6fc5627c81cca20ec365d76448db252d1ec7b5be22a4b7e12591114825a4b75a

Resubmissions

21/08/2026, 01:33

260821-by2j4sel7y6

21/08/2026, 01:30

21/08/2026, 01:27

21/08/2026, 01:22

21/08/2026, 01:19

21/08/2026, 01:16

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/08/2026, 01:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f2c90af9-428e-7373-5565-52ecb4ff11ed.eml
Size 17.9MB
Sample260821-brmglszena
SHA256 6fc5627c81cca20ec365d76448db252d1ec7b5be22a4b7e12591114825a4b75a
MD5 8c4a567f22efc5c9ec7ab8733ac0dc2b
SHA1 7edeaa22a24db994ef55f2bc63ae363d17dc1b38
SHA512 0ee06831004584ab905683b8472de80cf55058ccbe1651eacece1d851b958bef0072f6302e08564ae798a82e6d626989f7d8308b237ee12a0eaba2ecfaf87432
SSDEEP 49152:QsPtxugLWnmHAvLEufdmoGRRwkscUpZl/XGE3dStoyZ7ey7EdLRqY2K93ksm+JeM:e
TLSH
T182171234C572CEAB154162FF991634C8ACB877EF099D92F7237A8B72F0A1CB0D225549
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3480_865177273\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3480_385835119\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3480_385835119\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4904	chrome.exe
4204	msedge.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317489977368943"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e8005398e082303024b98265d99428e115f0000	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	OUTLOOK.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OUTLOOK.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000cb8fa53b1ae3dc01a21821fb26e3dc01938b40c10b31dd0114000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	OUTLOOK.EXE

NTFS ADS 9 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\20260819 Hearing Bundle.pdf:Zone.Identifier	OUTLOOK.EXE
File opened for modification	C:\Users\Admin\Downloads\P Skeleton vF.pdf:Zone.Identifier	OUTLOOK.EXE
File created	C:\Users\Admin\Downloads\P LOA vF (bookmarked).pdf\:Zone.Identifier:$DATA	OUTLOOK.EXE
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\GL32O1SL\20260819 Hearing Bundle.pdf:Zone.Identifier	OUTLOOK.EXE
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\GL32O1SL\P Skeleton vF.pdf:Zone.Identifier	OUTLOOK.EXE
File created	C:\Users\Admin\Downloads\P Skeleton vF.pdf\:Zone.Identifier:$DATA	OUTLOOK.EXE
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\GL32O1SL\P LOA vF (bookmarked).pdf:Zone.Identifier	OUTLOOK.EXE
File opened for modification	C:\Users\Admin\Downloads\P LOA vF (bookmarked).pdf:Zone.Identifier	OUTLOOK.EXE
File created	C:\Users\Admin\Downloads\20260819 Hearing Bundle.pdf\:Zone.Identifier:$DATA	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3592	OUTLOOK.EXE
3592	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3592	OUTLOOK.EXE
3592	OUTLOOK.EXE
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
6304	chrome.exe
6304	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3592	OUTLOOK.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
3592	OUTLOOK.EXE
3592	OUTLOOK.EXE
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe

Suspicious use of SendNotifyMessage 41 IoCs

pid	Process
3592	OUTLOOK.EXE
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe

Suspicious use of SetWindowsHookEx 34 IoCs

pid	Process
3592	OUTLOOK.EXE
3592	OUTLOOK.EXE
3592	OUTLOOK.EXE
3592	OUTLOOK.EXE
3592	OUTLOOK.EXE
3592	OUTLOOK.EXE
3592	OUTLOOK.EXE
3592	OUTLOOK.EXE
3592	OUTLOOK.EXE
3592	OUTLOOK.EXE
3592	OUTLOOK.EXE
3592	OUTLOOK.EXE
3592	OUTLOOK.EXE
3592	OUTLOOK.EXE
3592	OUTLOOK.EXE
3592	OUTLOOK.EXE
3592	OUTLOOK.EXE
3592	OUTLOOK.EXE
3592	OUTLOOK.EXE
3592	OUTLOOK.EXE
3592	OUTLOOK.EXE
3592	OUTLOOK.EXE
3592	OUTLOOK.EXE
3592	OUTLOOK.EXE
3592	OUTLOOK.EXE
3592	OUTLOOK.EXE
3592	OUTLOOK.EXE
3592	OUTLOOK.EXE
3592	OUTLOOK.EXE
3592	OUTLOOK.EXE
3592	OUTLOOK.EXE
3592	OUTLOOK.EXE
3592	OUTLOOK.EXE
6712	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 4088	2296	chrome.exe	94
PID 2296 wrote to memory of 4904	2296	chrome.exe	95
PID 2296 wrote to memory of 1816	2296	chrome.exe	96
PID 2296 wrote to memory of 1816	2296	chrome.exe	96
PID 2296 wrote to memory of 3056	2296	chrome.exe	97
PID 2296 wrote to memory of 3056	2296	chrome.exe	97
PID 2296 wrote to memory of 3232	2296	chrome.exe	98
PID 2296 wrote to memory of 3676	2296	chrome.exe	99
PID 2296 wrote to memory of 3232	2296	chrome.exe	98
PID 2296 wrote to memory of 3676	2296	chrome.exe	99
PID 2296 wrote to memory of 1960	2296	chrome.exe	100
PID 2296 wrote to memory of 1960	2296	chrome.exe	100
PID 2296 wrote to memory of 3432	2296	chrome.exe	102
PID 2296 wrote to memory of 3432	2296	chrome.exe	102
PID 2296 wrote to memory of 1968	2296	chrome.exe	103
PID 2296 wrote to memory of 1968	2296	chrome.exe	103
PID 2296 wrote to memory of 2268	2296	chrome.exe	104
PID 2296 wrote to memory of 2268	2296	chrome.exe	104
PID 2296 wrote to memory of 4540	2296	chrome.exe	105
PID 2296 wrote to memory of 4744	2296	chrome.exe	107
PID 2296 wrote to memory of 4744	2296	chrome.exe	107
PID 5080 wrote to memory of 3480	5080	msedge.exe	110
PID 3480 wrote to memory of 988	3480	msedge.exe	111
PID 3480 wrote to memory of 4204	3480	msedge.exe	112
PID 3480 wrote to memory of 3704	3480	msedge.exe	113
PID 3480 wrote to memory of 3972	3480	msedge.exe	114
PID 3480 wrote to memory of 3704	3480	msedge.exe	113
PID 3480 wrote to memory of 3704	3480	msedge.exe	113
PID 3480 wrote to memory of 3972	3480	msedge.exe	114
PID 3480 wrote to memory of 3832	3480	msedge.exe	115
PID 3480 wrote to memory of 3832	3480	msedge.exe	115
PID 3480 wrote to memory of 3832	3480	msedge.exe	115
PID 3480 wrote to memory of 228	3480	msedge.exe	116
PID 3480 wrote to memory of 228	3480	msedge.exe	116
PID 3480 wrote to memory of 228	3480	msedge.exe	116
PID 3480 wrote to memory of 1328	3480	msedge.exe	117
PID 3480 wrote to memory of 1328	3480	msedge.exe	117
PID 3480 wrote to memory of 1328	3480	msedge.exe	117
PID 3480 wrote to memory of 1460	3480	msedge.exe	118
PID 3480 wrote to memory of 1460	3480	msedge.exe	118
PID 3480 wrote to memory of 1460	3480	msedge.exe	118
PID 3480 wrote to memory of 5152	3480	msedge.exe	121
PID 3480 wrote to memory of 5152	3480	msedge.exe	121
PID 3480 wrote to memory of 5264	3480	msedge.exe	122
PID 3480 wrote to memory of 5264	3480	msedge.exe	122
PID 3480 wrote to memory of 5704	3480	msedge.exe	126
PID 3480 wrote to memory of 5704	3480	msedge.exe	126
PID 3480 wrote to memory of 5712	3480	msedge.exe	127
PID 3480 wrote to memory of 5712	3480	msedge.exe	127
PID 3480 wrote to memory of 5636	3480	msedge.exe	129
PID 3480 wrote to memory of 5636	3480	msedge.exe	129
PID 3480 wrote to memory of 5636	3480	msedge.exe	129
PID 2296 wrote to memory of 5912	2296	chrome.exe	130
PID 2296 wrote to memory of 5420	2296	chrome.exe	131
PID 2296 wrote to memory of 5436	2296	chrome.exe	132
PID 3480 wrote to memory of 5648	3480	msedge.exe	133
PID 3480 wrote to memory of 5648	3480	msedge.exe	133
PID 3480 wrote to memory of 5648	3480	msedge.exe	133
PID 3480 wrote to memory of 5896	3480	msedge.exe	134
PID 3480 wrote to memory of 5896	3480	msedge.exe	134
PID 3480 wrote to memory of 5896	3480	msedge.exe	134
PID 3480 wrote to memory of 6076	3480	msedge.exe	136
PID 3480 wrote to memory of 6076	3480	msedge.exe	136
PID 3480 wrote to memory of 6076	3480	msedge.exe	136

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\f2c90af9-428e-7373-5565-52ecb4ff11ed.eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3592

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff93dbec728,0x7ff93dbec734,0x7ff93dbec740
  2⤵
  PID:4088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2156,i,11341337463398498487,13955161449494813522,524288 --field-trial-handle=2172,i,11425610414223068966,8946368271606177107,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,2141712012744431819,16093266385038071068,262144 --field-trial-handle=2172,i,11425610414223068966,8946368271606177107,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:1816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2432,i,4171841525070839004,15316593011014703152,524288 --field-trial-handle=2172,i,11425610414223068966,8946368271606177107,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:3056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3272,i,14541372653881490025,18218293078085340787,2097152 --field-trial-handle=2172,i,11425610414223068966,8946368271606177107,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3128,i,17944775757899820598,2510482255812055681,2097152 --field-trial-handle=2172,i,11425610414223068966,8946368271606177107,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4352,i,9082882777353733794,8203613524911915730,2097152 --field-trial-handle=2172,i,11425610414223068966,8946368271606177107,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4368 /prefetch:2
  2⤵
  PID:1960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4772,i,8226476998343653702,7880073040085858097,2097152 --field-trial-handle=2172,i,11425610414223068966,8946368271606177107,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4908,i,15687908668662171352,339825605744638240,524288 --field-trial-handle=2172,i,11425610414223068966,8946368271606177107,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  PID:1968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4916,i,15348078012382195307,2199569973094148162,524288 --field-trial-handle=2172,i,11425610414223068966,8946368271606177107,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,14979573240491874950,17721822716988455662,524288 --field-trial-handle=2172,i,11425610414223068966,8946368271606177107,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:4540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5796,i,1481218674526110575,17389454181780603968,2097152 --field-trial-handle=2172,i,11425610414223068966,8946368271606177107,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3484,i,3592226239128384568,911372861383163857,524288 --field-trial-handle=2172,i,11425610414223068966,8946368271606177107,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3140 /prefetch:8
  2⤵
  PID:5912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5916,i,10203052247148722877,4386358811556929305,524288 --field-trial-handle=2172,i,11425610414223068966,8946368271606177107,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3560 /prefetch:8
  2⤵
  PID:5420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3564,i,12127244752885860134,14559195916704497991,524288 --field-trial-handle=2172,i,11425610414223068966,8946368271606177107,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3128 /prefetch:8
  2⤵
  PID:5436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1204,i,7134703717770727984,8123798956698197006,262144 --field-trial-handle=2172,i,11425610414223068966,8946368271606177107,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3484 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6304

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x260,0x7ff93765c188,0x7ff93765c194,0x7ff93765c1a0
    3⤵
    PID:988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,7106285551796243554,9452102120823724904,524288 --field-trial-handle=2952,i,12011694596007218511,2980957773641623057,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,3604608049113811884,14015900365665515608,262144 --field-trial-handle=2952,i,12011694596007218511,2980957773641623057,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:2
    3⤵
    PID:3704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2232,i,16338425268854020186,3324608488713104550,524288 --field-trial-handle=2952,i,12011694596007218511,2980957773641623057,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:8
    3⤵
    PID:3972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,16634178847348642171,12117660922277455324,2097152 --field-trial-handle=2952,i,12011694596007218511,2980957773641623057,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:3832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,4997301668133676556,12991039672234684214,2097152 --field-trial-handle=2952,i,12011694596007218511,2980957773641623057,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,15285419087565843271,3179743034563905139,2097152 --field-trial-handle=2952,i,12011694596007218511,2980957773641623057,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
    3⤵
    PID:1328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,11518787675420548357,7972596435874385117,2097152 --field-trial-handle=2952,i,12011694596007218511,2980957773641623057,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:2
    3⤵
    PID:1460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,11475049334152333469,17046773342451048027,524288 --field-trial-handle=2952,i,12011694596007218511,2980957773641623057,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
    3⤵
    PID:5152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,14494120109830778700,5627018068139732402,524288 --field-trial-handle=2952,i,12011694596007218511,2980957773641623057,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
    3⤵
    PID:5264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,14696465044361787484,8487667465564396036,524288 --field-trial-handle=2952,i,12011694596007218511,2980957773641623057,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:8
    3⤵
    PID:5704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,14922505106538529316,15445251471568829461,524288 --field-trial-handle=2952,i,12011694596007218511,2980957773641623057,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:8
    3⤵
    PID:5712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6136,i,12295081892254816024,12528653582875290566,2097152 --field-trial-handle=2952,i,12011694596007218511,2980957773641623057,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:1
    3⤵
    PID:5636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5296,i,8590289458454164790,15919578647848288483,2097152 --field-trial-handle=2952,i,12011694596007218511,2980957773641623057,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:1
    3⤵
    PID:5648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5060,i,8028865050748112496,73430327173320950,2097152 --field-trial-handle=2952,i,12011694596007218511,2980957773641623057,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:1
    3⤵
    PID:5896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6352,i,3501001429840217882,17325651080984233384,2097152 --field-trial-handle=2952,i,12011694596007218511,2980957773641623057,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:1
    3⤵
    PID:6076
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,14318508411404690677,8641029643616745235,524288 --field-trial-handle=2952,i,12011694596007218511,2980957773641623057,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:8
    3⤵
    PID:5160
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,14318508411404690677,8641029643616745235,524288 --field-trial-handle=2952,i,12011694596007218511,2980957773641623057,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:8
    3⤵
    PID:5140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6864,i,16061052411641253746,2730126382265923833,2097152 --field-trial-handle=2952,i,12011694596007218511,2980957773641623057,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:1
    3⤵
    PID:6396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7100,i,802441619834669699,13216209453784634263,524288 --field-trial-handle=2952,i,12011694596007218511,2980957773641623057,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:8
    3⤵
    PID:6672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7276,i,10637283169038695132,7844405181245169514,524288 --field-trial-handle=2952,i,12011694596007218511,2980957773641623057,262144 --variations-seed-version --mojo-platform-channel-handle=7328 /prefetch:8
    3⤵
    PID:6740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7112,i,12379112192832042039,6845159349450324857,524288 --field-trial-handle=2952,i,12011694596007218511,2980957773641623057,262144 --variations-seed-version --mojo-platform-channel-handle=7672 /prefetch:8
    3⤵
    PID:7024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7668,i,5848457797406575330,13768559123825816972,524288 --field-trial-handle=2952,i,12011694596007218511,2980957773641623057,262144 --variations-seed-version --mojo-platform-channel-handle=7680 /prefetch:8
    3⤵
    PID:7032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,1669332055490014268,2447319899556550051,524288 --field-trial-handle=2952,i,12011694596007218511,2980957773641623057,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
    3⤵
    PID:6372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6712,i,12831894107048107390,6045566047661569375,524288 --field-trial-handle=2952,i,12011694596007218511,2980957773641623057,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
    3⤵
    PID:2940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,945112201166768771,1952537148268649604,524288 --field-trial-handle=2952,i,12011694596007218511,2980957773641623057,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:8
    3⤵
    PID:3044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,10618236853931777045,1734351123721551532,524288 --field-trial-handle=2952,i,12011694596007218511,2980957773641623057,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
    3⤵
    PID:5608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,11885593585609843198,5529104442533660470,524288 --field-trial-handle=2952,i,12011694596007218511,2980957773641623057,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:6712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,7937482081860598353,14232013810679356470,524288 --field-trial-handle=2952,i,12011694596007218511,2980957773641623057,262144 --variations-seed-version --mojo-platform-channel-handle=7648 /prefetch:8
    3⤵
    PID:6648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,11923173431272338988,8604003496528449926,524288 --field-trial-handle=2952,i,12011694596007218511,2980957773641623057,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:8
    3⤵
    PID:3472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7680,i,5286422947351041903,9126765591627931668,524288 --field-trial-handle=2952,i,12011694596007218511,2980957773641623057,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:8
    3⤵
    PID:6256

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3480_385835119\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3480_865177273\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 9b515137f1305e41817db1ed03ff0ae67c806483371aa5ef47f3428ec88a35f5
MD5 fac6b4aa5fd644e432e7dcdcdb9dd203
SHA1 a65f0d4a04e757b656a59a627ef67818402579ca
SHA512 69c852094f0a09b4fb0ddcc7954908fae6482496891adf6cbfe89f257f6e794ec8cd54a7a669e3120b9057bc3ecf50493908461e162f3285a5665acc977d488b
TLSH
T1FBE02B69C821AC3708FD4F1850640646E750135B2B81561F3A3D9108CFB0A2A41C6C6D
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 312KB
SHA256 0b6251fd38152a7a7319d54a8e993417dfe359650a9581c135c3950fe5704861
MD5 932d4b5eb7460fda1f102de6f7149790
SHA1 fadbac31c043b89a72bf3abf502f9ee53ccbf86c
SHA512 eaad89143b37482972189a3ff86698a7ae3332c42248d177fc74e0ec6aa9e1756a0699cb77d3b83cd815e2651df267c0cca4e9866d7a59a26d0dbeadb060189d
SSDEEP 6144:Y87U1JYBYrHsCcjPUrsgrwz9Ot6mjoSF7SI/5Czsl/sfz+IeJqJi:REJYqaQ8QN7p5Cz0jqJi
TLSH
T1786423C8B9A7916BD9F3FEECE0C64958B3FE733433C684798421915B87122D882E45D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 f0653924e28dedd9991c3af35dc313cfc9a9d757b456c27497f85ef65ab936f0
MD5 9e485755d7b262a73f93ce8ac771248f
SHA1 b6b5d7598dbbb515c84743bc76694d8c78d9a6ba
SHA512 794f55a582ef1f8b78a51804737cd1eb3c6c0a1e0e15f369ba1dc24a99080f97f73bfb1bf301bf6f82eb55f9f5d52816e9a1c354665df04d17cdbc0cda8e5f2f
TLSH
T13BC09209668416CECBE4A6F214A5A59872306E6721620763D1E212F886B37A1A26A101
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 fa19bd50ef2466c33f5ed5e90cc9d73cf074616ea120f5cb5ab71a657e8aec3c
MD5 74251d28e1fff94a9fbf34d02b658704
SHA1 4a062711011aa8fab239077dfe907db9a47844b2
SHA512 17647be9be2bddd7e2bdbd817f41f0f4f5d6cbf94f4e793026a2614c1e53a8c64bc040d0cac1cbd021de6ca7b4a5eb41f91b0dfffb450dec8885cee66ec6e8fd
TLSH
T1F8B0120212C00281CB9046F10862A16430306D6A2122034381D045F98773AA0603D841
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 a3d0663802a8c9fe854e3cadd700c30f24be32f628e1eed969f8a06b8f71a740
MD5 9a99fd20fe66f8f42a5a0816e4996ebd
SHA1 2c97c0a01f780fe65ee17d99cf89d0dd98979d7b
SHA512 49a1272dea9979f2150979af00c560163589bf6fde765ced386e194b15962901f0339e7688eac40f12d02ffbdf86e7aec51135796cc0e49365875a7919cc8e5c
TLSH
T1A481ADF7D3E8C52DC91156F4AB156E1FCE2D0914432D3C6688D8AE9B93E2872D25074F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 056073f53c8f21491ec770d6ffc3c2185871a42a44ae11fd1310a5cdf98facc2
MD5 caefcd01c809e1c673800c2acd76ebef
SHA1 d7e11aa2110e2891a06243447599d14694c22681
SHA512 607c968e6dabb4d423a4edcf40e10aef3e37c90967a7702b0ea49bd215fbe74ef63c1f3808cd41d3353f26bfd27f3c10a847f1d338b3e8dfebb193094501ffc7
SSDEEP 192:+Ra99CRFQWpJnv7spAPRp22mTi9wHsb+WNnft4Z/2egykwG2VyIsnAUgtaJ:+Ra9eCsvYUX/DKwVW27yl8
TLSH
T14752E72EB918693B5CD7D229F9227717D7F5113121942E94EAFCC92C14EB9CC322741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 23e3a7a7233295f506b8f16c824e32fd60ef194a8a9b92175739c5c66a302b5d
MD5 f3e0a8ac618e4e793b1260c8cba6634e
SHA1 cb3cb60154aecfab601475553b826b989250a6d4
SHA512 422c3ac6c5c24ccbb62c823f9cf22a0eb2f09b5e40cf771e98612424405a3df533b7806466e9af513b898a6a0ca2743fd242f0f7cba7ca6fcccc1da54441d054
SSDEEP 192:+Rx99CRFQWpJnv7spAPRp22mTi9wHsb+WNnft4Z/2egykwG2VyIsnAUgtaJ:+Rx9eCsvYUX/DKwVW27yl8
TLSH
T1AE52E72EB918693B5CDBD229F9227717D7F5113121942E94EAFCCA2C14EB9CC322741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 84159bde6098fd32d2b292d1ce7bbb314d2f46e15b8e6ac04f5f1ef184f400c0
MD5 2e9a8e87da68ff5737059369b02f22e5
SHA1 81ac5c877347d437a036ac16bb53d05591b60f56
SHA512 522af424c7955e1767606e2b82fd5f5a9482a825fad16e7ee5d488a13632d245f499677bcca78878c33b2b327c9ddd8776a60f2c69baf35c2f518b468dfd0d8b
SSDEEP 192:+Rx9SCRFQWpJnv7spAPRp22mTi9wHsb+WNnft4Z/2wgykwGYVyIsnAUgraJ:+Rx9RCsvYUX/DKwVW2ByLe
TLSH
T18952D72EB918693B5CD7D219F9227B17D7F1213121942E94EAFCCA2C15EB9CC322741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 379d96542283773f422c052abe7293924621df1604b63c9a59676e1514d2db6c
MD5 d066f854d368cbebca026e5da297c2c3
SHA1 4f2f84d54b0a8dfd273bbdb70bcde51ad5e2f12f
SHA512 613285c6b38983d33fb336394c5eff7edb692f60dfa433defdbf45524dd1c84cadfc8cba744a39b1c75482b318f7db6eaaae9842cfa8649a9ad00cece8442e41
SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcSjCDXODUr+ErU3/NHGcmyqOqjmo:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pF
TLSH
T15A7209676C4C9E370F94C6CCD8267F4F9DB5024B65E9886483FA9C2903D5ACB114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 4e1e1eebab7295990f124d27c8ecec84d66ff77c0a63af134ea8fcff5c2f3f6d
MD5 af88e090606c3ef78b50f59d06631cdf
SHA1 41367fd7125a56d4ef029eb56f77647147598f6b
SHA512 3de6b30c80aefd661d619a476ad76145395655c3998a9e327b20bb4f4caceb665ead9174706b04343d99b23b40beb0cee14e31d653314dc92ab4a50e47a7b5b4
TLSH
T14CB0125080415112C04202F5225214DC71249F24960A170543F0693AC835590C065151
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bbc9.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58bbc9.TMP
Size 96B
SHA256 d55d73d19b54250eed4c99c609d50461dd4c49d1e97fe648c996f73e3b652e70
MD5 df6365371781b252249642269ab2db9f
SHA1 b854025534e13ba89568e4bf7be2f52413fa89ec
SHA512 e4cc74dfba796de2c7647bcb3330447a1b912312b2de376c25a2ff81c4dd4ad00ee90574cd807f6beb52c8cc30b412e12469d91228b239a85b35e63fac786514
TLSH
T17DB00295D5036623C04203B02DA599D97171DF2AC6132217A7E59ABADC29A604635A64
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 ecf8b8df18280abc26e5d465e9e8179ea1654e2282f19e7dbbd755a18f07db6f
MD5 0a0ba5cc2f5dfe07c670b0b078769b12
SHA1 df88c8899a7a4d245caf111e42fc319f4a4ecec9
SHA512 960c32c2cfb98507b09695050830810fd5d290969cf2896d2298ba6c9b4717f1105f765c1fe24e36e06926ce38228023afdc7ae74467ee6cded688c6d0f9c963
SSDEEP 6144:AFKtHW9O7g7M3HUMkXLBEWm7Rkm1tYpBeh2BAoH:cva+ih9oBGcAoH
TLSH
T1C63412376E1CBC724EF8FB2E9119291B0DF2D7F28635C9AA94D48604B3D9A852D05E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 ded24164e7c55e00c3a5828e1bbe2d8f0af3ac8c3b537baa06b903374ec07048
MD5 14a6790fba7e701d9cae1f6179237517
SHA1 f222119b39d5e296ea639a40a48e48c7ebdf5b01
SHA512 1912f396fe9dd82147a448b09aad2052b16cd53b6be55095e731915dd36eee0c7493f7e4ba93a86531265a0bc56866a51c8e83057a92b956dba0bf365747d6b4
SSDEEP 3072:nGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:Gm7Rkm1tYpBeh2BAoK
TLSH
T1D2C3123B5D75E9779979B70EB08E0B1F1EF149A2D920DE92C8D85A0437EA7CD0A04D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 b9fe043a41a6df0065c574fe666a2afeb0993bd0ddb12cc975799e4f0eac8260
MD5 089db56efe5107af59ceb19b33e4f79a
SHA1 bfabb1e9320b52afac3399b941d43ba293771063
SHA512 8c92e9f2c9a74004f83b6f55b3cfbc3624ac4e5b669df6ce95a8997d3f1b299831bda849645c1bac1d3d200e794e67070e6a64b2dd2a47249f4d3a68965e15be
SSDEEP 6144:fKtHW9O7g7M3HUMkXLBEWm7Rkm1tYpBeh2BAoH:zva+ih9oBGcAoH
TLSH
T1AA3412336E1CFD724EA8FB7A61691D1B0DF3D6F14636C9B685D0C604B2E4ACA2D05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 068bda006c6097655c5046cc17c25212928e9544be1078522fee3fc0cb864733
MD5 94d092e3e963dcadf946920e1d167f94
SHA1 aaf6121acc2025a09bd4224e7053c7196eacb9a8
SHA512 f49d6f89814989855883c5b15a58eafc3714d411235ba28e449bb27004ef0666f5c42aa3b2034dd9191a09af4ed8571167673c3486fe52ab8b2f5c6f3a5c9cc6
SSDEEP 6144:4KtHW9O7g7M3HUMkXLBEWm7Rkm1tYpBeh2BAoH:Cva+ih9oBGcAoH
TLSH
T1953412336E1CFD724EA8FB7A61691D1B0DF3D6F14636C9B685D0C604B2E4ACA2D05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 d1d3eb04b1c5c4181c32e26d6d7b6f8be19bc61c815f26a7c098c9e4e370d1fe
MD5 e57b7e0201dc4e6bdcf41db27ae070fe
SHA1 01301e6c72a932641ed230eafd156088f717e0b8
SHA512 aab525816cd3c2def56fe81c423de0424a6f877b6a38079d1e4121efaac3b83a8c8c4da5f481df8857a8f4399cce6bbffa5652658b4ed03a819b2a273bb43caf
SSDEEP 192:cK9A2ex3QZNaCBTXIYGG5/8Iq72s1gBM1mHa:G2S4TenRz
TLSH
T116F1963524DA9469DFCA4D73C8F22E8C313751E1F0171F0B262789766A277C9F86042D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 d6a370cf6ff8ae3da44db6ea308b69e82b1cc01fa2317882eb09537b8d0e6585
MD5 2089f77ee9f2d72af78e8058cbe11fdb
SHA1 6891075c80822793fc7c4bd5b5bf4ee74efd7c03
SHA512 abb86ef61d229cb1097f6aa96f3989132349c688dbd0ec4761de8a68731872ffc7b43c728a379c208e94bbad184d9c329b82600b519ff7e0efaafef90306832a
SSDEEP 192:nG7A2Mx3QZSaCVyXDYGg5NEInx72s1gBM1mHY:r2U4MycNRB
TLSH
T15602943524DE946ADFCA8D73C9F22E8C313761E1F0171F0B2A2789726A277C5E86042C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 d9011670119f647dcda6785142a7af3b10ca7c0e79fad074517d05dbe4b78c04
MD5 120d18018f5225e404926558c85a1228
SHA1 021b55ce8c1db34a66e98f0c8eae796e597f89c3
SHA512 5236091e2fba2559ea0b2bd76684d66101be102ac5d58f6945d18e7d105b7df560b4bab8d5d4384a9c000b3fadc451cfdded7b71027620c8bd14350085752d9a
SSDEEP 192:D1NeRj283MFgJl+taGiLnac75adtl3igQ/PhV1kMegQYZ/R/+/taXiUlFBt:D1NeRj283MFgJl+taGiLnac75adtl3if
TLSH
T12022AFF7C3D8862DC801A2F59F287E1FCE2D095462683D5689D4EF8BA3E5472E24164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 fc918a8d696266ada2462e0c1d886b22f9af720841d755fe12062cf060d21514
MD5 28640f6a58fc5a397a6cbcd19f9abe12
SHA1 c9e79901385318692d1e335e2552eebfacbf48bc
SHA512 1fb5d14922d2c40ec6b309ebe38c0903b2a0d0fa3633dcd99c8b26e1fdf82182c63e62313773059e43c7dd2562e8f2fe5fdb37d7b9862ebb94cb6bfe4e257dec
TLSH
T197D023731180707B559C7FC6557BECCFC32700104883DDD510D0E4DC553186CC507141
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe591c87.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe591c87.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 2ede439eb5a47ff7c379657135fcdd9fe791b4ee64a46842bba1961203cbb0eb
MD5 0b82a26194aa7efddb0859e27cc763b4
SHA1 bf810384481d0d1518d5b1cfdc6628d1db049d4f
SHA512 4df2769b16c07ab8dd2cd782c2c7c4d3e16d2a474fa2189629070570cfd0dbe20f1ebcc657ed7e8f9f57294329f8ede189db32223e818cacac9c5b393ac630ae
SSDEEP 192:sxZQhRDyM/jK1Ml8MycB1sQ/fMasCYSavNakbeNsMdpmkAIYHW6+WNOw92HyA/7V:sxZEtqm1D/fDsCYSJ3NjwHb+5/sdG7
TLSH
T11A82D542662499B7CDCAD619B9317F57D7F404A2CD914E8CAAFCC91C04EB6FC221782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 adede6e7f0291b8016abe807dfc17cef4853747509260aa9aba01d5f2c1c86c6
MD5 f6ada2e1eed7e773d64895e75c7827c1
SHA1 83802c2ec43b0207e41a752268539de6d3a87c28
SHA512 e3017d495c39f7d61bc206e66976dad0297842bee4bc7178d715584091888a7e00d60f3a7e35b2f16933d03a31ec01c2eb57b78672eb10c31f46ad483d799a17
SSDEEP 384:sxZ9tnm1D/fDs8YSCG3NlzHb+5/AV8nG7:sFhm1D/fnYSCG9ZHbWAE8
TLSH
T13F92E752653499B78DC6D619B935BF57D7F404A2DD918E88AEFCC81C04EB6FC220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 dbe6d113af390ce3f78e9a3c7814304899b85d6d426d3cacfc21d71a981906a0
MD5 f75f421a83546d36e76481555181ac7f
SHA1 e5a0b226e4a98487fee0916c869a206b98bb00c4
SHA512 d0fe60a45ec5c3b2d9a5c1af279026711a9742b391aa9765e307e0de8e5c47ad699b2db30b3cdf8e4e7c00cdc4bc332125c46772ac398d36667c20ce6bbe1b83
SSDEEP 384:sxZ9tsm1D/fDs82SCG3NlzHb+5g/AVNjyG7:sFKm1D/fn2SCG9ZHbTA/y8
TLSH
T11992E652692499B78DC6D619B935BF57D7F404A2C9818E88AEFCC91C00EB6FC220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 91ea286cc6177e182d1d4328a1d30c40da8dd71f6283cdc32f9b612db1085889
MD5 2a823cdc72362b27957c2aa770fc6faa
SHA1 d4e343601d8c89e62a8beb3d622537d84dc37ddc
SHA512 ff0b1e456d3724cddcc6af9cbafa532359a249e89f8815522495d440d33b72f815655af27c45631b430338f680caf1145b16bf0c7345cc5a91e435e5877226f8
SSDEEP 768:eQsqxAlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVZ4Ll6AR95ro808:eQsqxAlWvJD6Tu1jaa4LAs9y85
TLSH
T14DE21C3B694CCB7E4F840E6DEC266FD76ED801CB5698895447FA880C03CB3EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\783ff0be-338c-40ad-8053-33ee09a8d709\index-dir\the-real-index
Size 72B
SHA256 7f11786302a3c5c1776b3bf8ce3d634703c81a3199840aaa47bfe22012497ca7
MD5 37d6d393a319410ec7c697e65fb22f7f
SHA1 1df75a43700f91bcc9e4bbb3642d68b488f52f5f
SHA512 ac336256f9ea14fa0d5128c662d9488b089ddd0a07546800e3808e801be2f3d8a3ad1b6a2aa4185b08b77907c3834d0f24964786d6f702839b8e9dc3effc472e
TLSH
T1C7A00230DF800147C51629B2156713911301CC907504270750A21149CD618944DA140C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\783ff0be-338c-40ad-8053-33ee09a8d709\index-dir\the-real-index
Size 72B
SHA256 3df7c28de8e0be1220f5d2aaea19e0f0d1a1193697bbf734235ac9d8fda52c69
MD5 c63cc5aba9cb684a4d686d37615de755
SHA1 ec571b3af57eb29cce8414a9495cf2d00c596f4a
SHA512 78d948745da4653a5981c542cbaecfbc473eab9feb8141a57fe1b288bcd646e1b229425efde1d2ad1344032e530643d977f5fc88beacc1f78daa230aa2329e7f
TLSH
T1FBA002178381440DC30392B0269605A13B62EB224302570765A24266CD987498F7101C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index
Size 3KB
SHA256 d0b5fe502488a09164346644548d0768307e18f52621aeaa3462589f39ed6e0b
MD5 115c6b5a27b56142167124f01bc2e915
SHA1 60d82d3bba85d1d4735eb3819b9514b0512a5bec
SHA512 678a8f15774ec3052602a0b0c0df0738240c987f5058d9ff0a4e5b5ab1591b9ed3539e3c13de6f784eb22d3267dc30f314ef0fd50c292d866ad5b494811ed1c4
TLSH
T15B5195CFCD8A0E96E9AC12B258BB044133B624DE47984A076DDCB674BCC336F1C1DA55
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index
Size 1KB
SHA256 29883eabae057cbfca7e5e94c993dcae4477bf8d45afa9c9ddcbbed426e4b90e
MD5 e870cd693d184a4346dc600b35e0b02f
SHA1 65b936fd7f49191c2beff12fa2740389bb109d16
SHA512 f4d171fac2f36decfc713529cf3ff4c137faac0095ba4ef8e535c7b596a37c16dfc5a1395675282f66ee382923c3344c1b6ddcf456feb6093a12df36fff00810
TLSH
T1103112CD4EA0991FF86485B31576A4A07370C9CCA712E7235D2C31721D2138D39471D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c629.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index~RFe58c629.TMP
Size 1KB
SHA256 32a9a3931ffeceb8c5922928a8f676ea800b31e683602baef821f016d151aac4
MD5 471539943a54f103b6e8fbca5fba080d
SHA1 5a47a92a89e4285da6dca4895a5e9fe26755e29c
SHA512 2a0d1fee50d98f6417893b15ce6483c9503dfe55afa135da6e05428249904e797b881f770452b6a53086a71f07cfdf835d973be97ea86e838e18c1a40fdd7f83
TLSH
T15C3125854AE1490BF89455770A97E4F47330CC005323B793693C253A4D31B9D19470C5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 4186d327c8115b9ea6e090859fbd2e468a72fe8e4c014ad3d62d5a8d6b5fa3ca
MD5 e4a1cbe558ff9af67acdfe31fd8bc46e
SHA1 bb8784dada8140e78e99c135167c312d0ae7c292
SHA512 f3a4154f32448ea596838e811c62324773edbe366c5826448006f43cdbd93bc57590a1889ef86edc44a842c5ffbc2c2b26fc9fff2923ac5b953d33beb064bdd6
TLSH
T1AAE068B62AE71800A8EBC3DE087354964400F428C951EC4F002A928350722613821C26
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 f52c9db2d9f823a2c64371d0257c4c8c4d7618d62aa55023dd9725eedfa5edfd
MD5 9a9cb2bbe52886c9ebba1676b7f23318
SHA1 f4f124f1fd45837d2f2e516ef6d59be3b50858a5
SHA512 5641b35bb18ebcc39432f1af4370b04e301d672869aab733d82e2dd5fc0ec3787f0645505e032f14c844df3490eb9565b6fe7c6fc76e583fd567011714e2acdc
TLSH
T1C1B02288002CB022C83803B0A2EB000033300CAFC32F323008B8F0BECA02F20B0CE202
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59428d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59428d.TMP
Size 48B
SHA256 1d6319ee926137f68ed985278d1ec972b5882721e9bd9ccdbf45d2576507f176
MD5 f17b25df27863b3a8ecd38644c112212
SHA1 edf53c13d9cc5faef48e195965d4c7973c7d2f1c
SHA512 0a9cc873a6cc6c86bcf52bd07cf680a5793476fc7961dc1e2dbef7aa22c50e9d9566e0ef827866ea42635eb1d30bda148a139bf7beda87ef6a3edfaf6bae7d82
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 e2a005c9cf519dd109c4f7e5d95d833ccecae78d8f6d555df459db369ab7425a
MD5 3c93f4e1aa2f89e9f6bcded49bebcf79
SHA1 458ba666f500ee4bc17111e7bb64653ee83e2aae
SHA512 fa13134dd9697b442d61576ebbecdd7f8fa93ae75c044f9e664c5ed775b7647b2f07c027f6bd67e8e8e53d6e7ef2eeb1e9a27e14df0ce69f607b84821e2ec11f
SSDEEP 96:KYbaKYIK6m0Knq6+HuKYYj5uKiYCiE4KxCc:ExX/l9Zfv
TLSH
T11DE11402717F02033ABD7918A3AA89374E4275A37418A4BF3BB954624EB7E115CFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59a9e2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59a9e2.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 e0e62cc797cd3a39886f14a0cf2abc899f2e1c0f1e1b52dbbb44689c39b6f4f8
MD5 5137adb4f0302980a240730ead8f3cd1
SHA1 043744988099642dd90678a802bd74dcf27aca00
SHA512 2c4705e57a1a88af76b218729f58fd6337bf6e07bcb268bef2d7c932e3e361f888bd13acbb04dfa116e1482ede9a760b41adc6683c676ae3de3fa9d23f482b40
SSDEEP 384:nUiFPZcIosNy8TUNTUlIlKT59bsgmP2ZDfYZRNwOWG9JIhivHuOo+:vFHozwgEctZHwOp9ehivuOR
TLSH
T1B5B21772DCA4DA7BADE29785E70A76478EF0406786CD9EC0D9C95E1C00DB6ED130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 5dea02675933270121d26ff483eef29af98904f84c41b8fca6f2264555a6720e
MD5 b3a2a96e5a903131ff90451ad79da396
SHA1 b37f931cb0f644ac0fd9668978bd920f5caf0b65
SHA512 a0674e83f9b3a5d3ed209f0b06007bb1a958741feefd166c3450b13ae532ae57a2c2a2f5c57793753035fb938c1a908369d21057e62b3a43e5da3391c455be2a
SSDEEP 384:nRZcImsNqKT59bGgmP2VRNwOWG9JohivHuOo+:5micUHwOp9ehivuOR
TLSH
T15A926C715C746CB75DE6E145F64B35078FB88067A6CA6F8098DD9F2C01EF6A81307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 8c9e1fda0747727b9a39e16bdc89beabaf5be30bef2beee93ca9ed89748faafa
MD5 11f77d57ed3cce58f8c580ea8edff4f7
SHA1 e51b30e5dfbe7a60ea970f4eb24d92f5c96d1e18
SHA512 c5cf588472a7c440942ee1554506b2b8a1cf5acb3aa3359f3eb47537e760bdfcb8863e9eae66980e8db923fbb4537334b4708175b17840bff68bed7841efe5bc
SSDEEP 384:nBZcImsNqKT59bsgmP2VRNwOWG9JxhivHuOo+:JmocUHwOp9XhivuOR
TLSH
T17B927C715C746CB71DE6E145F64B35078FB88067A6CA6F8098DD9F2C01EF6A81307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 eca8ff8e420e9eeddaf14d8808c0a60a32ed8b57c185d691d6c5f1616d5c9cba
MD5 b1c6123fd6e57d654d666228201f4ca6
SHA1 a395300eaafcf0c03f869ab53480bbe70936cdfe
SHA512 a3d681b78875713c403fc080c48ab19bbff396afb282f0ac6753cfe7b37e21a2566177f62d4f4217d74feada4f98567dbbbf2f8f1c1f9121eac0d2d73ec8001e
SSDEEP 192:tONg6JkRtQmiUyCuW+RNwOmhOmQh33RQU6:tONg6UrAW+RNwOW0WU6
TLSH
T19202E93468382C779EF26E0AF58B27135FA5107BE9852F80DAD81F1C01D765C234782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 436d651fc72add7cc0f9ab93ddcdf5e4ed9f56ea0a4afa8b2438770d422ec8a0
MD5 a95e94333ac701601b4634b544d45495
SHA1 88eb01b038717056b098c463e2704e62a1465f57
SHA512 a9c4336f756d31d86a58bb4039727c2a9ffc0ad6a6e4464f26f48590fe37a2d905bf1591d0650917e7fa2ab8b4bcff6303196200438472b6fe1fe013b19b859e
SSDEEP 192:uueLsNqQTLWMykRb/8WPGmiU18ZmP8BVRNwOmhOmVU9DFVSRgqptlYyXj4XH:nUsNqQT59bDkmP2VRNwOWG9JMhxsH
TLSH
T1C5423931A8745C775DE3A449F64B36138FB4916BDAC92F9099DD1F0C01EF2AC230B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a3539985438563371dd4b80cc78c7d1cb0cc87fa7ce1d2b412d1af17ad7fdc7c
MD5 61efeca2693b1b3858cb7fe27b8293fc
SHA1 d9221fe3cb0114d52955bd5ed707934654882044
SHA512 3969b1aac36c2c1c76ba74873b0fd3a878e406aa36bd522ef036ff86af4eab91345e1f11389ab3d450e97c973938bab69d3838958b3a544ba5564c9968db4da7
SSDEEP 384:nPZcICsNqfT59bDgmP2VRNwOWG9JMhivHuOo+:HCacUHwOp9+hivuOR
TLSH
T182926C715C746CB71DE6E145FA4B35078FB88067A6CA6F8094DD9F2C01EF6A81307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d8dc85bfb462da19e9c8ee8c05e781db68abd5569aa1448b168c0dfc6edd642b
MD5 d657d8aedb3a6ed5034054236fd8f9d6
SHA1 8543be4e73ff02ff733695888896610fe726b958
SHA512 835d89fc17e7b72e10aa944f585e4009f42c075a4a75acaa44d8e2b6cb90b57b68f92c0c4d44ee2cd945de347a75584a5b674a8731442e765b0c4b5c114fa4c5
SSDEEP 192:1ONr6JkR6QmiUy7u5+RNwOmhOmVU9DF+VcgqptU6:1ONr6U2H5+RNwOWG9JphU6
TLSH
T17C122A3168786C7B5EE2A445F58B36135EB5512BEA897FC0D5DC2E1C01EF69C230AC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

a012d0ec-b46e-4367-a543-f23f27b1bf97.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a012d0ec-b46e-4367-a543-f23f27b1bf97.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
Size 2KB
SHA256 17daba90a76693f4d979a164d6bbaf7e3c9ff7efedd708b6720c37d488feb024
MD5 9686a340c8e0ffc53a34ba19033dcba1
SHA1 329b614d554640c88043959a6a218fdae423959d
SHA512 0ada1cac4afe072b7d9f9433112b0f76070e40db0dffa3e951a8eaa2b98c4a2289c38349f21f88fa469bd7012ddee62e8a6f6b633f5b0c3f9a53bc3fe73ae60d
TLSH
T1CA413B58AAFE1058B3776E4AABF6B82D587BBC772E06D45D00010E4E0623B44CCB1B37
MD5 SHA1 SHA512 TLSH

Submit Download

49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres
Size 2KB
SHA256 b30b5d99aa64b64dca7184c0fbaa7a8a7976aedf220cf6f124e148b563b6ebf3
MD5 cd13635686fcd0598983ac05f0517220
SHA1 c2ef483a25333b8980b54b680dbf8a87321fd3de
SHA512 02a929cfbdb518dd6d0702b357b121201200824cd378c84de10fed7300707149fb8e0c4d8150dcfac8fcc96d2ea0d9396314152acadd56ac257c50cf399228dc
TLSH
T13A516D58AAE911187373AF56ABF3A96E487FBC732F06945E10510E4F4723A40CD61B37
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5f5799d881bab902f32ba148cefd16070f453fa054d2c3c9c3aae354fb800495
MD5 c62695f3e87c041e754ed20ed50a8a20
SHA1 8e5ee06140b134ee9beca46e65e659a1e1df4481
SHA512 b26bef900890735f6a2f9ab7249c5b23e411e7cc78257f93b8bba3ccf2b1148acc46618cbdd251f5b73e0589c358d488cc5aa4db99ce37fe2015dc8ad53eed54
TLSH
T13641F498A2E91148B7B36E5A9BFAA46E487F7C373F0B959D00110E4F0A23A40DD61777
MD5 SHA1 SHA512 TLSH

Submit Download

20260819 Hearing Bundle.pdf

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\GL32O1SL\20260819 Hearing Bundle.pdf
Size 10.5MB
SHA256 320ffe002480434156492fac9fdb145a4f10960e7a56b9a65f1f1d3c7f6ccf45
MD5 bd417750f35211e69ea2538f29c5722d
SHA1 5d026cc5b7c4f72fd95f6e16cb9eb8a97288c49f
SHA512 c4f3ff3a9919b9211459009a863d6b5dd588d31df62a0e1e8a2a0e19cc780bd5d08a077177da67f725b4cccd673946375390aa1aaf08e2fd20a092ae558b1e5d
SSDEEP 196608:GtBu85qZI/vSHifSQ1NLJdzYZHd2ffNUZmKoDsU+nvr9MrrTaae7GYHQ:A+ISHqlN1dzcHcffNUZxoD8vr9waxGd
TLSH
T1CAB6025B9B65C6C6C40983B4BD0B1FA44F8A93AB9D4135FB18224ECF3D08D239C9957E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

P LOA vF (bookmarked).pdf:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\GL32O1SL\P LOA vF (bookmarked).pdf:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

P Skeleton vF.pdf

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\GL32O1SL\P Skeleton vF.pdf
Size 271KB
SHA256 a4ad9454fbde8a563f3e2b47e46548ff1f2ec180ada8f15a984462e60bd0ed3d
MD5 527430d6f50b53292c9116bfe882b3d6
SHA1 ae74198c7594d4c7e52efd34e177f58c5f13326e
SHA512 cbc806806b7ce8b92ebe507e6a7752b915920c38f76ece4b7a8060496310a58436f9b82f9e2df7676844f2eac0bf5a5a41d3e8a33a5d6d92f784ec063e85fa7e
SSDEEP 6144:q0SVOPslqIgL1MAsPpPc+P4y95de8A6OJF1al00PpvkQ1ZfbLxDmBYnQF2s:q0mOPslqIgsPp5RATJIPpvkoRxQp
TLSH
T1614402A5D244B4ACF4C2C406A93E3649AADEF19381D464E0356C490DE947ECCFDB72EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c62f6c43-6f33-48d0-ad3b-f866b86257d7.tmp

Path C:\Users\Admin\AppData\Local\Temp\c62f6c43-6f33-48d0-ad3b-f866b86257d7.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f290649e-9eab-405d-ac8f-13bd4c9bff5f.tmp

Path C:\Users\Admin\AppData\Local\Temp\f290649e-9eab-405d-ac8f-13bd4c9bff5f.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3480_1503459178\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1dd2449d-518c-4b45-99ef-52f4028918df.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3480_255173971\1dd2449d-518c-4b45-99ef-52f4028918df.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

P LOA vF (bookmarked).pdf

Path C:\Users\Admin\Downloads\P LOA vF (bookmarked).pdf
Size 2.3MB
SHA256 732495b36efd4bf134eb8c4949f493cb6d17b7ea381b09f639940bfdaec788f0
MD5 31ec0061b5518432c56187f279b63198
SHA1 696262d3cc010bd0eea2805b92fe94b059ce9ca3
SHA512 458ab50f93da7d28f369da60b7d455abfa8f32e9c8ed5a4a1209680359a874420803786a34fd8e26af12cb3a0381a74d8533fb14ee6dab5791821e6155327231
SSDEEP 49152:iMWxdlF0U8pUNr38MF7KzPCo1yBeOPxQSzy+GsKMpsll1ch16G:fwXOWdMGCPCo1XES02qYQh1l
TLSH
T19FB51299D307AD1C80130A0177594A6BC1DBA8EE241D3437BD8C87DA8B56E93B371EE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3592-10-0x00007FF924C30000-0x00007FF924C40000-memory.dmp

Download

memory/3592-7-0x00007FF9670F0000-0x00007FF9672E5000-memory.dmp

Download

memory/3592-5-0x00007FF9670F0000-0x00007FF9672E5000-memory.dmp

Download

memory/3592-9-0x00007FF9670F0000-0x00007FF9672E5000-memory.dmp

Download

memory/3592-8-0x00007FF9670F0000-0x00007FF9672E5000-memory.dmp

Download

memory/3592-11-0x00007FF924C30000-0x00007FF924C40000-memory.dmp

Download

memory/3592-6-0x00007FF927170000-0x00007FF927180000-memory.dmp

Download

memory/3592-4-0x00007FF927170000-0x00007FF927180000-memory.dmp

Download

memory/3592-2-0x00007FF927170000-0x00007FF927180000-memory.dmp

Download

memory/3592-49-0x00007FF9670F0000-0x00007FF9672E5000-memory.dmp

Download

memory/3592-3-0x00007FF96718D000-0x00007FF96718E000-memory.dmp

Download

memory/3592-1-0x00007FF927170000-0x00007FF927180000-memory.dmp

Download

memory/3592-0-0x00007FF927170000-0x00007FF927180000-memory.dmp

Download