hxxps://github[.]com/phuber66/xeno-executor-windows-hub

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 03:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/phuber66/xeno-executor-windows-hub
Sample260810-ef2c6svvbw

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
44	camo.githubusercontent.com
45	camo.githubusercontent.com
46	camo.githubusercontent.com
47	camo.githubusercontent.com
40	camo.githubusercontent.com
41	camo.githubusercontent.com
42	camo.githubusercontent.com
43	camo.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2084	msedge.exe
1092	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308076367558666"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{9735EF26-2172-431C-AA05-80C37D74A228}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{4BAC02F6-A94D-4D80-B9EB-BF848C5D071E}	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3268	msedge.exe
3268	msedge.exe
4996	chrome.exe
4996	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3468	chrome.exe
Token: SeCreatePagefilePrivilege	3468	chrome.exe
Token: SeShutdownPrivilege	3468	chrome.exe
Token: SeCreatePagefilePrivilege	3468	chrome.exe
Token: SeShutdownPrivilege	3468	chrome.exe
Token: SeCreatePagefilePrivilege	3468	chrome.exe
Token: SeShutdownPrivilege	3468	chrome.exe
Token: SeCreatePagefilePrivilege	3468	chrome.exe
Token: SeShutdownPrivilege	3468	chrome.exe
Token: SeCreatePagefilePrivilege	3468	chrome.exe
Token: SeShutdownPrivilege	3468	chrome.exe
Token: SeCreatePagefilePrivilege	3468	chrome.exe
Token: SeShutdownPrivilege	3468	chrome.exe
Token: SeCreatePagefilePrivilege	3468	chrome.exe
Token: SeShutdownPrivilege	3468	chrome.exe
Token: SeCreatePagefilePrivilege	3468	chrome.exe
Token: SeShutdownPrivilege	3468	chrome.exe
Token: SeCreatePagefilePrivilege	3468	chrome.exe
Token: SeShutdownPrivilege	3468	chrome.exe
Token: SeCreatePagefilePrivilege	3468	chrome.exe
Token: SeShutdownPrivilege	3468	chrome.exe
Token: SeCreatePagefilePrivilege	3468	chrome.exe
Token: SeShutdownPrivilege	3468	chrome.exe
Token: SeCreatePagefilePrivilege	3468	chrome.exe
Token: SeShutdownPrivilege	3468	chrome.exe
Token: SeCreatePagefilePrivilege	3468	chrome.exe
Token: SeShutdownPrivilege	3468	chrome.exe
Token: SeCreatePagefilePrivilege	3468	chrome.exe
Token: SeShutdownPrivilege	3468	chrome.exe
Token: SeCreatePagefilePrivilege	3468	chrome.exe
Token: SeShutdownPrivilege	3468	chrome.exe
Token: SeCreatePagefilePrivilege	3468	chrome.exe
Token: SeShutdownPrivilege	3468	chrome.exe
Token: SeCreatePagefilePrivilege	3468	chrome.exe
Token: SeShutdownPrivilege	3468	chrome.exe
Token: SeCreatePagefilePrivilege	3468	chrome.exe
Token: SeShutdownPrivilege	3468	chrome.exe
Token: SeCreatePagefilePrivilege	3468	chrome.exe
Token: SeShutdownPrivilege	3468	chrome.exe
Token: SeCreatePagefilePrivilege	3468	chrome.exe
Token: SeShutdownPrivilege	3468	chrome.exe
Token: SeCreatePagefilePrivilege	3468	chrome.exe
Token: SeShutdownPrivilege	3468	chrome.exe
Token: SeCreatePagefilePrivilege	3468	chrome.exe
Token: SeShutdownPrivilege	3468	chrome.exe
Token: SeCreatePagefilePrivilege	3468	chrome.exe
Token: SeShutdownPrivilege	3468	chrome.exe
Token: SeCreatePagefilePrivilege	3468	chrome.exe
Token: SeShutdownPrivilege	3468	chrome.exe
Token: SeCreatePagefilePrivilege	3468	chrome.exe
Token: SeShutdownPrivilege	3468	chrome.exe
Token: SeCreatePagefilePrivilege	3468	chrome.exe
Token: SeShutdownPrivilege	3468	chrome.exe
Token: SeCreatePagefilePrivilege	3468	chrome.exe
Token: SeShutdownPrivilege	3468	chrome.exe
Token: SeCreatePagefilePrivilege	3468	chrome.exe
Token: SeShutdownPrivilege	3468	chrome.exe
Token: SeCreatePagefilePrivilege	3468	chrome.exe
Token: SeShutdownPrivilege	3468	chrome.exe
Token: SeCreatePagefilePrivilege	3468	chrome.exe
Token: SeShutdownPrivilege	3468	chrome.exe
Token: SeCreatePagefilePrivilege	3468	chrome.exe
Token: SeShutdownPrivilege	3468	chrome.exe
Token: SeCreatePagefilePrivilege	3468	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe
3468	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 1028	4008	msedge.exe	89
PID 4008 wrote to memory of 2084	4008	msedge.exe	90
PID 4008 wrote to memory of 3000	4008	msedge.exe	91
PID 4008 wrote to memory of 3000	4008	msedge.exe	91
PID 4008 wrote to memory of 4916	4008	msedge.exe	92
PID 4008 wrote to memory of 4916	4008	msedge.exe	92
PID 4008 wrote to memory of 4916	4008	msedge.exe	92
PID 4008 wrote to memory of 3856	4008	msedge.exe	93
PID 4008 wrote to memory of 3856	4008	msedge.exe	93
PID 4008 wrote to memory of 3856	4008	msedge.exe	93
PID 4008 wrote to memory of 3944	4008	msedge.exe	94
PID 4008 wrote to memory of 3944	4008	msedge.exe	94
PID 4008 wrote to memory of 3944	4008	msedge.exe	94
PID 4008 wrote to memory of 1152	4008	msedge.exe	95
PID 4008 wrote to memory of 1152	4008	msedge.exe	95
PID 4008 wrote to memory of 1152	4008	msedge.exe	95
PID 4008 wrote to memory of 3268	4008	msedge.exe	96
PID 4008 wrote to memory of 3268	4008	msedge.exe	96
PID 4008 wrote to memory of 3268	4008	msedge.exe	96
PID 4008 wrote to memory of 2924	4008	msedge.exe	100
PID 4008 wrote to memory of 4288	4008	msedge.exe	101
PID 4008 wrote to memory of 2924	4008	msedge.exe	100
PID 4008 wrote to memory of 4288	4008	msedge.exe	101
PID 4008 wrote to memory of 2372	4008	msedge.exe	103
PID 3468 wrote to memory of 3556	3468	chrome.exe	108
PID 3468 wrote to memory of 1092	3468	chrome.exe	110
PID 3468 wrote to memory of 4936	3468	chrome.exe	111
PID 3468 wrote to memory of 4936	3468	chrome.exe	111
PID 3468 wrote to memory of 2300	3468	chrome.exe	112
PID 3468 wrote to memory of 2300	3468	chrome.exe	112
PID 3468 wrote to memory of 1644	3468	chrome.exe	113
PID 3468 wrote to memory of 1644	3468	chrome.exe	113
PID 3468 wrote to memory of 2264	3468	chrome.exe	114
PID 3468 wrote to memory of 2264	3468	chrome.exe	114
PID 3468 wrote to memory of 5204	3468	chrome.exe	115
PID 3468 wrote to memory of 5204	3468	chrome.exe	115
PID 3468 wrote to memory of 5532	3468	chrome.exe	116
PID 3468 wrote to memory of 5824	3468	chrome.exe	121
PID 3468 wrote to memory of 5824	3468	chrome.exe	121
PID 3468 wrote to memory of 6128	3468	chrome.exe	123
PID 3468 wrote to memory of 6128	3468	chrome.exe	123
PID 3468 wrote to memory of 5292	3468	chrome.exe	125
PID 3468 wrote to memory of 5292	3468	chrome.exe	125
PID 3468 wrote to memory of 5132	3468	chrome.exe	128
PID 3468 wrote to memory of 5132	3468	chrome.exe	128
PID 3468 wrote to memory of 5236	3468	chrome.exe	129
PID 3468 wrote to memory of 5236	3468	chrome.exe	129
PID 4008 wrote to memory of 5400	4008	msedge.exe	131
PID 4008 wrote to memory of 5092	4008	msedge.exe	132
PID 4008 wrote to memory of 4100	4008	msedge.exe	133
PID 3468 wrote to memory of 3452	3468	chrome.exe	135
PID 3468 wrote to memory of 984	3468	chrome.exe	136
PID 3468 wrote to memory of 1052	3468	chrome.exe	137
PID 3468 wrote to memory of 5324	3468	chrome.exe	139
PID 3468 wrote to memory of 5308	3468	chrome.exe	138
PID 3468 wrote to memory of 5308	3468	chrome.exe	138
PID 4008 wrote to memory of 5460	4008	msedge.exe	140
PID 4008 wrote to memory of 5460	4008	msedge.exe	140
PID 4008 wrote to memory of 5416	4008	msedge.exe	141
PID 4008 wrote to memory of 5416	4008	msedge.exe	141
PID 4008 wrote to memory of 5416	4008	msedge.exe	141
PID 4008 wrote to memory of 2168	4008	msedge.exe	142
PID 4008 wrote to memory of 2168	4008	msedge.exe	142
PID 4008 wrote to memory of 2168	4008	msedge.exe	142

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/phuber66/xeno-executor-windows-hub
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffc32c5c188,0x7ffc32c5c194,0x7ffc32c5c1a0
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,11031239590562362369,5716691952237325346,524288 --field-trial-handle=2476,i,12708414161998215512,5688547697791324257,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,17434003455992747418,17862710798069370467,524288 --field-trial-handle=2476,i,12708414161998215512,5688547697791324257,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:8
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,14079608292358307388,1577690778746208978,262144 --field-trial-handle=2476,i,12708414161998215512,5688547697791324257,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:2
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,13134421385364539948,2081074620706884043,2097152 --field-trial-handle=2476,i,12708414161998215512,5688547697791324257,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,1046390785353464127,2568457413193021146,2097152 --field-trial-handle=2476,i,12708414161998215512,5688547697791324257,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,8290069227348255856,5813170625459235960,2097152 --field-trial-handle=2476,i,12708414161998215512,5688547697791324257,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,15668142711187293674,16964517325758413600,2097152 --field-trial-handle=2476,i,12708414161998215512,5688547697791324257,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:2
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,6751768921442527941,15838423760669016430,524288 --field-trial-handle=2476,i,12708414161998215512,5688547697791324257,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,7436332229330133257,14884177904872811,524288 --field-trial-handle=2476,i,12708414161998215512,5688547697791324257,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,17740245448354269552,17638314118614839334,524288 --field-trial-handle=2476,i,12708414161998215512,5688547697791324257,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,17740245448354269552,17638314118614839334,524288 --field-trial-handle=2476,i,12708414161998215512,5688547697791324257,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,11756167051004109868,4462764742601897894,524288 --field-trial-handle=2476,i,12708414161998215512,5688547697791324257,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
  2⤵
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,5094795720364085538,13961084009852347409,524288 --field-trial-handle=2476,i,12708414161998215512,5688547697791324257,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4148,i,11592960890441873512,8798365412556785486,524288 --field-trial-handle=2476,i,12708414161998215512,5688547697791324257,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:8
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2680,i,20525958627793492,18063662998702999356,524288 --field-trial-handle=2476,i,12708414161998215512,5688547697791324257,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:8
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6256,i,6371298117544449082,1819505938300877602,2097152 --field-trial-handle=2476,i,12708414161998215512,5688547697791324257,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5856,i,14405689130968779951,18387947584002140695,2097152 --field-trial-handle=2476,i,12708414161998215512,5688547697791324257,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,10387233906848953037,15978303903948575292,524288 --field-trial-handle=2476,i,12708414161998215512,5688547697791324257,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:8
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6244,i,9449030731949405330,4890388190580017334,2097152 --field-trial-handle=2476,i,12708414161998215512,5688547697791324257,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6536,i,5271879651282330440,16892964633000182660,2097152 --field-trial-handle=2476,i,12708414161998215512,5688547697791324257,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:1
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6500,i,12783546157063343301,1967822760976056028,2097152 --field-trial-handle=2476,i,12708414161998215512,5688547697791324257,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=3436,i,141076233523309019,5439545783226942686,2097152 --field-trial-handle=2476,i,12708414161998215512,5688547697791324257,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,3811589629230025335,15526860069523330158,524288 --field-trial-handle=2476,i,12708414161998215512,5688547697791324257,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:8
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=748,i,16907095304040635758,13193652755314398671,524288 --field-trial-handle=2476,i,12708414161998215512,5688547697791324257,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:8
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3696,i,5263878708654344006,5486206180286024311,262144 --field-trial-handle=2476,i,12708414161998215512,5688547697791324257,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3268

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0xf4,0x130,0x7ffc2f46c728,0x7ffc2f46c734,0x7ffc2f46c740
  2⤵
  PID:3556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1944,i,700990471960919550,16632157498902517989,524288 --field-trial-handle=2240,i,16193595944017530932,15986547724606478084,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,5781684594653566261,3701891091006269362,262144 --field-trial-handle=2240,i,16193595944017530932,15986547724606478084,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:4936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2444,i,15966647168618284004,16208299567445126878,524288 --field-trial-handle=2240,i,16193595944017530932,15986547724606478084,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2416 /prefetch:8
  2⤵
  PID:2300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,4092559916262849844,14413814491088554209,2097152 --field-trial-handle=2240,i,16193595944017530932,15986547724606478084,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3172,i,4486011443405391761,1561891137855734117,2097152 --field-trial-handle=2240,i,16193595944017530932,15986547724606478084,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4588,i,8611603771899048002,15718261840637981116,2097152 --field-trial-handle=2240,i,16193595944017530932,15986547724606478084,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5376,i,15337518623720396462,701853240897484946,524288 --field-trial-handle=2240,i,16193595944017530932,15986547724606478084,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:5532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5632,i,7820274759200798959,11684814860784662194,2097152 --field-trial-handle=2240,i,16193595944017530932,15986547724606478084,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:5824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3504,i,15094877308458282409,16583580045071193997,2097152 --field-trial-handle=2240,i,16193595944017530932,15986547724606478084,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3272,i,12560868422369778985,11096011091835380883,2097152 --field-trial-handle=2240,i,16193595944017530932,15986547724606478084,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:5292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5848,i,2827553153398220296,9933268876417854248,2097152 --field-trial-handle=2240,i,16193595944017530932,15986547724606478084,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:5132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5936,i,13846749654898137832,3671278381643343853,2097152 --field-trial-handle=2240,i,16193595944017530932,15986547724606478084,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:5236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4688,i,100714615758862539,4370224886862081228,524288 --field-trial-handle=2240,i,16193595944017530932,15986547724606478084,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4600,i,12339178954062109917,1733509033401744782,524288 --field-trial-handle=2240,i,16193595944017530932,15986547724606478084,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=240 /prefetch:8
  2⤵
  PID:984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3232,i,4534115576392080613,11845029342086836452,524288 --field-trial-handle=2240,i,16193595944017530932,15986547724606478084,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  PID:1052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3328,i,3683131214829013691,2696207228563542086,524288 --field-trial-handle=2240,i,16193595944017530932,15986547724606478084,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  PID:5308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4452,i,7782943542284345688,17719557246288738043,524288 --field-trial-handle=2240,i,16193595944017530932,15986547724606478084,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=240 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=868,i,3820849171296163652,18329517310084718862,262144 --field-trial-handle=2240,i,16193595944017530932,15986547724606478084,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4636 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4996

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5696

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

68012522-a25f-44b2-a35a-4851a02b81ab.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\68012522-a25f-44b2-a35a-4851a02b81ab.tmp
Size 116KB
SHA256 f604a01411f1b588514b0a0e6f4d8f7fe9621c7faef029f8ed3b2756b848a675
MD5 efb7d12d975b648c1779387f1d8187d1
SHA1 4bd24582d25f0deb0b9279235a1b3ae7011b8dcb
SHA512 d23f52d448faac95ab5b1fad26b2d988c77319f2460fdcf77a13e68c39a2d25229ebf00be32bef1eb8076e90c0ae5c096a69a4afb9365df9627064bc1e950747
SSDEEP 3072:VTGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMr:Vqm7Rkm1tYpBeh2BAor
TLSH
T18DC3123BAD65E8375DB9B71AB04E0A1F1DF14EA7C920DE52C8D86B0423E97DC1A48934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3f4b66cf-964a-4237-b898-7087b51ee903.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3f4b66cf-964a-4237-b898-7087b51ee903.tmp
Size 13KB
SHA256 fe25151713deb1ef21390d7da62b2445b6c5bcfbe1f165325247859131fa2c2f
MD5 87d1ddde4807403b9294c1de3c0e09b0
SHA1 57595206094cbff0d6ee540193f90733db8e60dc
SHA512 5f8629590187bdf9f61f3b62c06d30283ebd0a88ef3d2984741c01c9fc36475b2df1444cbba9bd0ff9c7eec5586d42f4cfca8f4610511d6eaf56f8f8ad2cea99
SSDEEP 192:uRpMx1Qv7imMBPRpdZVxOZ9DHsb+WNcBE4ByiDnXe3Ph2c2a27+0kwDVyIsnAUge:uRpMvMZmXRk5w8xze/h2cPwxFe
TLSH
T17052D72AF9142D776CEBD215F912B767E3F6102265E01E94EAFC992C14E79CC321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 48cea6215205269fe4a7c41acefbdb7b42ac9e6c96a843bffd7e5764f4809d2d
MD5 20e1d210ce8be2389c1de9ac60067852
SHA1 f6853929b5384e858b219b5bcd93ef732df4ebc3
SHA512 668d9cce3122f4edf6e4d3741172a2805419dcd3e2379cdd1b12bb5325a7098523bf4f451fd13701ed50361f926f7b49dcfb6d2b44b07cd49b4d53c9dbcbe2fc
TLSH
T107E02BAADA35EC371CFD176C50404746D74013573B40CD5F3A3D9109CFB5A36014581C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 6f56744a2df5e670dcd7834779f9e6cda2d0cd33af13264435ca33b6b2832161
MD5 01d66c00df93580f0d52b7c402750b8a
SHA1 0d77dd0e72d1dc4b803e5d046cff1cd108eda27a
SHA512 2f320ae0df81fed99928cade5928624c27928b3be8cdefabd3aa6268d3954e0a3bc656525953bfe43e82f0c6c0ab578800c69931d47732295963642aa9392a98
TLSH
T1C151D52598E2BD23CF7961BE0DA37FE05B12389B0343BB4B1B02AC1124535D401BE639
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 a5366e162e2444c17bc9d1160438e6d77c96af43fb69ba9472c56b815f5ef908
MD5 ab11c7d3716b097862c2062af306dc38
SHA1 1d5ff2e7ff8f345a0ad262d0fe210920da77a29d
SHA512 4d05de9fb6e2e671d7994e398b4a12af4e38ac26b9a2e769f3476f1a9fe868f36d77ba8c1bbf70e16dc415f9b1f88b25bc5acda2f940c5dabbae3df958edd865
SSDEEP 192:DqB61kIt+6WaIN7hG66y7hGMaFjg9f1VH8DKQeHxHTC:DqB61Zt+TaIN7hG66y7hGMaRg9f7H8DP
TLSH
T172E189F383E5C66D891256F0AB15AE1BCE5D0924031C3C76C9E4BE5B93E2572E20179F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 db81df21b0e383879038f7623bb176fe9283a97f67852632b61bffb65e06905d
MD5 c2b2bcff0467ad080fc04fa187826815
SHA1 ea22aa4093251b2b57824ca8871251aa03b7ad18
SHA512 12ea21b93d99847bc05bb5ce197f9ad05c24e52718489607a65a14bc21a250c3ab045a3e8369968eeffb15e8444c3140d82d897808240f11b91b7a4d50684973
SSDEEP 192:uRpMxCTv78hAPRp2ZVxz9DHsb+WNnE4Byi2cPh2c2a27+0kw2VyIsnAUgtaJ:uRpM8r48XMV5w/x2ah2cPwxu8
TLSH
T19C42D62EB914693B6CDBD219FD627763D3F6102275A11E94EAFC892C14E79CC322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2a644b4518133f5c2380165111cc4685de38c6fba206ae986fa26f852a7be57c
MD5 00a81d89c79a7a15b1bccca96559155a
SHA1 fa832913ece781b93d8f52a29b6721ce55320461
SHA512 e71e12423a2b4a9f50240ba44a918d381c251c287afb6480c82d0da515fcadf9262020cf68f1381e1c81fb328c7c4877abb84a0881c5385125980fd775ad6276
SSDEEP 192:uRpMx1Tv78MAPRp2ZVxOZ9DHsb+WNcBE4ByiDt52NPh2c2a27+0kw2VyIsnAUgtK:uRpMvr4tXMk5w8xv2Vh2cPwxu8
TLSH
T15052D62AA924697B5CEBD215FD22B727E3F6102265D01E94EAFC992C14D79CC322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5b9792c99fa5e1c616ce744d561e875aa3c483028e70c59a94c9ed9a7cbaac6f
MD5 517c19647463a76b994f4e84b56e2ba1
SHA1 25b19f83570f1262bb1ef46388707a2b9caac4d1
SHA512 01e023d45ae372edf5a3cf952ba45b9d2156399c003460afc6dc72ca00dc0c372ae6cee051e043e2ccdf7af173410d96cfad422d2d201c67ffe0a9fe63d0a3a2
SSDEEP 192:uRpMx1Tv7imMAPRp2ZVxOZ9DHsb+WNcBE4ByiDnXecPh2c2a27+0kwPVyIsnAUge:uRpMvrZtXMk5w8xzeah2cPwxJe
TLSH
T15552C72AE9146D7B6CEBD219FD12B727E3F6102265D11E90EAFC992C14E79CC3227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 7142211ff73135f4edaef7d811381e1b7d894dcd9e41e5f68774ddfbf2f114e2
MD5 3775fe815feecb94bfa552fb65b2c74d
SHA1 5cb7f67a811d4411c3beb5831b233a17ecf4914d
SHA512 eab85658f6e0662639b20744b57d42a0f5ae42c02a7b98e28e415f99fa02111ef9ec61b58c29d1290138b0f165c04ed904413a4c95fab33b1ef9d4720229d347
SSDEEP 192:uRpMx1Qv7imMAPRp2ZVxOZ9DHsb+WNcBE4ByiDnXecPh2c2a27+0kwPVyIsnAUge:uRpMvMZtXMk5w8xzeah2cPwxJe
TLSH
T19152D72AE9146D776CEBD215FD12B727E3F6102265D01E90EAFC992C14E79CC3227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
MD5 be6f9d6a2cbcb56c02708e735863c266
SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
TLSH
T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 62cd354e6a3c4d960f3a8ab34db430144df0c4f47b39dff1bd49a956d7495326
MD5 5f822bf397e8f98b0e702a05ea44339f
SHA1 893607557c87649b0551c2c6247d2120e77fef7e
SHA512 4818bb88f1b7f90ce366374ee9b41efb7a5d68575dec35f1e662ce05f744a37d48d5402e03f9cd4b6db08447267ab61ad882b3af0fa024a1fca672b341a1c6b0
SSDEEP 6144:WBX4NwhgqKR4ILo59R57lOYo8pm7Rkm1tYpBeh2BAoo:WBoNweqYhLw/7l69oBGcAoo
TLSH
T13B342372ED326BBD5C79ABAF300D1E290FF29A99D564E942C9C57A08335D9DC070893C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 311KB
SHA256 62f1aff980aca2484d8f86a68eb477b3d3f37f95e0ee0a9104f14d1e69f82f1c
MD5 681e7c476998692219c41e724afdf49f
SHA1 37f51414beb222eaa3f8ed7b479417303598c920
SHA512 c68bd2beff40e5e131a706ca3cf8adce70dd57504d2d46dd58da5f4ab9773c135f6a38099e80c679a5b4c84ee1570d70655e2bea4a61fdc2dd6981440a24fcdf
SSDEEP 6144:iDkBKFrAFOjm8QYV1YX4NwhgqKR4ILo59R57lOYo8pm7Rkm1tYpBeh2BAoo:iDrATXsYoNweqYhLw/7l69oBGcAoo
TLSH
T183642271EE776A7E6CBA9B6F30051E690EF2DFDDC568D482C8C43948335E9490709938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 d426aa167b82d73e4864b4a8e1d6a2711904479bf4f1f46d0fcd701710e3023b
MD5 403270b7056170846e2f177cd563c445
SHA1 770118cb19762961b3b1ca27eff72a8886b8498b
SHA512 f4162e09d4a2e692afb5748dab0618c4648a7d03ac732b987b9ecaca2f85d5d4d028d04586ab73374d5a9049ca57b6bc6d5b6610e65caa8d8ca7c8e26eb2c019
SSDEEP 3072:uGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:pm7Rkm1tYpBeh2BAoO
TLSH
T1AAC3123B5D65E9375D78A71EB48E0B1E1EF24AA6C930DE42C8D46A0437FA7CC1904A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 38f70ebbcf4abb4b85f1a86af356dec1776dcde876ab12e99a6c9d769fbebaec
MD5 486f0ea4f008300d7c57209e79e9f62c
SHA1 3ab76491d209a18fa6f79096191b925e83f53739
SHA512 868669a4ab5659fca5f3ae8194acd7b3de3bc2d0571471bc7064b5ef03853662087fc18b9d57c5631145d72059eb23f657692507d438be71ff6460e1c33c7216
SSDEEP 96:sg/U7Gx4IeTJmdhmgH90WeuD0WspPpt1kffOaJbD36DhUkTyUJh3o1:sSUSxbgmdnd3x0BtgZwlTpa
TLSH
T1DEC16E3865527553CFF00E3D7AD241F4B77886D8F57BAE6A0B129D723A043312F86689
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 adc796255e3dd25dc33c0f247cc47037127f3e10d5af0b31619026a65a74b608
MD5 fa13338bedec4a5b86bbaba1f6f4e4d3
SHA1 01e1a51b7db2dda5cb6229ea8d7d601c34a5b288
SHA512 0520914d99a2cec51010734c08d6536ab8db087bacc25338e18fc5f1accaaff5d549e2ce215a6e9ba6a42166c1b3912cc641d65b6564d7c134b5f0800ad94daf
TLSH
T18F4159F787E2956E8A1256F0AA18EE1BCE2C0510831C7869C5E0BE57D3F3871E10275F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 82b6e50d3e5d0ef1c19528955965fb5cbd12dd42e259eceedaf5875213889376
MD5 44adefda983451aa7c3507912f1b8cc1
SHA1 3059c5e625d90104ca752be9eaaa36e07bea9af5
SHA512 ef16804724c676aa5fcf73e883761b790aa025ebd91d9d55a51fde4ea678fdb5614c56ca5222a2c245bbd765c3311bd5ef2080037d3b24165be4cb70460668f5
TLSH
T12A5169F747F1956D9B125AF0AA18EE1BCE2C0510831C786989E0BE66E3F3871E14275F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 876f6fef2a7cf6911d5d9d5ae3496cc25eecf519bb0c122e998f1883cf1c6516
MD5 9d73e71fd0556fdc1a8b8a2e647a5e3a
SHA1 d78bcc00f8f3037ae0211b1c3682ede760114eec
SHA512 57db59d8a32903ebf1ef0f9fa7eb45939059ded5e6ee4496c4416adf0c1645265f56a3bb5fdfb3d6fe4abfc1555026618968d3bc8e8d6d1d8f75f93cdb393368
SSDEEP 192:sxZ9RCkb/fLstXkNsuIdp9QpHW6+WNYR5/YC1HCjBmIgpJ:sxZ9jb/fLstXkNs/uHba/a4T
TLSH
T1DE32B8526D28697B8CCBD219BA66BF13E2FD103195D41E58EAFCA51C04E6ADD230B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 57372ab6eb2b306503f306844cf85e62fbd5cf155cadd896e75785cf6af95664
MD5 2296423b2fadad41525b5c97eb5e0679
SHA1 b4436e7aaa95f29a0488142b523e20fba4e23cc7
SHA512 98fe64fb7eb2bda3ca6a72a3895e1a6476be4aa78215b5a68751acfdb3cea0ef99c845947849202bd225af8081d7d6991c4914ad8809a84cbce0536ec151fbbb
SSDEEP 192:sxZ9RC9b/fLs3XkosMIdpvQ0ldHW6+WNejHIAXYCvdECwBmIg5zJ:sxZ9mb/fLs3XkosVxHbWnXe4n
TLSH
T1FD42B852AD38697B8CCBD219BA55BF13E2F9503294D01E58EAFCA51C05E7BDD230B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f44aad730bdfcd09207f7fcb77789ce4bd353046b9abb68ed1266b7a4ef7a5c6
MD5 e33cd58abf69497196b0ebe32aa5b625
SHA1 990394fb864cd6624849f8e6045735934e8f8e95
SHA512 4606469f8c20c44e8039cbbf604044916dc116e923cb7c91e53e5553fbc2fdb68429dc137a4902fb524d5e136678144867e30c8f2dd472d9d4deb48b1081e71a
SSDEEP 192:sxZ9RCkb/fLs3XkNsuIdp9QpHW6+WNYR5/YC1HCjBmIg5pJ:sxZ9jb/fLs3XkNs/uHba/a4B
TLSH
T1CA32C852AD28697B8CCBD219BB66BF53D2FD103194D41E58EAFCA51C04E7ADD230B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2615fde68db24eefc02eca2ea10e1ce6d35327f4e98729330bb581333ce70a49
MD5 67d0198914a49b3d233bf54b0ed9b979
SHA1 68b029f331b774fcb6efce793c2bb3f931422d84
SHA512 da14ab98372b76b15d74042d345745c3c34cf3a4cbf3c6d3548dc10421da92adda1866226e3f8c4d2cbd4837dce2b9d873e1e2c5743bbea8e1cda5bd39757c15
SSDEEP 192:sxZ9RCkb/fLs3XkosuIdp9QpHW6+WNYR5/YCidrCjBmIg5zJ:sxZ9jb/fLs3Xkos/uHba/74n
TLSH
T15C32C8526D28697B8CCBD219BB56BF13E2FD103290D01E58E6FCA61C05E7ADD230B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 9c792f9917571ceec4af4dabf6c7e01b07eb165a25aaac5c0fcfa68519dab573
MD5 3a5fb3a67e6ca483a8aa6d8d5d600880
SHA1 7afd771029ae3d366a502deb24984ff26c16ecb7
SHA512 006c41c05195d6dbb89f5b8e499970097837fab0bd83e1ef161f16c0e43eef986a5c710b59c2163a1adbdefef13e1bb1e2d0d24887704c84e0381d001454e74f
SSDEEP 192:sxZ9RCkb/fLs3XkosMIdpvQ0ldHW6+WNejHIAXYCvdECjBmIg5zJ:sxZ9jb/fLs3XkosVxHbWnXd4n
TLSH
T17742C8526D38697B8CCBD219FA55BF13E2F9103294D01E58EAFCA91C05E7BDD220B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 3e3f67ef8611bcf53400ab98d08a4c85ee0a6dd077efe93fbcfbb2fa559d898f
MD5 a0aec02f636ec74cc74011e6b92a67ec
SHA1 882d5f7bf096c967b2bda9313f50c12bb9b493c0
SHA512 8a8cc2d49ce75c257d2f055ae4e3059982502e62e6293ca6c8ccb8a82b9e93e4feeb4c427c595379728824eeeb90738b7f74988b8a75e71fd66fca136a3543b9
SSDEEP 768:KCqbUj+WvSCs68F1+UoAYDCx9Tuqh0VfUC9xbog/OVHZLlRTKrZroY:KCqbUj+WvSCs6u1jaaZLbWrSY
TLSH
T1ABC2F83B340CCA7E4FC01E9DDD5A6F972E9802C7AB588D4447FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 48ee39382e71dfbd07690994599f5a6a2a6fafd20ca0e15966624ae5eb9734ec
MD5 a1ae556df6f3b353996032de28802c23
SHA1 09b14c29b833f1eac8f112f14744b5a48828b722
SHA512 02b7525cbe095cb87b6cc4dfefc8b39e2d51c92261d38ad5b6a156f24586748f9f4b55c3c0f472e3fb332d6c2aa6b65355ba19ac36f319565997a12152f4ad2b
SSDEEP 48:K0TQ3D5FRkhFmPIm7kKfBX5jsnTRtZkpt6PI6bkK/BH5kLz08aRz5yxoIvKx2Ept:KEIgKJB0QKp+ayoAKx2qW8K7C+g
TLSH
T12DA1670A747E12022C7E3598BAA696764FD531937014F8BF3FB9106A0E66E114CFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59287d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59287d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 8b299ce47fec68f0391429901456c455b704d6385abb55118582c95d1006d038
MD5 1481e60f396639af805a2c342b72606f
SHA1 56a0c24818d25a43cdbb504180d14ce9a38446ed
SHA512 058ad7f038d5d0bb43295ab01599482f60f83a420e780a28569bd0b748ff9320f1584376ea1d6aa4adf176527664098bd43f7d3d1f3bb5aab572fd2cace4450f
SSDEEP 384:WZcIKsNx+mKE6OEa+NOjHD6HlytEDq1UWo:EKasNaIOjHDoy6DqqWo
TLSH
T19B927D3169785C375DABA155F88B36139FFC8127A7C86AD4D2DDAF1C01DA2A8130F839
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 ebb72fe48ad1463ee3e7a414ff4a7efdb703328450cc3ea05ed1b71237a9d572
MD5 55f36ec688708110f82db23b7c59f2e5
SHA1 88bd4c4f0247482e04025123a03a72a757520fc7
SHA512 656e07745312e1c77dfe0ddd86b4d1ef2811f4b86753d91317fb8f5936af395ebe174c2e87ae3400131b80fd8ec79d3d14f7a19dd94d965228db1b85cea98ccc
SSDEEP 384:KZcIKsNx+mKE6OEa+NOjHD6HlytEDq1UWo:oKasNaIOjHDoy6DqqWo
TLSH
T1DD927D3169785C375DABA154F88B36139FFC9127A7C86BD4D2DDAF1C01DA2A8130F829
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 261b6c6e424397a628a4e0372296871c6372d0d485d7d4cc300931f50a5ab216
MD5 23219ea856f8c990c560c5190de2b592
SHA1 5d78959502ab155b185a1e8aeb9c2b72747dabe4
SHA512 1579a308a92a65d26c8f5003c68e0625b51bbbe6d3fa8cd61339913a073d7cc379c7f6a50e59474ebaa4c6cd492aa6deeaeb81b26d3c3822ef7bc09204036d04
SSDEEP 192:VONM6DbyQmiUyBHqBa+jROmDRkFNz/qQU6:VONM62qqBa+NOj7DU6
TLSH
T13A121A36697C9C775DE26554F88736139EE84127DA8A6B90D6CC2F0C01EF69C230B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 04fa1f64e8537d5a22885e5e5914e0c033e935d1bf25f5a067d4392cbe27817f
MD5 03b0631010f2adf344c6667d5982206d
SHA1 143a764abadba3c99c5433feb618203cb5445508
SHA512 8a17820bd4282cff00aeae42f29aa34ab255f94e880e23390338397ea4f9a2aade92cd5391e697c58042a7d8c2b1296e46f60ffc399b2a124029d18b9c5bb5c6
SSDEEP 384:3ZcIKsNxbmKE6OEa+NOjHD6HlytEDq1UWo:/K3sNaIOjHDoy6DqqWo
TLSH
T1E7927D3159785C375DABA154F88B36139FFC9127A7C86AD4D2DDAF1C01DA2A8130F839
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 60d86537d77b92dfe392555f0438e65213534d9c88f6ea09057910645b76ea36
MD5 94814df4028239be697bc7251d2af87e
SHA1 4d19aec80bb0c53516d73b52d013f5475742871d
SHA512 23bbabfdc2980f5d023ac72226459af4c3db093a21b2e9d87f6f196989af1bc041b1097e9282327aaeebad593b337836b5d8d62f4309c3bad6cb0f1f770430bb
SSDEEP 384:WiFPZcINUsND8TUNTUlIlbmKx6OEa+NOjTxD6HlytEDq1UWo:9FHeKwgYhNaIOjTxDoy6DqqWo
TLSH
T1BFB27E3259688D3BADBB5644F99A3613CFF84167DAD5AA90E3CDAE1C00DB19C130FC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 82d70c5771dffd9492a9ab76c331c6e2cc4597f246e5c3f3a271c01989775f33
MD5 cdd9cd69913fd1ac06831e22e0f122c8
SHA1 2d168b81ac4fbde87b0ae811262fd81b7c577934
SHA512 962295b1a8cde39e11e141a3608ed72d476f183b016df46d48eca03e1509a71a676ce5e5941dd1faa59b6d477d4e8957965ff5b117b8315ac5bcb628d11e99a0
SSDEEP 96:EqONkjQsjpf1bxX5ih/cIPURHl8h4otop5znDxBfPgvE5BzatIRdy+88OmlmsR15:vON76Db6QmiUyfHHBa+jROmDRuRgkSU6
TLSH
T1B002E835697C6C7B9EA26E48F88737276F98103BDA966B54D6D81F0C00D764C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 cb8c17664432d9824deed742e824d4554d866e0ddf4e59d69492ff63279b6363
MD5 3cf2d0eb411345cbabff3dee5bd9ab1b
SHA1 d6f71b8a296acdc9f2ed3daa96175d5494b9c793
SHA512 2bd86c6e73f46e99b8f88509a67abfbb0152f73f047587b520777a1c7656fa705405daa671dccfc77b4b157b26e73837196ad31ff21317d7510e243fc6f3ffcf
SSDEEP 384:WiF0ZcINksNk8TUNTUlIlbmKxlIezIPOEa+NOjlUD6HlytEDq1UWo:9Fy+bwgYMIezIPNaIOjlUDoy6DqqWo
TLSH
T131D219F245EB4836D9AE5747E77D2D138EBCC023B584A590B3895A0CCC961BFD30A825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6f94041f-4641-4e69-81ab-1328d749dbe2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6f94041f-4641-4e69-81ab-1328d749dbe2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7083ed4e9bcb03efd32f0df69c70c4aaedf18e0c379e4e06861794bfcc689c4f
MD5 b44635da14b4069b3878e4de98dce598
SHA1 737dbd82573c794e123f315783bd7961752f8b04
SHA512 54381ed29afb4bfcb4689f04384a910feae1d3e91d24379f2c473d61fd4f2fc146e8751c376bcfe1794f3945a1226a48eb61f8d8c86a0fb6a39f1ef1c13d8d25
TLSH
T1C6410958BAE91148B3736E56ABF6686D487FB8772E06949E00110E4F0A22B04CD71737
MD5 SHA1 SHA512 TLSH

Submit Download