fe531a4c2e677e71961a0b04
SSDEEP 192:LRa8/LxzpmcDtIgv7hphPRpBQr95Hsb+WNna8PzvzIkwlvv+VyIsnAUgE:LRa8jLy89/X8rwZPD0Zv2E
TLSH
T1BD52C72EF910297B9CCBD21AF9167B57E3FB103125A01E84EAFC892C15EB9DC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9eebfd2549e20a82d00049e450389862c2f4c3d63de1d0e945345979320ea3ef
MD5 e92f53816f1a30bae2435c470cd68f67
SHA1 a9efa8f728182aa3d599cdf4a8ba0dbddb38e2b0
SHA512 9fc68afcef9d9b732882471284571a8f2ba71282838b5ee3ef5fada19778bf9254c8f22d63c0129a871da407890f091538b22a0688af17f8454d81b91289372f
SSDEEP 192:LRn8/LxzpmcDtJKv7hpAPRp2W95Hsb+WNna8PBvzIkwlsv+VyIsnAUge:LRn8jLrG9UXtrwZPd0Cv2e
TLSH
T14C42C72EF910657B9CCBD21AF9267747D7FB142135901E84EAFC892C15EB9DC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 7f2c3bb0b002e4d7d49e8ebd780daefdc42e5000eb8a51c5ee9d65c53ca14658
MD5 238ecb1a3e1c98f2912f099b0b7b8a1c
SHA1 8ef41ba79237b6d6468df95cd855e11fa292bdcc
SHA512 ce27ea08a3f6036dcdccaf5606f131bfeaa96a34cb88aad7fdbbef444d0eb669f860c23142443bbec8334482763511fadcc152f5ae3ac7f75fcb910a49c20877
SSDEEP 384:Kkj+F7KxkXqKf/pUZNCgVLH2HfgsloD7pLuLcSjsNXOD+F+ErU3qsHGZ45hUeHD:Ko+F7KxkXqKf/pUZNCgVLH2HfgsuD7pY
TLSH
T16D72F9677C4C9A3B0F94C6CCEC277B4FADB6024B65E9886542FA581503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 1fe360a098badb7ce40ec7130d7d5a714c67e1b6cb06dc992067bb2702050ea4
MD5 25c4fa90db5d8d85d3fbdbc99c050ff5
SHA1 3762f88479b1b5cd50aeb5330e877911bf8cec81
SHA512 72d121bfe861e534ea912e1c0e3f9b59d644d52639169cf9825698ef4584e39749cb0695a31fd28f70a0b69811287171bed85891233610f3ba959ee134f1e9d0
TLSH
T175B0121080019141C07306B42183149C71145F10A60B170143E47A62DC257718055160
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c0ab.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c0ab.TMP
Size 96B
SHA256 0f385c0c164750b8849546a1fff29810e1672c04cdaa6a61b696138a685c4908
MD5 d19ea7d1c31bce7737dc66a73dd82b3f
SHA1 6de2f271fc2b5bd6da618cd9e9fa2450cad2dad9
SHA512 b39d2f44b1c20fa83cf82551616f4c39ca8b9ad182e42219b3c6fc33f0ff4547060c40aef7a3b206559140c0be50ca0a08aa867910625d257920a908a71fb9a1
TLSH
T179B02208C022A283C00303B020C08EEC3030CF20CE030222C3F03EA3CC203300338030
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 6a06d8f26013af5dfb5e9569a20d7c2075956a105690d1641738d98488a1f582
MD5 de6ceb0a0c8b4a009fd92e26400507be
SHA1 f8f73e53bfcab654e85d066d34a4aa1593845861
SHA512 10bdf31bbfe41c4be6e6e685493b4761d5a550d3a536d66f61d31a924661f016857215d298f974ad34bc55263c6a6373519f5bd07a3dc087fafa2c6ea5f0fef6
SSDEEP 1536:XOyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:Eqfd7NtZL8cHQRZEQ6Sps9
TLSH
T1DCC30237EBC21E335DC2CB70B9130EDBA7B644A99034D301ABBD3BBB6883495658245C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 9e7b954a033329f79c20dd32b984fa32fc69ecb46032f00b9e0dd5e242007b39
MD5 df0ed82d50d92aa9f52821bfead5452a
SHA1 eabe38b423a2b581f684c9ceb4f9a78aafcb9c25
SHA512 c7a1d5296b692918b9ecf0dc3f142d852578d4da9cf9555a1643b3f31b39bc29a50dd80c0a289e6838850a21dac75d7b9a2452a5247413a24ff2cbe5e3274c80
SSDEEP 1536:XKdyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:aDqfd7NtZL8cHQRZEQ6Sps9
TLSH
T1ECC30237EBC21E335DD2DB70B9130EDBA7B644A99034D301ABBD3BBB6883455658246C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 878ab90a656c43d2a28048456f248af6f54452687673dccf46b6d25405f454bf
MD5 678c6171c30e4a2cf32e9354b19a65c4
SHA1 083d45c8ad1d4f95ec7a1e4a5d917c693885fe36
SHA512 be964dd21043e200523b8675a6f97583d3926e7eb97d9bb50e99048cf9b73d6885acb87063852ee097553bab0febb1469ca8e36f1b5fd54d86fa0f4ca707e3dc
SSDEEP 1536:eKdyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:fDqfd7NtZL8cHQRZEQ6Sps9
TLSH
T142C30237EBC21E335DD2CB70B9130EDB97B644A99034D301ABBD3BBB6883455658246C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 cf6ce027e78952ed7138883a20eeddf1d11e648dc9a4afe069aceea5109154c9
MD5 5e6240204cb74b7e601ff3e08a98d2d1
SHA1 a99a626acd2c2757fc055c6cbc1858a2e2c55990
SHA512 4d8d7356123d5413575f1ad5bdf266b74a48eca9714a32828cae550bd85ca08a99dad3c8a3566da3b2f61e30c94f1473bf017dc56220362d261307a7362116ae
SSDEEP 1536:6AyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:jqfd7NtZL8cHQRZEQ6Sps9
TLSH
T116C30237EBC25F335D82CB64BA534FDAA7B644A99030D301AABD3BFB6C93451644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 2adcff9c3071fe08629c88761a25ac25ac5286a4d2d856730ddac0792efdd20a
MD5 ecf214a9d539236617ddb7640a8bf5b3
SHA1 99ecce0fac1f4ec6575a85e730ec85d2e816024d
SHA512 8000255c116a5576cfadaa29079835b607ae91736e92709277a5f26972ccd426990a33fdd9a643894dc3f07cefb3e8deeab4f5940dbe09d801a1cf55dab3ae42
SSDEEP 1536:XqyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:oqfd7NtZL8cHQRZEQ6Sps9
TLSH
T120C30237EBC21E335DC2DB70B9130EDBA7B644A99034D301AABD3BBB6893495658245C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 609e7d7d5cc14b50d2f35fc5b134e21737e1a8a7e0e544413f92cb672952fe0d
MD5 a1e137638ffd6ede14917ee15b512303
SHA1 ab047716c3566c6ec97c15ab78b7ea19a3a7d6d3
SHA512 d7f7b3c16ac711af3eefcecdcf6116469f1022ed3d35d6a79b88009e2bc9a60229b9d545f6292d3058b81576f6c20da488111e45d66dc9bc30fb033cf63d5865
TLSH
T133D012223E48F441DB494270D512CF453B2614A424579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

9a831b97-6f3a-4c11-8d9d-efe17cc52085.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9a831b97-6f3a-4c11-8d9d-efe17cc52085.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 326a14ecbe2205602bb751613b06b6071303e2a4834e2091b9504e25dc830083
MD5 c42a2f929f4a8228ad373191f07395db
SHA1 d19d0dd9e2c256830822c376b4abcde1bcc0bb3c
SHA512 cc2e67bef3448ffbaf14f47bc8d44144caa4527fcf2bdf45b08d1af3be3c3d42a3a4cd446f2b0cca3fbbcec4a7199a97639c51f2f73ac6585a0106e5ebed25eb
TLSH
T19E612B340B526BADFBE11E72E8E147057432D36DDA73FC2C60609ABC6107727A02611B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 4690a09475ea3acf2afc14ee0f764b62e71a7dbf3770271a312efb90f0a3f65c
MD5 3e06b5de9a6150e95b5ebbd50d77ba66
SHA1 aacee89b8a3d4d10e037a0bced8e61f8cd503cb1
SHA512 9f63e7d0daa7bf493e52fb185df25ef104833a4e733bcc85c46e6c9185eaaeeb934126c895887652a2ad741a17519361a50cb696f384ab2ee6ebca7db1ca0b63
TLSH
T1BEE0D8B594C7C15E6A5274C761ACD708C2C23497DFCAADC71B00CCC47606041B691E6B
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 ad8f0c557bce3068128d08843b911ccbf58ab7e2619bd15da653e27f53de3ca1
MD5 ee51397cffa921804f196eb8e692029a
SHA1 ad422df7411feb22be8f30edf10022d3eedc7a3a
SHA512 93230b3ce3d8ee149d51222224d6ed09d22917b5a56a610d320eeae4d8104a06835ac87af78c8854f65d98b96a8cf1a95462b51cdcca4c56f5c22ec36455e7f9
TLSH
T1E7E0D8ADE5DAC12E695234C7616CAB48C1C034C3DFC5ADCB5700C8C4770F001B641E5E
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 513B
SHA256 388c5c95f0f54f32b499c03a37aabfa5e0a31030ec70d0956a239942544b0eea
MD5 c92eabb217d45c77f8d52725ad3758f0
SHA1 43b422ac002bb445e2e9b2c27d74c27cd70c9975
SHA512 dfd5d1c614f0ebff97f354dfc23266655c336b9b7112781d7579057814b4503d4b63ab1263258bda3358e5ee9457429c1a2451b22261a1f1e2d8657f31240d3c
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 f76ecb6bbbc9ba1b3ddc2126178dfed9a7a1233a3ecfd5f4e3da4edf8572f77e
MD5 cbf1aaa6f2dc9e01d04b4a62507e62ac
SHA1 69d2ea6a5f420acc75a1488562850aecf2dcb353
SHA512 6ab02fca9dbbe8109edc5d400c799f26e03ce2598310ab95f22d892b2a840ab4f82f999f49e9bbcb0f1df0fa09f1c9490e1a54532ab87edf7ac52bb1cc8d791f
TLSH
T1A4E026B884C8C13E9457689BD6ACBB0C9BE0341BBEC8398627089C447242241A2C77E4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 ecd6d4fbe7b0e932b12a95ecfc7834596cf4f00166249dccdd08965b2ecb46d4
MD5 c3730930b9554a060510df9fb2dffb2c
SHA1 69c5f2cd6024ed00e49b8af7aab7e27b91d6313c
SHA512 b05cd7da89c0467efe84b1785adc8d163e58b8f41cd8ca7ddf30f0d22d820e66e5d47d5ad8d9fc2e0880177e035a051b238b51fa625e84d0f80c36f6474e3532
TLSH
T1A4E02054C5C8C11A54AB649B52AD9F4886D03807AFC43D855B0BCC84A101581F3C5754
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 4f9dc90cb5e68a9648d7c1c2fe5bdbf7a7861c748377ea7217bd2c1fea4572df
MD5 8a7bc27e1429175c80350c0d807d84da
SHA1 1bb927b5e25d73afd0140fde62a5d69319584299
SHA512 140f99bc7d5915262c15c271d081b60d675a861344979eaa0a944879e3f7b82785a893e6956618af2450d818c41b9e8083129754576ef14e06837dd7d317e41a
TLSH
T131E0D8B284DDC15A5547208F625CAF48C7E03407DFC9BB8A2F059C84B045144F6826E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 99352408cf32f0446a90604d5623e64b95c94a5d6b128ff915f23db5e8aec80a
MD5 2aeedac0be7ac07f1256455efea6fbbe
SHA1 de81f99dad26e8984b5bd73b4798b19a961e727c
SHA512 bbe3358b193ca18b0fa331341d9ff16dad0a66232792f1a67bcfd20718c1e76ea701f38d761ffd86e492de4a8e89fbbd2bb977a98e9b7847e567a4a96d188042
TLSH
T10CE0D8F987DDC16B768A344B6258BF08C7F03847DEC96F851B489886B10A004EA956D5
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 d3b297a9bd67bb2de622e68df7adf0d1c3990cb9d49574472ca7ec2fc6726629
MD5 f528c21c676614685f411f6bd5c6585a
SHA1 cb3c0e4ce41363dc83fbfa4b8e914d00f8bfa365
SHA512 742f8a83e5a547a4235dcfdc1b2df47bbc09e7467ed8534974159d8c315e04e3994ef6abdcaf69fb447f66154f20eb6e96bf377767e73e440a31c6d692981ea5
SSDEEP 96:sa2YqiEDWaERscUb91on06cwdHW+i046W6hfuH9EOx+WVoMfm+uecpYQjnK+gt+Z:sxfubs67rpMHW6+WNGYLExhgOJ
TLSH
T1FEF1D8526E28697B4CCBD11DBB267B53E2F6002165C51E4CEAFCDA1C059BACD230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 3e004be3acc19d33fcf63a1364505b7cc3a079602c291f15a8eb1771cdf3a748
MD5 e842dce69d82c73c3b6f18f3fe6e1251
SHA1 9d4fa2debe5f5915075ff5f3fd7143dd062932d3
SHA512 c34a847008ae4ecdb0f4489edf6d076aac205ee6cc9d961c18c72c6f3597e43a2d624e70e6d5261c86e5b8733ba75018ba1be18a8565ee51c43bf2304f25f3b7
SSDEEP 96:sa2YqiEDWaERscUbD1on06cwdHW+i046W6hfuH9EOx+WVoMfm+uecpYQjnK+gt+j:sxfubsE7rpMHW6+WNGYLExhgOJ
TLSH
T1EDF1C8526E24697B4CCBD11DFA267B53E2FA002275C51E4CEAFC9A1C0597ADD230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 26KB
SHA256 9db6fc27070a68b225d17ba87b92ba4c4f10813516cfad706f14fd66a614349d
MD5 74a6743b731d7903f929cf7e3b0d7931
SHA1 b37e2bf44ffb2c820ab24ff794d4b28027ad547c
SHA512 68e4b2d031dfdacbf04e878ecf0355ec23683093320c7ce4d5e96418c591c1094212b3a787603dc39e3bad96fee9c9d419a41b9b7038b1eaa6451ee4f0f31a5b
SSDEEP 768:wHO6fP1Wvxz3j8F1+UoAYDCx9Tuqh0VfUC9xbog/OVkILlWwJb5ro6y:wHO6fP1Wvxz3ju1jaZILIsby6y
TLSH
T117C2F93B240DCB7E4F801A9DAC5A6F977E9802C7AB588D8047FE954C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 d0f5efa471850e3d591cae0e6fa02d0c9925ac49dbb0b37fb65444782244cea5
MD5 732f539839a26fdc12ddddb4c9f0bd55
SHA1 0f4bd31c3f505387a42723e7739bcd5b89522572
SHA512 6263e163f17f38b69c5ae35cd69d1cf3892b7ded3ac2686f7960fbb21180a0e945e3a4d5829bd3c8921f98ef762b488234a78d9d943d4db3fe5a828c9b81e4c2
TLSH
T165E0262449C9D27E7057604B92A8CF08C3E4B40BEFC83DC66F40CC486287905B5D6AD2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 677dfbb88619fcfa018c14c7562aa3dc295395185c394a278b7ba83ad605986b
MD5 38b5b1acf15f235952469889029e9991
SHA1 861e3d8bebda88f3126a7713887218dca4e851c5
SHA512 ee7e18b7209855a237e8a2b25ca533e80612aa14d3ae5a3b752018cb7399ba50f413545d67a315e561d0b2da48652042ee90881ee3c5f9b79fa66dfc8238b039
TLSH
T145E026A0A7E8C17EA097206F12EDDB0882E47407DFC83D86AF02DC46B146504F2E2690
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 509cd46495aa28542cba1cc7079ea73c62dc519e9ac4941857a2d271a83a923a
MD5 ab23d956b947f3856b898d458f05d330
SHA1 9dba7d68aad3b1b4118748e128ec69a23087fd5d
SHA512 a43c877e92b512e83443c79a1dcf58785ea8e3e5ddc85943f1d75bc9551dc56a7647ef505f206d81fb6b8856a876f9c9f64438f2ff7ff2a328f636a49753703e
TLSH
T1B0E0D83055C9C72B61C7208F625CDF0CC2E2F40BDFC869D53B09D844620A180F243655
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 4c580f035c6ad36b43ae8823c3abc66edea156fb28bcf1e8a7b60a2e3418fb68
MD5 27a06facf4a260265bcb0db256837c4b
SHA1 eb0054df52ae6eacc5a8b774acb75977f9a66ea3
SHA512 eaf0ddcac6ed0dc55e713d687be33b5f94cd640c24ef9a1e9b225887b7c0e5c8f7f49c96af792e26d835f3eee45002d60e06c8989d9f3760198b9620480b0222
TLSH
T14FE0D83456D9C67F6187209FA368DB0885E27413EEC8A9962B08A488630B140B2877A0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 69551f4e9904191443a74b91f241c57bb2f710bf735f4a7e6d4d74ebfe0ea991
MD5 d2465f42940e53b8de68ee078e0826f1
SHA1 6043fbd04e6049b25c66219169eb11ca252ca5fe
SHA512 1f18c8510173cea7489d557a0956629a6d0b4c30bc3d4d95b75f3ca29f91405e3d51fa9d4ad27b3e27e56c6f06bd62eb76e15e2558183779e96466281380305f
TLSH
T104E0867085D9C73E6547609B52ACDF0C86F0F84BEFC87ACA6B088844A105554F6A6A9A
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 79ccbce2867387cfcaf97b52536db03610b955bea0fad05faa1165c3c6f126d7
MD5 6f2eb31bd588ecb13d9a9231ae35d3a0
SHA1 35316b301e1088fe0c3bfc7b38f1d4a57c163227
SHA512 dee81fea2c82411eba9ae471f0e71ad9c8ea173e99e82e7bdc456420b7d053ddcc2388f10a88dd3e4c6223966a1ef950fdb5779beb7f441875b6b86d850666a9
TLSH
T14CE0D8B499D5C23B95C1708792A8DB0CC3E07807EBC5798557084845630610072A96D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 a08f766868f31bd662f8d9b5707decbba50642025df34b8bd620d95f9f293cbe
MD5 f89be632165b16d10301dab3bb5d4d17
SHA1 6fc9e80bb150e373e00c86a48e70099e7320045e
SHA512 72d320dbb747aae5d42c460d7ed2fd18c8642283aeec731cf715a3eac991b67e5a08e1609920788403276ef341f0b6abeb376a1ef35d0d00b098a13275bc7e3e
TLSH
T13AE0DF26A8C8C16FA497308B71A88708C2C43803FEC8B98A6B00848AA206500B686791
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 663a0c4b41005f2b45585a158130db5199be3ad622f15e2185465837a30970fd
MD5 43a9d5fb4ba55835300743baed9d6341
SHA1 38d5ff6901351f7b5ee65b1625a5fb8923fac752
SHA512 982655aacf55c04b2ad69f0d98404981d7a335a79f4f2aefb7839123a75e6b708f06087f53fbb2890a23b81f07b2e877d6124895d472a0ca0fc0b2b5629a448c
TLSH
T108E02024D4C4C15FF5A7208F21DC8B0882D03503EFC43DC91F01C8886106100F67B661
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 42d4613cd17f89f3f56f33ad634fa6119140a2985e3940895fce9e380b5593ac
MD5 75705af61f4333de83685bdd3aa79f62
SHA1 7b4e6f7ac6e2bd52975c137850ca00f26a92b9f2
SHA512 fb2d1f8b0a1dfaadfb1d4ca8e1955fd93e34867ff1d12d31ee71ecfa9802aa1799bda6ea7c8749fc41a3e5ac06914532f288438cd890b5538c6282373964f94a
TLSH
T121216896F335C14AE645423A243F9B210334E4028FF9EC0F447668242F72F440E4B2E5
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 f7d7bbbdd867bffc425b72256196308d6d81d66adbdf76e7c3dafe98b57fde1d
MD5 f08282ff38eebf35ae43b587ee5ea292
SHA1 4728cc9903cc34eb1d7ca25228c88f88730389ac
SHA512 81085ec65e5a218e6f790462e888d6f4e3b2a2af2d198e7824e1f573d6b5a9a44b7a0a36c1b78a7b0644e6dafbc606c0e4a2e7580f16c57e43441e5fb76f1666
TLSH
T1B9212296F335C14AE646423A643F9B210378E8028FF9EC0F44B668242F72E440E4B2E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 40e95992a34606460b28f2539da5a308ec611dafe2543e926d1f0dad7261b808
MD5 d99aa5ecd473212d91e3bf761911b0d5
SHA1 6cc218cb702a77292846fdd1694da9a02a3e85e1
SHA512 9b8960bc05684b586d7e060089f45f14499cce53f056b9324d38b650473836fabdae65c745ceb1fa358c2c9cc940d5a7f49a1b7cd559a9c77c7a3852c0bf0442
TLSH
T1D5E0D824B4C4C35F90A3208B12ACCB4883D23803EFC42EC51F058CC99205141B76A655
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 365a13f566f8b926a9a73cf915610cc4b7371072be32712045355aa7643d2b16
MD5 ce7fbe130ba79d71e9d7a8a4d64c1cff
SHA1 d99cf2821fa3ea88a597bfbd50e6ce667e4479e6
SHA512 e8f6ec0fa64f4a97db3960a8c526c6a9de420c9d2300ce4f8850a0ee32c04e481a14a444dca0bda53e0259afd985db6ec3a4a9d6831ebc3c6d6fcd655232435c
TLSH
T11DE0D874E8C4C16F5093308761A8E748D3D13807FEC87E851F008C8962061417686691
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9a3ee6d5eda761e5ba7816510bdd3a6aeb94af4201d2675d14b5d57d65fbe52a
MD5 c42c8c725b98d13ab661da7272ecf9dc
SHA1 738e7ef9a5929d32bbce1bc1a17315ccc7d7a85a
SHA512 7eda80af44f0e2faac9eaec9f237d6692388dcc4a13241e4d5256aa173c4b83d61442cbb4f48b71dc72bed3af4f3b12da5ca5b4c11c4b58e57e5c78d4166ecae
SSDEEP 192:qONQ6O7+3hQmiUy7tGttb0IO25h2sgGrv1U6:qONQ612Gt91O+MCz1U6
TLSH
T14402E9346C386CB74EF3AE45B68737279FA5112BE9952F84D6E81F0C00DB65C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 a63f94170e8991997805a01d04903eb961f894224b44a30eea09d648cda449ea
MD5 ee7477c6db8b9301df79446d77db2704
SHA1 5749ff46db1fc125070951548d797f499bda54b9
SHA512 0c7eb5db65ee099bcaecbc6beee03c1b053cc1250dfb57de64dcd6f6dc51a6ac701613dddde54016856319fc0d80235635d499325635a1549fd2f5f4f63ea3ff
SSDEEP 192:zisNFVO7+3vUQmiUy622atb0IO25h2zMZF0SJr1cMUSqiuUO:zisNFV9km2a91O+MzozJr7UzUO
TLSH
T13D120934A8289C7749E7A105FA8737679EB9107BDC862F44D5D85E0C01DB69C374AC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fc23f1a1d148752de49233ae80497b5b7eb055fc5e08af1b6c81344d68e9d658
MD5 cc1b9ff5f4f2d47d8772ccfa21b405a1
SHA1 5871c107c19e87220698a7ac5b685dc1ca76f780
SHA512 ee2b27aaa4d6b751934dbead47c4a62bc699312a7033fa27b9e17407b9e50e1c59b31b8ccd7637322db3c21cab57f1ea1cbb99fb54f591ba331285f6b38beb2a
SSDEEP 192:6ONE6O7+3eQmiUyNt2ttb0IO25h2zMZF0SJr1cNHqiuU6:6ONE6YW2t91O+MzozJri4U6
TLSH
T1F8121934B8289C671DE7E105F98737A79EA5117BEC862F40E5D85E0C01DBA5C378AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 b56c124999dea520125d30fd2bb406da06111ae6f0a475b098a3a65da9419696
MD5 764424e5a34ddb1de382995ea18b284b
SHA1 5c83be48f3ac9ad5967d993be56450ffe95ce90e
SHA512 03182cb788244ffd8dde2dc22e0f88f2c853c0c1989c1c8d4c7afe86bef81608756affe8d90211e2a1c3ea53e803d43bd6e3f78a62c414ecff6d454568ccb4f4
SSDEEP 192:zisNFVO7+3vUQmiUyx22atb0IO25h2zMZF0SJr1cMUSqiuUO:zisNFV9kB2a91O+MzozJr7UzUO
TLSH
T1CF120834A8289C7749E7E105FA8737679EB9107BAC862F44D5D85E0C01DB69C374AC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 8c552cff34b24cebd755ce2125f43c1c4bbd15352ae80e951419e52c62dfa3c9
MD5 22e2c17fcdad607ddff1b4887cb193b0
SHA1 a9cead61c634f288f081c7540168b1ff4fdcbcce
SHA512 3eeee53529708271b0776b607ef61089671da38f588bab760d80ba106a9de983e12bb16f25fafb653541a7e87a1647839d4ac8a3282fbccfc80929965ff292fe
SSDEEP 192:zisNPVO7+3vUQmiUyJ22atb0IO25h2zMZF0SJr1xNQqLFUO:zisNPV9kx2a91O+MzozJrdDUO
TLSH
T189121B34B8285C779EF39A46FA4737279FB9016B99962E80D9D81E0C01D7A6C3346C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 51f0b9fa897fd66e5a3654ff7a562406fd54f0c100aa56344b743734a246ae8e
MD5 4bd415bd9ce127cdcbddf894943b28ac
SHA1 8ffe9f6dc25d09493fec3d0f0e7a0549f44cc035
SHA512 7c0d43033c09928482c1aa62ff72b1602b459f01ea633c2c5ee7b3a8671f0d3692e8dda543e4d7e57c1dfd38aa023e6b8cef4236c237a30537afea9197721e74
SSDEEP 192:zisNPVO7+3vUQmiUyJ22atb0IO25h2zMZF0SJr1xNIqLFUO:zisNPV9kx2a91O+MzozJrdLUO
TLSH
T1B1121B34B8285C779EF39A06FA4737279FB9016BD9962E80D9D81E0C01D7A6C3346C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 bc1a47d25f653a74e3a9d0c3f3850410e9fa2cf895183fbb817583003ccd5fe2
MD5 ed0ad7a7c4c6dc2c37fcbc7e719a6207
SHA1 75a29b3b43175aeb0afe858954595008de9c45c1
SHA512 c4ec57c76b8f1cd03a71c9e2b7a562706e3e3e42efe882113553bf42ee0cbfada133b99ba3ffe0667637562c56257d7fecbc2a5b4c7a76e6bb262494fc4ec550
SSDEEP 192:zisNtVO7+3vUQmiUyw22atb0IO25h2zMZF0SJr1eqRqLTUO:zisNtV9kE2a91O+MzozJrnKUO
TLSH
T1E4120B34B8285C779EF3AA45FA4737279FB5016BD9962E80D9D81E0C01D7A6C2346C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 5cd2c4d9f13524923046198c92213691539407e04fa520cdae9eade1bad3d91d
MD5 e9e365607374115b92e4abe4b9628101
SHA1 d5054ea9b22317dca83801eb3586017bfcc0e2a8
SHA512 a84d65ed53e43883e5ecb7848fbd48f5305a63e6975e6af480cf85532879720061106be54f2a5888ebc3569f7123081a0e6eb48ccb8d7dba3e1da1c8a3c50401
TLSH
T151A012078473800AE4144051C49C024114A4804A0219D0015060932314A40CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

bbe8912c-ca45-4de4-94eb-029e1c19cbb2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bbe8912c-ca45-4de4-94eb-029e1c19cbb2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_vu4rnhsg.lvp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vu4rnhsg.lvp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

DiagPackage.dll

Path C:\Windows\Temp\SDIAG_0e6cdd60-63d7-47ff-a60e-18a744307d4d\DiagPackage.dll
Size 478KB
SHA256 5b7aa413e4a64679c550c77e6599a1c940ee947cbdf77d310e142a07a237aad2
MD5 580dc3658fa3fe42c41c99c52a9ce6b0
SHA1 3c4be12c6e3679a6c2267f88363bbd0e6e00cac5
SHA512 68c52cd7b762b8f5d2f546092ed9c4316924fa04bd3ab748ab99541a8b4e7d9aec70acf5c9594d1457ad3a2f207d0c189ec58421d4352ddbc7eae453324d13f2
SSDEEP 6144:0ZC0lEOC2Us6eEyAc0jbJYOjlCLHUZQsxjuaJ7oSEvcdfSc0jbJYOjlCLHUZQ:0ZFLUe6vJ/wLIvavyfEvJ/wLI
TLSH
T189A49E8BA6848DF0C72A0674C42BCDF04E267C76DC11772E6B99F66F4CB2291644B71E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagPackage.dll.mui

Path C:\Windows\Temp\SDIAG_0e6cdd60-63d7-47ff-a60e-18a744307d4d\en-US\DiagPackage.dll.mui
Size 17KB
SHA256 8be175e8fbdae0dade54830fece6c6980d1345dbeb4a06c07f7efdb1152743f4
MD5 44c4385447d4fa46b407fc47c8a467d0
SHA1 41e4e0e83b74943f5c41648f263b832419c05256
SHA512 191cd534e85323a4cd9649a1fc372312ed4a600f6252dffc4435793650f9dd40d0c0e615ba5eb9aa437a58af334146aac7c0ba08e0a1bf24ec4837a40f966005
SSDEEP 96:+mbJmdYVotzW1xcFjPe/dQTVOd5RLQ9/5HgVqz+4MLRvTLGlyQzwv7KCbVeog3+S:+mx1xyexdXeoR4gsgKvHWlTWn
TLSH
T1AF727901A3F90618F2FB7FB46DBA56654D3ABCA6AD38D28D0504005E59B2E90CDB1B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E32E631A-2639-48EA-AA5F-0CA95619F179.Diagnose.Admin.0.etl

Path C:\Windows\Temp\SDIAG_0e6cdd60-63d7-47ff-a60e-18a744307d4d\result\E32E631A-2639-48EA-AA5F-0CA95619F179.Diagnose.Admin.0.etl
Size 192KB
SHA256 9042289d58565c1052dea323f259c020e1819757cd272347e8a7e926390fe584
MD5 34d288c0422373853ccfce99fd2803ce
SHA1 39a863c62588347528f5041ad4bd4514e3fc32b3
SHA512 bbbe10079aa136f4c63a0bdbfa0529b18b9748fdbd416aa0f6f0f884db9a6dc0770de73d5e3819d01b65c28bf3e977f0204fcf9e735104a787629bb036fd1f5a
SSDEEP 768:bnY+lRZ5ZIDBMing0GdBMh42w9c32eDiEqyVOvfs731TxWYvAdED9d08d6HRncb+:x
TLSH
T17514FED0D6964105EB3B0F72BDBA330268737E811A3BDD2A055CB72958765ACCE23F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetworkConfiguration.cab

Path C:\Windows\Temp\SDIAG_0e6cdd60-63d7-47ff-a60e-18a744307d4d\result\NetworkConfiguration.cab
Size 1KB
SHA256 69ca0845f7cb77a04daa45865461341849573cc93b490ee1eadb5842873fdd28
MD5 4303761761488e27c6f9f61b5d6e1923
SHA1 e1e8e2104607d20f51c98e217398823484bc9be0
SHA512 0bce8de977e9dbce81405e5b000d3a0227081fe8bf5e0d7e7ddbe3704e5c29b15005330ffd5df1a500eb3a1184a2b3068ec9030f66ca39e7b374c432ddbf7b7d
TLSH
T14D1118229E900DA3D4226FB958C8EB0D2B0414E3F0EC85C242FD70C2CCBC2D10E5A879
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3176-989-0x000001760A920000-0x000001760A921000-memory.dmp

Download

memory/3176-984-0x000001760A9D0000-0x000001760A9D1000-memory.dmp

Download

memory/3176-983-0x000001760A9E0000-0x000001760A9E1000-memory.dmp

Download

memory/3176-981-0x000001760AAE0000-0x000001760AAE1000-memory.dmp

Download

memory/3176-980-0x000001760AAF0000-0x000001760AAF1000-memory.dmp

Download

memory/3176-986-0x000001760A9D0000-0x000001760A9D1000-memory.dmp

Download

memory/3176-954-0x000001760A9D0000-0x000001760A9D1000-memory.dmp

Download

memory/4088-848-0x000001A1922D0000-0x000001A1922F2000-memory.dmp

Download

memory/4696-925-0x00000238CF970000-0x00000238CF971000-memory.dmp

Download

memory/4696-939-0x00000238CF4C0000-0x00000238CF4C1000-memory.dmp

Download

memory/4696-942-0x00000238D9050000-0x00000238D9051000-memory.dmp

Download

memory/4696-937-0x00000238CF4C0000-0x00000238CF4C1000-memory.dmp

Download

memory/4696-936-0x00000238CF4D0000-0x00000238CF4D1000-memory.dmp

Download

memory/4696-934-0x00000238CF8A0000-0x00000238CF8A1000-memory.dmp

Download

memory/4696-933-0x00000238CF8C0000-0x00000238CF8C1000-memory.dmp

Download

memory/4696-932-0x00000238CF8A0000-0x00000238CF8A1000-memory.dmp

Download

memory/4696-931-0x00000238CF8A0000-0x00000238CF8A1000-memory.dmp

Download

memory/4696-929-0x00000238CF8F0000-0x00000238CF8F1000-memory.dmp

Download

memory/4696-930-0x00000238CF8F0000-0x00000238CF8F1000-memory.dmp

Download

memory/4696-927-0x00000238CF8A0000-0x00000238CF8A1000-memory.dmp

Download

memory/4696-857-0x00000238D9100000-0x00000238D9101000-memory.dmp

Download

memory/4696-924-0x00000238CF910000-0x00000238CF911000-memory.dmp

Download

memory/4696-923-0x00000238CF920000-0x00000238CF921000-memory.dmp

Download

memory/4696-853-0x00000238CFA40000-0x00000238CFA50000-memory.dmp

Download

memory/4696-850-0x00000238CFA10000-0x00000238CFA20000-memory.dmp

Download