214e0dc3d6b6d29d0d3dee18bde6636ac080ab8c35988195b1f6bff39f4f0f00

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 09:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MEMZ-4.html
Size 224KB
Sample260825-k2swtage48
SHA256 214e0dc3d6b6d29d0d3dee18bde6636ac080ab8c35988195b1f6bff39f4f0f00
MD5 48d3717807e8048376684f54a798a690
SHA1 cd7226e92529ece351b41dabe7016164bd242627
SHA512 b7dbcb99210fc710cda1ef461af68fba3f5fb75d33f2314e497f5b809f8392068a25616b604b35109765627a357638395aafca168c2c6324401ae09115dbc87a
SSDEEP 6144:MIUDNSaM7k9UREMj82NitCvWdpwmOJ4XP2RcrPkGzQynhBbQVFB3lBzx9F20kxqh:5UDNSaM72UREMj82NitCvWdpwmOJ4XPo
TLSH
T1F324C8B1B071E33E019F229AF1B05B50C3D3A69BC7566DE6D02FC6A845D2C88F7A3156
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
912	chrome.exe
2780	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321223825704598"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{56C307BB-88F1-4006-84DC-0DDB24003A6B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{1A40E16E-80C0-4A86-ABE4-AA26C1B62124}	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3128	chrome.exe
3128	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2324	2128	msedge.exe	86
PID 2128 wrote to memory of 2780	2128	msedge.exe	87
PID 2128 wrote to memory of 3296	2128	msedge.exe	88
PID 2128 wrote to memory of 3296	2128	msedge.exe	88
PID 2128 wrote to memory of 3296	2128	msedge.exe	88
PID 2128 wrote to memory of 3140	2128	msedge.exe	89
PID 2128 wrote to memory of 3140	2128	msedge.exe	89
PID 2128 wrote to memory of 4016	2128	msedge.exe	90
PID 2128 wrote to memory of 4016	2128	msedge.exe	90
PID 2128 wrote to memory of 4016	2128	msedge.exe	90
PID 2128 wrote to memory of 840	2128	msedge.exe	91
PID 2128 wrote to memory of 840	2128	msedge.exe	91
PID 2128 wrote to memory of 840	2128	msedge.exe	91
PID 2128 wrote to memory of 4724	2128	msedge.exe	92
PID 2128 wrote to memory of 4724	2128	msedge.exe	92
PID 2128 wrote to memory of 2472	2128	msedge.exe	93
PID 2128 wrote to memory of 4724	2128	msedge.exe	92
PID 2128 wrote to memory of 2472	2128	msedge.exe	93
PID 2128 wrote to memory of 2472	2128	msedge.exe	93
PID 2128 wrote to memory of 1640	2128	msedge.exe	98
PID 2128 wrote to memory of 3528	2128	msedge.exe	99
PID 2128 wrote to memory of 1640	2128	msedge.exe	98
PID 2128 wrote to memory of 3528	2128	msedge.exe	99
PID 2128 wrote to memory of 4740	2128	msedge.exe	101
PID 2128 wrote to memory of 3904	2128	msedge.exe	102
PID 2128 wrote to memory of 3904	2128	msedge.exe	102
PID 2128 wrote to memory of 3904	2128	msedge.exe	102
PID 2128 wrote to memory of 1272	2128	msedge.exe	103
PID 2128 wrote to memory of 1272	2128	msedge.exe	103
PID 2128 wrote to memory of 1272	2128	msedge.exe	103
PID 2128 wrote to memory of 2856	2128	msedge.exe	104
PID 2128 wrote to memory of 2856	2128	msedge.exe	104
PID 2128 wrote to memory of 2856	2128	msedge.exe	104
PID 3364 wrote to memory of 4016	3364	chrome.exe	112
PID 3364 wrote to memory of 912	3364	chrome.exe	113
PID 3364 wrote to memory of 2452	3364	chrome.exe	114
PID 3364 wrote to memory of 5020	3364	chrome.exe	115
PID 3364 wrote to memory of 2452	3364	chrome.exe	114
PID 3364 wrote to memory of 5020	3364	chrome.exe	115
PID 3364 wrote to memory of 2812	3364	chrome.exe	117
PID 3364 wrote to memory of 628	3364	chrome.exe	118
PID 3364 wrote to memory of 2812	3364	chrome.exe	117
PID 3364 wrote to memory of 628	3364	chrome.exe	118
PID 3364 wrote to memory of 4044	3364	chrome.exe	119
PID 3364 wrote to memory of 4044	3364	chrome.exe	119
PID 3364 wrote to memory of 1028	3364	chrome.exe	120
PID 3364 wrote to memory of 1028	3364	chrome.exe	120
PID 3364 wrote to memory of 3528	3364	chrome.exe	123
PID 3364 wrote to memory of 748	3364	chrome.exe	125
PID 3364 wrote to memory of 748	3364	chrome.exe	125
PID 3364 wrote to memory of 4984	3364	chrome.exe	126
PID 3364 wrote to memory of 4984	3364	chrome.exe	126
PID 3364 wrote to memory of 4380	3364	chrome.exe	128
PID 3364 wrote to memory of 4380	3364	chrome.exe	128
PID 3364 wrote to memory of 3368	3364	chrome.exe	129
PID 3364 wrote to memory of 3368	3364	chrome.exe	129
PID 3364 wrote to memory of 4140	3364	chrome.exe	130
PID 3364 wrote to memory of 4140	3364	chrome.exe	130
PID 3364 wrote to memory of 4212	3364	chrome.exe	131
PID 3364 wrote to memory of 4212	3364	chrome.exe	131
PID 3364 wrote to memory of 2432	3364	chrome.exe	132
PID 3364 wrote to memory of 2432	3364	chrome.exe	132
PID 3364 wrote to memory of 4324	3364	chrome.exe	133
PID 3364 wrote to memory of 4324	3364	chrome.exe	133

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\MEMZ-4.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffc0125c188,0x7ffc0125c194,0x7ffc0125c1a0
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,8997547495119419834,8131700093226052705,524288 --field-trial-handle=2492,i,14473237108229508941,9661611625612064020,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,16468731374167254298,13923662355534139928,262144 --field-trial-handle=2492,i,14473237108229508941,9661611625612064020,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:2
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2324,i,15181210964500173961,12846709517189407617,524288 --field-trial-handle=2492,i,14473237108229508941,9661611625612064020,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,15516178957602287758,733878674926690592,2097152 --field-trial-handle=2492,i,14473237108229508941,9661611625612064020,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,6254846890537468427,17460580882113753921,2097152 --field-trial-handle=2492,i,14473237108229508941,9661611625612064020,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,3760416880476700058,10287452193408840975,2097152 --field-trial-handle=2492,i,14473237108229508941,9661611625612064020,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,8109441460937079427,7421036875319453488,2097152 --field-trial-handle=2492,i,14473237108229508941,9661611625612064020,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:2
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,4194801263021242851,16826056096880418717,524288 --field-trial-handle=2492,i,14473237108229508941,9661611625612064020,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,1176744339562216782,14428247746332300300,524288 --field-trial-handle=2492,i,14473237108229508941,9661611625612064020,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,8388238706948803032,11682858623936375571,524288 --field-trial-handle=2492,i,14473237108229508941,9661611625612064020,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,8388238706948803032,11682858623936375571,524288 --field-trial-handle=2492,i,14473237108229508941,9661611625612064020,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6060,i,11488997470638469665,4921217881423202778,2097152 --field-trial-handle=2492,i,14473237108229508941,9661611625612064020,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6368,i,3510518634937317155,14498050128220988792,2097152 --field-trial-handle=2492,i,14473237108229508941,9661611625612064020,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6228,i,17827078879909422817,5953150317593353129,2097152 --field-trial-handle=2492,i,14473237108229508941,9661611625612064020,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:2856

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3532

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffbf55cc728,0x7ffbf55cc734,0x7ffbf55cc740
  2⤵
  PID:4016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2108,i,5096052570433220768,11762298485809642855,524288 --field-trial-handle=2096,i,5702163075443249792,11569607698244841985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - System Time Discovery
  PID:912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2292,i,12406398491227817037,7350348266541928526,524288 --field-trial-handle=2096,i,5702163075443249792,11569607698244841985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2480 /prefetch:8
  2⤵
  PID:2452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,8494434704005570138,11995716059125410507,262144 --field-trial-handle=2096,i,5702163075443249792,11569607698244841985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,10880401331033937675,12130719511871343511,2097152 --field-trial-handle=2096,i,5702163075443249792,11569607698244841985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3284,i,12986351084259965510,4420921779996710773,2097152 --field-trial-handle=2096,i,5702163075443249792,11569607698244841985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4496,i,7602363840959724467,3897744040901452827,2097152 --field-trial-handle=2096,i,5702163075443249792,11569607698244841985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4512 /prefetch:2
  2⤵
  PID:4044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4756,i,3747817980635000908,8225381277893632785,2097152 --field-trial-handle=2096,i,5702163075443249792,11569607698244841985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4460 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,1819589250070044804,17261017416965188260,524288 --field-trial-handle=2096,i,5702163075443249792,11569607698244841985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:3528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5748,i,16528406778360402584,14271831863635729913,2097152 --field-trial-handle=2096,i,5702163075443249792,11569607698244841985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5944,i,14163013009153522209,69317072858794668,2097152 --field-trial-handle=2096,i,5702163075443249792,11569607698244841985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6060,i,17693468296346417602,6142553062319603570,2097152 --field-trial-handle=2096,i,5702163075443249792,11569607698244841985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4632,i,11435212833176457924,17200348451677802834,2097152 --field-trial-handle=2096,i,5702163075443249792,11569607698244841985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4812,i,7149722459119609912,4199154687652157612,2097152 --field-trial-handle=2096,i,5702163075443249792,11569607698244841985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4756,i,9250345264579136331,7087991895986047378,2097152 --field-trial-handle=2096,i,5702163075443249792,11569607698244841985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6348,i,3576718626248202981,5018850828699650085,2097152 --field-trial-handle=2096,i,5702163075443249792,11569607698244841985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6176,i,15217059383294628916,11442725294579111704,2097152 --field-trial-handle=2096,i,5702163075443249792,11569607698244841985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4840,i,12081784829258801565,5612338918880072992,524288 --field-trial-handle=2096,i,5702163075443249792,11569607698244841985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:1000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6352,i,11836196397879381542,5972027492570372855,2097152 --field-trial-handle=2096,i,5702163075443249792,11569607698244841985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6424,i,17739738794766509898,12234839201052179446,2097152 --field-trial-handle=2096,i,5702163075443249792,11569607698244841985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6596 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6316,i,7941962026160487495,9101276680940435724,524288 --field-trial-handle=2096,i,5702163075443249792,11569607698244841985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:5376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6324,i,9929112209681729852,4085935579060982948,524288 --field-trial-handle=2096,i,5702163075443249792,11569607698244841985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4632 /prefetch:8
  2⤵
  PID:5384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6308,i,6233452971802550506,16823094230828196470,524288 --field-trial-handle=2096,i,5702163075443249792,11569607698244841985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:5392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6272,i,5605322113231071886,9739996873973277786,2097152 --field-trial-handle=2096,i,5702163075443249792,11569607698244841985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=4776,i,1127599224688111825,10801524194982742504,2097152 --field-trial-handle=2096,i,5702163075443249792,11569607698244841985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=3464,i,18163205593575498947,1891942603140922790,2097152 --field-trial-handle=2096,i,5702163075443249792,11569607698244841985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6176,i,16568385270834362761,3436125509763775851,524288 --field-trial-handle=2096,i,5702163075443249792,11569607698244841985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:3300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6168,i,11820644280134747980,2507443158652199350,524288 --field-trial-handle=2096,i,5702163075443249792,11569607698244841985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4524 /prefetch:8
  2⤵
  - Modifies registry class
  PID:536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6316,i,15346240185659439113,6741499747581193258,2097152 --field-trial-handle=2096,i,5702163075443249792,11569607698244841985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4508,i,13186148948176360079,5456285532705513802,262144 --field-trial-handle=2096,i,5702163075443249792,11569607698244841985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3128

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2352

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6b8680d0-8646-42cd-99c7-af4652e2503a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6b8680d0-8646-42cd-99c7-af4652e2503a.tmp
Size 13KB
SHA256 a0ec9a4c4b6bd806feb456718711ae3ff41c685c14b9da5af96174f43147800b
MD5 4902ac669609653542a85e12db80bed2
SHA1 6f2ffc4132450ed97d3f2b62693d6733626b5365
SHA512 ca6bb934ad35a703baa511764f8f6ff04c95c8ce2cae8b8ae77288ebd56cd3f55550cb199de77c54fa787a270525f72003e7be0f1b56e6d0f9a008a4cd960349
SSDEEP 192:FRccBzz+PyIzlv7spAPRp22mjRb9wHsb+WNZ4LXYSm+Us2cYtQeArEWaDVyIsnAq:FRcmzz+VYUX/YKwO822BtGrale
TLSH
T10A52D62AF92569375DDAC219FA267B6BD7F5106121C41E80EBFCCD2C10D79CD2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c31135691c0665f855b9d0f04e14f938ecdf96dbecb6d9af1545a34f15ffd108
MD5 9cd695d29cfbe5234a8e6e6e1e6ef15b
SHA1 6e21da283c62d608c6d9076f90e3d0824d2c5db5
SHA512 05880fee7e09ca49a55e9e30a3a18bea9ca0971d802e16a4dc10cab72c7fc84b511a015ffe98751285cd0840f2e8d87f016b835f112b8e36b25df4d0f1677ac5
TLSH
T199E022A9C922BC2709FE0718911406CBEB51139B2A80591F3A3DA108CFB0B2B41CACAD
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 110KB
SHA256 419f89cea7cf18912a64ba3ea64d7a4edc821b3cc7e95401b3335fede99f6033
MD5 f0a3db3afaf55a5ff88491ea31588eff
SHA1 29c6fe025d7ea59e6c162f339e23ba82d2e8de96
SHA512 efb225aad98e2ea1a933758ccc5fcb03aa37f05b46b82c2dc56e5d6569529441312f778fafd56164a0b92f73f9b2f873cedad738833fb4811cab187c85fdcbbb
SSDEEP 3072:O74LLgxNlRR3ApiQ+MYTM+A+2y5IrgI0FyYUp3JwU7UHDQ+840x28q5:ZLLg3lRlOiQ+MYTfA+LurRX/pCU7UHDF
TLSH
T1E8B312390B78B98B81DC684E5D4A1F5C5E61A8F1F4C272D458C33D909BA3BC9A91EF70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
Size 436KB
SHA256 0b320d2cf00e9215763a5377904e2301b2edb7a5d299bd319259714cf8bcd9a9
MD5 38e965609b7e0769e6754549cfa3c2fd
SHA1 8ef9e62fa3ae6d8b371f5a9e9344a6cdf31515fe
SHA512 18cff962b979abf3e3d06261422f35502463a0e196aa0cf801cadcff8833a83f20c9e9f22fb3133041e406fdf2304088a0a5eaa4bbb8aff07ab15a0c1b46b0e4
SSDEEP 6144:HT+7EhQjYpz+XUGr9+7Km54TxcjJJEWv6p0qOJ7kuKtAiDL6GnkES7+S8HBWzDi2:6vj0iUI9EKFEJdU0p7riDxw7L8oviJ3c
TLSH
T147942367DF08D99BDA158361EA30EBDD1158EB6EE00A3CC844BB462CE54C0F9F6913C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002c
Size 62KB
SHA256 10b6c9e057a8c63cf4acbc837ddc83dfb9e6d724211bb21d93343594583afc3c
MD5 269456ae8c6ba3af97d2b4aa64a497a8
SHA1 0e9dc3cc1eb00fadd89cd3278b5be5cbdb79a0dd
SHA512 89b7579c0a71b13728cd01c4c1783cb9daef20bb7c340b255f02b1d3a286848ca434ce6f6321a246c374efbb8daa37fe0e4057e7469a7ea6721177c7db14da34
SSDEEP 1536:mXPI7rkkzxzCH6NGIQaSNXkkFRPvk9VkPf8z:swPzCaYkelvkfYUz
TLSH
T1155302F1179EBEEE6619A648DFCB720A4CFC5F17123531AE5E08A91DF1B07672293810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002e
Size 158KB
SHA256 60072b4eb6fc5f1f1214a34fcd55b3cbd1d05eddf778f85611f9b352c4c6452d
MD5 83266658f29f5cb762001d5d9f6985a7
SHA1 9ff52157193e1e798944e6a3172d938183f5e550
SHA512 60b2a8749bb597b71c6cb7113c4ea6c430ab90c6f6a5f78a36ab5fbd2676fbc173ade236be939e862569c786fbdc8e0aa984f1ae4263e91de2ba681cc8ce5d66
SSDEEP 3072:pqj6fcYjfI87fn/NWUEu+Y4rwgnWSPrrGh9SC2VRvkQdv45cf+Fg:pTvjg87fnVTEu+W3rSC2VRpBf+y
TLSH
T196F3232CABB1EF2298ADD32D789EF491C870553AC097303BB84FDF8575154348A7684E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000034

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000034
Size 73KB
SHA256 a76e08ac4b0f43faabb1d6d526629af32f23fe5cdfad40045d0e9640e269a114
MD5 444387eefbcd36a51edd55b9116045b8
SHA1 07f5340cf268e50784f9c06b1bb9559d9b987bc5
SHA512 88db54be2990eb163c7142356d7356a32ee0c3f0605171b26330e7d25949910f76eb70e95c92756ffc4246b4e0d7c6113953614a1ec198cd6dd54a510a7e4724
SSDEEP 1536:gJJpWKEN0+OUU0C2XYIyfDqHbs9hB09CfZlKMVOSUFV+qnCQaaCeDVIKQUCsf:cjW1b1U09DGyQPKzSUFVXCQa5eDqK6sf
TLSH
T1247312D24BC943F63F12D73C481D446AF73099A6259FCE87B67560AFF620174E1CA262
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003b
Size 21KB
SHA256 9f11cf3fe82ccd642913d2ee374e85786dc180a4efe82609b8d5d41f0ac233dc
MD5 6f5e255094770c83240443d768f79680
SHA1 1097769d2407a0ee71d51d1d5263a374b13a4dae
SHA512 c99455fcc55c71464f2e4f53bf6bc20e94eac6d4890a444b0856771a87d435ddca61858245a03923822c24a49bdd0ea64ecfe36bb9c65ecdb407c5beef09bd6e
SSDEEP 384:csR/9Cu7O//LbOjulgRpehzOT/tQIWnNB6xYMv4ptvZjepudtdQz+1iZdvzhAdpX:dh9LOrbkJRp8zctb+HCY24jfydvzWXLv
TLSH
T1AFA2E1AB70767A89BE1E8D2D418C94E92F5C2CEBFD4C4582B34148CFE392641C2E251F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 e5154c67326d24a10b437f9effca36d032fc84dc3bd08d551dfa125080f00898
MD5 f6ef3e20ac8f1a272eda110ba336503c
SHA1 2b20e255d63005e7cc410584dccf32a5ad4a73f3
SHA512 6cb22a0213349eb2350c1e2c695f123794f191b983e23895f2726d29024ff9fb78eb62cfd958055a1a76b0f05dd40fbb867e53cf8de671877d08b2a54c28cd6c
TLSH
T10641445665ED6C80FFB55C7EA8E96E80F53E0AA14C173B0F15108EB721736E5534C2A1
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 17KB
SHA256 24de18ad1d2d068927856a0498f33dc7954882c779df1b7dddd7856b3916cf55
MD5 e900fe05be35d2b0b7454a5c2db90e2d
SHA1 9226862b8ea5859ae3024bc8fd419ecae419abf8
SHA512 3d7e2d7f385c8daad5fb8434539764b874f64cd48dadaddd937e13a4a9cc3f725feb6e6f8109baffde0402bfc471a3ef9045a460e4da95f56f8fd10939fe376f
SSDEEP 384:D/QgNPzVeYW/RJOUeMO4JVoBeitUpaaRkXXAxa7j1faNQaKHRAYserXNW6O4N1RB:ynEMPC1BUK/CQZ
TLSH
T13272A1F7C3D88B2EC81152F46B652E1BCE690928562C3C1789D9FF5B53E24B3D24164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 cc15af982e1821eb40b32ef2ad6d380202646614b8f5edb7470e6c5ce00ff3c4
MD5 c04cb7a324886cf8e590834b310f6cb4
SHA1 c8a43c48f248a205e1e6dcf2b2d8cc5d5934542b
SHA512 60815d007c66341e0468fd890018e2842ecb9e6872451baf2c0148713e869a206b087f7e21be3ef01a8b3c51b4502d04f3dba849870263bd1a1b6faeeb0dbbe0
SSDEEP 192:FRccBzr+PyIzlv7spAPRp22mjo9wHsb+WNnLX4Us2dYtQeArEWaVVyIsnAUgtaJ:FRcmzr+VYUX/RKwb82WtGraD8
TLSH
T14652C62EF91569375DDAC219FA227B6BD7F5103121D42E84EBFC892C14D79CC222B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9b4aee193f22bad7ab223b6c518cb7fd089dbe39c220ce345672565bf2a6ca0e
MD5 45e15df973b0aa5ad83882d547a50d67
SHA1 2756f06acc271c6ff105d54cd1d48e7dc9a1bb1e
SHA512 037cd47251a111cf2abd9771b3f2c63eeeb8f3e905f7642b951fec114ce51444eef1c0982b4fc48b4312062cca74b8a0d60ee83c34361505b0857d43d7e35924
SSDEEP 192:FRvcBzz+PyIzlv7spAPRp22mjRb9wHsb+WNZ4LXYSm+Us2cYtQeArEWaDVyIsnAq:FRvmzz+VYUX/YKwO822BtGrale
TLSH
T1AE52D62AF925693B5DDAC219FA267B6BD7F5102121C41E80EBFCCD2C10D79CD2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 5a35c6dbf5ae3c9bf5323b0257be453f88db1a1d4ae479c2deda6cd172f216d4
MD5 1cc7f610fe6f3cc8362b52c0376552b7
SHA1 201a5f5469abd7079d37a7bfd91520db57c01340
SHA512 64f74dc09be969e69cd12a05cd899939b0c7d1195eafda6a081b8d1be57c275205834e85aaf35a6186d12923b3ab2cb18b62576760b51de7fe399d7ec0e5dbdc
SSDEEP 192:FRccBhz+PyI/lv7MpUPRp62mYj2p9wHsb+WNECOLXYwI+SQeDYtQeArEWaXVyIsB:FRcmhzmVQgXrsKwoUoe8tGraxe
TLSH
T15C62D62AF8216A375DDBC219FA66BBABD3F5106221D41D80EBFC8D2C14D7ACD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 379d96542283773f422c052abe7293924621df1604b63c9a59676e1514d2db6c
MD5 d066f854d368cbebca026e5da297c2c3
SHA1 4f2f84d54b0a8dfd273bbdb70bcde51ad5e2f12f
SHA512 613285c6b38983d33fb336394c5eff7edb692f60dfa433defdbf45524dd1c84cadfc8cba744a39b1c75482b318f7db6eaaae9842cfa8649a9ad00cece8442e41
SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcSjCDXODUr+ErU3/NHGcmyqOqjmo:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pF
TLSH
T15A7209676C4C9E370F94C6CCD8267F4F9DB5024B65E9886483FA9C2903D5ACB114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 652487511c62c3be84be532e40b69bc26c9e4b3f54ea1054edc06359794d47ae
MD5 3f0a1ae98097ef96885dd86954e18f53
SHA1 f573f640092c0001595dee31d9d7f96891f2fba2
SHA512 fab287ce091084b6c204e4d1ef951f498d87111fe5856e9b4f8c49b556533082f76f5568c9c42ce659c002cc6334c8c5d2d0fce96883a2cb69507e31a1171e54
TLSH
T1A2B0120080829501C04702B4175A149872186F249A0A170183E06D22C83A1718024160
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c649.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c649.TMP
Size 96B
SHA256 e888e957565d14c05510ec4347e7fbdc22ce2312b6696bd5a7fcb59cefcb74cc
MD5 890f8d79bb1762c31f9ed4bf0688bc0e
SHA1 f5b760c3027d9bfca9551df517e980734761ac50
SHA512 5ded685eae3dfb6087e85dafad287881e50898945650fe886940dd96840b005211e2efb8934cf933a01b365eb7fcd1ebddc2d0940d76623910ce277a01c10747
TLSH
T14EB02200C002A302C00303F0B28082E83028CF22CA83028282E00A22CCB0E300228020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 19aeda1f8685d56c9aa8f90b5e3895b946e4f2f46c30ecf233421395476e1923
MD5 172c878d0209a2be4acf80375fe141a7
SHA1 bd4d0365cf0d7df856d7a24ce5c2f3ce0ea14fd4
SHA512 b024ee48ce5a9302ebceac9d2eba9071d28f2a9fc9766985809fb1bda15c519794da8497d05eba5e7bb30110c210f59ea2db54857201dc2a47bb9f1f1abb7e7e
TLSH
T16DB002353A415933C0D947F2D0C5C5C1F6B42D5D4A86628575D55C9599703445329568
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 14ffd54b62e36f6651f18b0f5b1f1dd72e6c91ae35d92571674dec4776ee8015
MD5 1b2c79daa25dfdca0d3bd1515a58d60b
SHA1 10d050a3b30defe6dd039899252003a56fd3c1b5
SHA512 ff69193a8c6ac9d78749e341ec2f16dd0475f90a7a36d647074091d2d6ba57d0acc0b79655738d1c33a426a360304ef5a7ed5f9f861eabd56161b73845d3f00c
SSDEEP 3072:iGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:Vm7Rkm1tYpBeh2BAoK
TLSH
T116C3123B5D65E8779979B70EB08E0B1F1EF149A2C920DE92C8D85A0477EA7CD0A04D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 7ce829c3390e6eed289874d58df2fe679a9133a6130f844b86162c2a22cc726a
MD5 b5e9fef2c349a64bcd59f98b3f1da09b
SHA1 9a8bc97be339ffcfb5277870b6b64c46be036cc7
SHA512 a51f15b7aeb8ba71fd4f8b362c4729abd0879de1e8cf312c794fbc1e13475aa9f15483db00919498392992cb90a8dff81f8b95c4f1c395e02145a22d7b68b819
SSDEEP 6144:cx80uHLFpgCAdYglwm7Rkm1tYpBeh2BAoB:ZpcJdYglD9oBGcAoB
TLSH
T1163412379DB769F41E78B72E300F362A2EF19FF7C928D5898095990C6BDA7940809C71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 7f3c6e866203d87247d6a2a37f0d9911da4715a23c79b14dfa8d375d477ccc06
MD5 95dbd22fdd1740f95cfc064af8c2a8a7
SHA1 cbf550564b7b915bf8aff05775abdfe5720e9925
SHA512 fa56305a8940eaade2a53abcbb867343271ded75b182e7c3b34d722f0b6942577e929584d7efa21068bc95cc247c273803b767e421bf0e434ef4b0029ff25cc7
SSDEEP 6144:l80uHLFpgCAdYglwm7Rkm1tYpBeh2BAoB:qpcJdYglD9oBGcAoB
TLSH
T1693423379DF7B9F81A78B76E300F262B2FF28EFB982895858091990C5BD5B950408D71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bd5dff6b6a2953b678276fe774acb1020dcf956eee918258c4fbcebd9799de50
MD5 ad9e9cc59d40b3c4a865c23e526c194b
SHA1 ec6e5c23153f46461256dc2ee3316df628e2eda9
SHA512 781d6d2d74c84caa1d22367f03cb2eef3a2125624c47277182248dc2b092992ad8756b1ea9759b2d56ee2b90c008cd691688382416e421209d33f546892f8550
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P74:fwUQC5VwBIiElEd2K57P74
TLSH
T14FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 43ed930ab4f6c301b8a9975002044396e81fb40335708a22c63a3b7518502fba
MD5 f493814681e43778e7341007380f2a28
SHA1 aab119961717e6462b02d8af5b020a91fd266bda
SHA512 d7b2ccf619f128deea36b94b7b6f831d4a46f1b2752a93511b3f254c206f65a832c52abb8b3f4eda5f12017f0fdd7df077761cd133f76a77a0edbe45a3f22b1c
TLSH
T171D02304E034BFF2F433087D0274C31238CCA233D213331C2040212A0EA208350CACF0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 b8ae3c5e86faa179b6826b2590c971ac4916314d109e806e692e74eccf76a6f8
MD5 abe039d7348de3edc08c9c822c6a475a
SHA1 692ca830a0be81758f3286b0cf572013443f60b2
SHA512 431bf34f5d80267c1f629c75c64f9afb45929e91878a73dc3a5d42da582898c289b0098a839413ff05588faf6658ca1278609d68a0db76989b59fb36d452916c
SSDEEP 96:SPmiOqCtABRlamRV49Y5wuhuVyd59jZIlJI4ovbCNIE2WpNsLbEv/yl1/E:SPB/TakUY2rOHztNw
TLSH
T1BBA14FB099CB2D57FB91C07994E32B51373DB7EAFC1A4E9202D2573026B6792F56A030
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe586731.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586731.TMP
Size 3KB
SHA256 7463a5d357398d5295934fd6c7bbc4024cb5fba60c4ae9deead86b94be03dc7f
MD5 6e11c21a2b2865b66f80f9c7f8fbda58
SHA1 bb27633cfb7d11a362549c9664145b2911ad4f83
SHA512 456595c479864152ecc5102df2736449dd08cae793ee9dc7a22c794de1e32a2d343b465d874461cf6c740bc136ad98b1b11b82f5a1c72732e236ca2eb4accb88
TLSH
T11E715DB05EDB0563FB60803168E333667731B7FAFC175E9902E24B312795762F45A024
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 97d6eee6a21fd8024f37746b84e642e18d38cb7d446a8053e84769391d75c03d
MD5 d5355326364ccaaba85f63d5af990bf7
SHA1 4d3c087dca248b77bc2f081339412a6edc2dd012
SHA512 87ecca3381f4a66631466dc30aaef019079d7a7e0f6d0578cda3b8e3dc7d79d799aeb27c2c656f94e7e0ca9703e2dd5f373fe59e6a4de9857d3daf4a331e2d0b
TLSH
T125519BF7C3E54A6D8A1155F0AE146F1BCE2C0557836C3C5A89E4AF1BA7F28B1E10168F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f6b8f063a6a7b3b1da8b2ce3390ed5f820531eb7feb360ffb8c687eb4da0eea8
MD5 9e9d601fb03bd9d013c790699d90f0df
SHA1 2491569c77fb7a72af597730439274538f30382b
SHA512 100bba936b707d86bb9784553578f1f547dd6c20428b38795a314ae9efed9063b04f1d4dbf19566a4fd7d77d89b61d347df9bba26b12eeae0fadc027205a9d06
SSDEEP 192:sxZORwyM/jK1Ml8XkS/fos5WpV64ns1Glddpm3IHW6+WN0uUAu/YASNn4IgbyJ:sxZOiRS/fos5Wv64dHLHb0P/Z6
TLSH
T12462E7016634597BCDDBC21DFA46BFA3D6F9046296940E48AAFC991C04E7BDC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a20acb21226fa8c50f5357ac8901997fe0cb440fe7a4f6ed3ac0598890b1d740
MD5 8c2e23b0d671cb803c017fe40d4705a8
SHA1 3c898215b6b706112f8e6815d294332424e8280b
SHA512 264e11e2bd5656be15f11cca85fe3004e073f74950fb283670554dc1041e60107ddf7a5dcf44b541bcd6d39b0a43b5490897a94083c43764c9c0f19ef48fc3da
SSDEEP 192:sxZORwyM/jK1Ml8MkS/fosv4LIdpdIHW6+WNGYIkwTmIgrJ:sxZOiMS/fosv4UaHbGC9
TLSH
T1E542D8116A34A977CCCBD209FA55BF53D6F5047292900E54AAFCD91C04E7AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 2adc744eeb66e277f1cb2d880a41b52f834c84a903dff1eee855de190bc23ea5
MD5 b9fba5fd36db73d02a5cc6b6cd41ae68
SHA1 31f00ce38909f0be701fadb1b4e2ab8887fe4bc8
SHA512 2e29da571af01285c89ccb72305318e402eb6db0904921a222a74d71fc89194adc399a73ee018047124775c98870f527de4fa4987fe3bc4a4fc3739978f98a59
SSDEEP 768:9tsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9WroqQL:9tsqxXlWvJD6Tu1ja54LAs9tqy
TLSH
T135D20B3B694CCB7E4F840E5DEC266ED76ED801CBA6988D5447FA880C02CB3EA11165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index
Size 1KB
SHA256 5306260cb4c891837e21f77cdc2c89d1f78273fad975064669f940e8225a218b
MD5 0ca6cc01c3c46b65fa261301e9a50721
SHA1 9cb43486a98d4675c960851cb03da60b095fe00f
SHA512 ef27d9fb0d5b291a05aca8a6db04c163f57a4e1778daf51e154ed098525f0885739b8ee9292f01792b0592a9383c57974c9db1ec3f032a2253a682e25a668df7
TLSH
T11131518E8E50959FECA449B20472A1B476B0C9CC2B01D7134C3C61373D2736A2A1B1EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58589b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index~RFe58589b.TMP
Size 1KB
SHA256 37645e4aff30ce4de3d374a246bd2acb5a8c5d4cb9f84f58a32f27874a2659ab
MD5 13990b2f9ac91c295cdb8079426e11ea
SHA1 46bc9ec58211363bbc5051b24a82eea438aeded5
SHA512 690cbef4502a5a08f6485b6bf42da915ccf92ad9e99fb02ca9b97fa31c40304b34f6ffbf3ab88c52b89d077c06737f307edac2a4cb53a15e5099e5de82a0538b
TLSH
T14431938B8A418A1FECD404B20992A4B83379C94053127787987C6239BC753BE1E5F0D8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 ad1f100d3f727e853d31de14b61a3fb71760905af2bb2aa67ef122a888a6d427
MD5 592a1c6e703ba7848d9988a7b1e9d357
SHA1 55c0c7b05e1cff2a5c759379f1cdd26c3f45acd5
SHA512 1acec13ced9a13eadf2230c4d1cf15f6d4d09c5d0c60dc3f2271b3260fcd1b8bdc8a53670c2198e7ac795e6ae4d3500f1dbe5eabc611ec5d4b34c6186f737536
TLSH
T1D6E068762AE70814A8ABC3DA087244964514F428CC51EC4F0129928310622602832C27
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 64be434d65aabb1831d7b3a7e409297b88bf8eef330f01c20951b770af4d5daa
MD5 e3766c9eb6e51a2a3397e27e28014142
SHA1 3fdd71cc9534d487a0365be3d2b65c162a57f5a6
SHA512 8d8a854bd860d34b743951f1a386047d41e189736cb863217c3c1cf67e21b7cb90274468932e8f849526a8516451bea7132436a2368bd41e2ff5109fc4f89095
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5866f2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5866f2.TMP
Size 48B
SHA256 c86aa7741193a5968f144e344ccd03859c3ebc3f6cca0c9be6493c9861170cfe
MD5 d9ada27602d31f7dac1fe0e386e48527
SHA1 dba92cfc8549ed80c416ec32c775334e01f484f4
SHA512 ad1156f7db4d2b4dcc6add1e14d44b8ea88a7c45ba0e63a39154e3258089747220453517c675792e696d09d129f16dd29a74a1755c7fdd51f82bb9f6e4e00d61
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 35c20e9a32600240c8cbf00a450ee71b5cad2f34206dee76321bb4b05c940fc1
MD5 90843058b2c67cf36bf884c6fd6a1cd9
SHA1 15dfb530160ffae4bc7245f8710d102cc8a62125
SHA512 f34cb068642f4eb72e2192963a0a59ba6b00562ef1e8cedebf6c32d0f5794e29c1f5c5662312b7c070c3eb1a243e9aaa2066bc2509c6cdb43fd79e404f213297
SSDEEP 96:KYbaKYIK+P6Ko8uutGKuIRJKKqQaCMwKZ21:ExZBdPxze
TLSH
T1B3E13C42713B821238BE690CA27696374E8373A77518A56F7F7870720E66E114DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 522a39e14e7de97d238da4685843ff14a6ef66e7a606717983de327de1722882
MD5 56c481ca202135f534cab14ee672cbae
SHA1 60947f669fc459731577c19fb0e9a35eed9bc09c
SHA512 4714d2ded5b4d8b83fe05fdf3de021e4033792069a0174556a5598c448e4c8487e23a7782ca575d8049c1436dba4f14104196effdfda551212a7c305b28722ef
SSDEEP 192:tONc6JkRtQmiUygsXW+RNVOmSY+y9h3tReU6:tONc6UrWW+RNVOK+G6U6
TLSH
T1AE02E835AD381C7B8EF26E0AB58B27175FA8203BA9856B80D6D81F0C01D765C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 2c6801f3610830e91899a1be96b5c50af912556e7660608e17f00ab914cf6b21
MD5 a0cdbab2849fa0503c5358776a52ca59
SHA1 c414aca15f8c525b057c6cbda33fa6e4a66b3799
SHA512 4d5657ed83d5bb29b70955afe8ab27bf802b35e66c35cc095320942bd6909a3b7712d91b9988c2fb4ce7549d9714a5b53ba24e1b7a9b009ad491ef9ed0bb92ee
SSDEEP 384:8ZcIhsNDMTqUWbl102VRNVOK+t9FIef9AStQ6XUo15mkctivlubo+:qheUk0UHVOKs9KeqSj15Utitubh
TLSH
T10EB27CB1DC644CE709A4E1C9A68AE51B6D780037C68D5A4CE2F8BB3D30AF9F85357825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fd051ef9146514235425c7bb9985aa1208fe685a3cc54fb3bd573f8ef6312163
MD5 2389ca37f932926b3b0c6af33ae369d9
SHA1 2c852c7d88943de2b5cf8396dec9441f7f8ba1e8
SHA512 2f5e5820385c4bec414f4a0cc904e031a36cc06634adc66db1bea8b2f1f3ffc3db33c2e885bfe1d9fe6d370c0c7ddd4dc9742a35a4783a14e2368d9cacdbc2ac
SSDEEP 192:9ONG6JkROQmiUygiXB+RNVOmSY+y6l9nFgVcqqkZU6:9ONG6UKwB+RNVOK+t9FHiU6
TLSH
T110122A35AC385C7B4EE26945F58736178FA9113BEA896F80D1DC1E0C01EFA9C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 049644d981bf876be68a5af947b60435bd0bc4e70fa5914d7be3865ea9469511
MD5 c829cd8606ff51291e413f9c86d1a345
SHA1 3a6a0d18186d36ea88bafa4133511fb4561caef0
SHA512 0de8d7e33c2966f37b4759c1eeea3a277f03b8508ce328d8c3de62235cab1bf83cc213b119697865ed75c2eacadc5189a3976ca535d3305d25ed63061b73c0cc
SSDEEP 384:gZcIhsNDMBUWbLcTVRNVOK+t9FIiivlubo+:ehRUHxHVOKs9Kiitubh
TLSH
T1AD827D715D345C771EF69245F64B361B9FB84067EAC96E80D0DC9F1D01EEAAC230B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7474d52a224b39955ddf9b6ca13f4159cd2290cf67b5ba17c0d0235a629b78fb
MD5 79426f7a830115428de36a68ac540073
SHA1 d6ec8142c1e44b083dd7b0ceab8c16a43a75aee9
SHA512 0f3191f344a4bb87f6cd6ee6bc29492577356efb3604297b3751b8fab54f5324969dd2e0b88f1b6acbff95b3b045809832e6909b9efced695260876f9fe66675
TLSH
T12E412B5C6BE91108B3B76F5AABF6686E587FB9332B07949D00010D4E0622B40D961B37
MD5 SHA1 SHA512 TLSH

Submit Download

MEMZ 4.0 Clean.zip

Path C:\Users\Admin\Desktop\MEMZ 4.0 Clean.zip
Size 12KB
SHA256 15ef265d305f4a1eac11fc0e65515b94b115cf6cbb498597125fa3a8a1af44f5
MD5 8ce8fc61248ec439225bdd3a71ad4be9
SHA1 881d4c3f400b74fdde172df440a2eddb22eb90f6
SHA512 fe66db34bde67304091281872510354c8381f2d1cf053b91dcd2ff16839e6e58969b2c4cb8f70544f5ddef2e7898af18aaaacb074fb2d51883687034ec18cdd9
SSDEEP 384:BcN/xi5gj09+WA0dUHsTCkUdn5Q9IpIhkQ:KZoi4+MdTWkUd5Q9IphQ
TLSH
T15D42CF47445C827ACB3FDAB83C604058BE45F881917CF3459C9B2E6A4BB29D39B215FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download