hxxps://stim[.]io/

Analysis

max time kernel
211s
max time network
214s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
25-07-2024 14:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://stim.io/

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133663912862776735"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3637748876-3197268895-3385380113-1000\{FBB67344-9277-4ABB-83D6-556A27DD7416}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2220	msedge.exe
2220	msedge.exe
5632	msedge.exe
5632	msedge.exe
2256	identity_helper.exe
2256	identity_helper.exe
1688	msedge.exe
1688	msedge.exe
1704	msedge.exe
1704	msedge.exe
2888	chrome.exe
2888	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	3956	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3956	AUDIODG.EXE
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5632 wrote to memory of 688	5632	msedge.exe	81
PID 5632 wrote to memory of 688	5632	msedge.exe	81
PID 5632 wrote to memory of 4704	5632	msedge.exe	82
PID 5632 wrote to memory of 4704	5632	msedge.exe	82
PID 5632 wrote to memory of 4704	5632	msedge.exe	82
PID 5632 wrote to memory of 4704	5632	msedge.exe	82
PID 5632 wrote to memory of 4704	5632	msedge.exe	82
PID 5632 wrote to memory of 4704	5632	msedge.exe	82
PID 5632 wrote to memory of 4704	5632	msedge.exe	82
PID 5632 wrote to memory of 4704	5632	msedge.exe	82
PID 5632 wrote to memory of 4704	5632	msedge.exe	82
PID 5632 wrote to memory of 4704	5632	msedge.exe	82
PID 5632 wrote to memory of 4704	5632	msedge.exe	82
PID 5632 wrote to memory of 4704	5632	msedge.exe	82
PID 5632 wrote to memory of 4704	5632	msedge.exe	82
PID 5632 wrote to memory of 4704	5632	msedge.exe	82
PID 5632 wrote to memory of 4704	5632	msedge.exe	82
PID 5632 wrote to memory of 4704	5632	msedge.exe	82
PID 5632 wrote to memory of 4704	5632	msedge.exe	82
PID 5632 wrote to memory of 4704	5632	msedge.exe	82
PID 5632 wrote to memory of 4704	5632	msedge.exe	82
PID 5632 wrote to memory of 4704	5632	msedge.exe	82
PID 5632 wrote to memory of 4704	5632	msedge.exe	82
PID 5632 wrote to memory of 4704	5632	msedge.exe	82
PID 5632 wrote to memory of 4704	5632	msedge.exe	82
PID 5632 wrote to memory of 4704	5632	msedge.exe	82
PID 5632 wrote to memory of 4704	5632	msedge.exe	82
PID 5632 wrote to memory of 4704	5632	msedge.exe	82
PID 5632 wrote to memory of 4704	5632	msedge.exe	82
PID 5632 wrote to memory of 4704	5632	msedge.exe	82
PID 5632 wrote to memory of 4704	5632	msedge.exe	82
PID 5632 wrote to memory of 4704	5632	msedge.exe	82
PID 5632 wrote to memory of 4704	5632	msedge.exe	82
PID 5632 wrote to memory of 4704	5632	msedge.exe	82
PID 5632 wrote to memory of 4704	5632	msedge.exe	82
PID 5632 wrote to memory of 4704	5632	msedge.exe	82
PID 5632 wrote to memory of 4704	5632	msedge.exe	82
PID 5632 wrote to memory of 4704	5632	msedge.exe	82
PID 5632 wrote to memory of 4704	5632	msedge.exe	82
PID 5632 wrote to memory of 4704	5632	msedge.exe	82
PID 5632 wrote to memory of 4704	5632	msedge.exe	82
PID 5632 wrote to memory of 4704	5632	msedge.exe	82
PID 5632 wrote to memory of 2220	5632	msedge.exe	83
PID 5632 wrote to memory of 2220	5632	msedge.exe	83
PID 5632 wrote to memory of 2960	5632	msedge.exe	84
PID 5632 wrote to memory of 2960	5632	msedge.exe	84
PID 5632 wrote to memory of 2960	5632	msedge.exe	84
PID 5632 wrote to memory of 2960	5632	msedge.exe	84
PID 5632 wrote to memory of 2960	5632	msedge.exe	84
PID 5632 wrote to memory of 2960	5632	msedge.exe	84
PID 5632 wrote to memory of 2960	5632	msedge.exe	84
PID 5632 wrote to memory of 2960	5632	msedge.exe	84
PID 5632 wrote to memory of 2960	5632	msedge.exe	84
PID 5632 wrote to memory of 2960	5632	msedge.exe	84
PID 5632 wrote to memory of 2960	5632	msedge.exe	84
PID 5632 wrote to memory of 2960	5632	msedge.exe	84
PID 5632 wrote to memory of 2960	5632	msedge.exe	84
PID 5632 wrote to memory of 2960	5632	msedge.exe	84
PID 5632 wrote to memory of 2960	5632	msedge.exe	84
PID 5632 wrote to memory of 2960	5632	msedge.exe	84
PID 5632 wrote to memory of 2960	5632	msedge.exe	84
PID 5632 wrote to memory of 2960	5632	msedge.exe	84
PID 5632 wrote to memory of 2960	5632	msedge.exe	84
PID 5632 wrote to memory of 2960	5632	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://stim.io/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc8ec73cb8,0x7ffc8ec73cc8,0x7ffc8ec73cd8
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6624 /prefetch:1
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3068 /prefetch:1
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6328 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6548 /prefetch:1
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7032 /prefetch:1
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7292 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7448 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7612 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7952 /prefetch:8
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6784 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8196 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8584 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6872 /prefetch:1
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6676 /prefetch:8
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=8084 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8784 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8640 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8436 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8824 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8412 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8344 /prefetch:1
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8384 /prefetch:1
  2⤵
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9168 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7692 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10650137057292193119,16735637992186254826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:1488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1148

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004E8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3956

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ffc7d45cc40,0x7ffc7d45cc4c,0x7ffc7d45cc58
  2⤵
  PID:5724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1948,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:5860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1700,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=1980 /prefetch:3
  2⤵
  PID:668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2080,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2156 /prefetch:8
  2⤵
  PID:2100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3100,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3112 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3116,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4424,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4784,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4792 /prefetch:8
  2⤵
  PID:5320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4768,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4908 /prefetch:8
  2⤵
  PID:1920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4968,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4448,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5408,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5504,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5580,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5440,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5388,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5544,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5804,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5360,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5968,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=6212,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=6268,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=6512,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=6532 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=5784,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=6744 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=6900,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=6884 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=7052,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=6684,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=7140 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=7320,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=7304 /prefetch:1
  2⤵
  PID:5868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=7456,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=7444,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=7588 /prefetch:1
  2⤵
  PID:5932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=7460,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=7620 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --field-trial-handle=7720,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=7856 /prefetch:1
  2⤵
  PID:5444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --field-trial-handle=7840,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=8000 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --field-trial-handle=7984,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=8144 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --field-trial-handle=8152,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=8292 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --field-trial-handle=8276,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=8436 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --field-trial-handle=8584,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=8468 /prefetch:1
  2⤵
  PID:6004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --field-trial-handle=8720,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=8444 /prefetch:1
  2⤵
  PID:5996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --field-trial-handle=8864,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=8732 /prefetch:1
  2⤵
  PID:828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --field-trial-handle=8908,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=9020 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --field-trial-handle=9028,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=9156 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --field-trial-handle=9180,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=9304 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --field-trial-handle=9328,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=9448 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --field-trial-handle=9456,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=9592 /prefetch:1
  2⤵
  PID:5132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --field-trial-handle=9628,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=9744 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --field-trial-handle=9600,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=9884 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --field-trial-handle=9040,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=9116 /prefetch:1
  2⤵
  PID:6896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --field-trial-handle=8284,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=8016 /prefetch:1
  2⤵
  PID:6908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --field-trial-handle=8044,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=8056 /prefetch:1
  2⤵
  PID:6916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --field-trial-handle=8116,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=9836 /prefetch:1
  2⤵
  PID:7028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --field-trial-handle=8364,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=9848 /prefetch:1
  2⤵
  PID:7036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --field-trial-handle=9344,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=7492 /prefetch:1
  2⤵
  PID:7140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --field-trial-handle=8348,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=9312 /prefetch:1
  2⤵
  PID:7148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --field-trial-handle=9316,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=9400 /prefetch:1
  2⤵
  PID:7156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --field-trial-handle=5720,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=9772 /prefetch:1
  2⤵
  PID:6396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --field-trial-handle=10104,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=7664 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=9396,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=9364 /prefetch:8
  2⤵
  PID:6820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --field-trial-handle=9376,i,5158745762851758328,15121438901732274626,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:560

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
PID:4964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\01943029-70b2-45c8-baaa-7c504ebf7e49.tmp

Filesize
10KB

MD5
4ce33459c85ee892c73a3bc2e41ad52f

SHA1
3afe1921db86dd712f90092282ee375bc1d1b784

SHA256
6693074fdab0a19fd1931b95a9e681de632fc9cc52dcc939fd470dd390d104b4

SHA512
15a3a690a9703f069745da8c0dc206d00e868d6af762ae8ecc649f12e72e29e5c6d69d4f4b05d5b955ba6d07c5156b507ed0d4ec32e0604d1e8b00f5ea59ed60

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
ed4179d105528b7f1855acd9ce033839

SHA1
1c9adbae78dff3e550ddc72aef48fed06f87d59b

SHA256
f06538cb9fe5da6e5927e5b4c347f2ad6367f5edf23389ccba348b4699189149

SHA512
fb38d775f4b657c518c1dda733244ad08cfb9875a13fc03e88e47cbff1ac8040d56f15621ee267f06a5df6011c45bc3bfd938a63a6168f7f7779d610df384f93

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f

Filesize
142KB

MD5
dfa51f8fd2777df81663c4e47282b0fb

SHA1
8d2e4ac23e115184237c12824533ca111c12c117

SHA256
7f25859044cc2d1338d723bcbae6f4c454420da8335fd4b00dcbd38eb4e63946

SHA512
ba8cf95ce717eb0beb3aaf105aedd3c5eafec40c3174ecf1c886b6e440a53c43901ca5f0d0e6865fc64f732eebfdcc13711e43d5e9d5c8a68bdd73c6a76f9cce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010

Filesize
83KB

MD5
1fa3b145c6c7c382832ab30d3fdd4f85

SHA1
6322e1680b0cb038f99459bf90659b6753bbb7ad

SHA256
48d4ed65b210db98659e3ec192a001df2ebf792b37f49eae85b7c93c15d33a15

SHA512
f93343d98f4712969ed29c2aacc5f28cc2cabe5ac1eec5da7e721dc9551c1e0d615553a61aea4bf41e52fa4f161e77027b9098406d3a80faa03656f874128b53

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000012

Filesize
33KB

MD5
e54627f2b63c916a9a7864138a16237c

SHA1
4af3fca8c7682da24ca42ecbffddd2a40c24d639

SHA256
7c6d299241afe7ccb67f1fdf8b9edd1eeda158cadf3f2819f6022780ff5b594a

SHA512
4e01ebdb82586406676d4175970d46f266eb43736e8acccb88f8e4944663e50e02dc45f4e05b000d9b554463cfee42d9935ccca673b1a5fb07e0c58c89f3cafb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000037

Filesize
62KB

MD5
42caa5394be00aeb88e057eafd4adb21

SHA1
8b91faacf2b7ece910a6f876a0ca6850334a1b32

SHA256
87938e4f4d76399f0f7bd19469916684fc6171ce362f657c7f6e5cd079091ca8

SHA512
c5e765e4fdb376259d717934ee85b878869cbc3991d2022ff8760c457677adb72a7eee85dd9afdd74f29d93b657038411088daa022a2658acd4f1ce3cbc61fef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
7ea2264200a7919e4acaeeee3f340f24

SHA1
de56406e9522703d7306fd7d4525cffe8dcab3cd

SHA256
605a7b3bd472cdb44f8ee7d7019a16e329a5ba98cc09cd9f1ea3539edef6e916

SHA512
3120d5469fd0aba90d671c2be61c2882a3d29532356eea9737b635f66d591b0e3d257ea59a1ac1e65c556ce19d40135b1665b407b3c42984bd90ba63e44ba857

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
bab8490f8a6b0d660b464a5d8f925a5a

SHA1
20890caba2d2c0b987e658141b47b6b789a6732d

SHA256
fb6be1be3a26d8215b1d6c7bd8dc52eaed5935cd2317451fac7957532713d369

SHA512
6b04e48383f21a02e034bfb54ed7f6db97c87bee802b26ce769faf207d181a76a2dab6e29c7c6ed3e280f36adb5516b735487fe044829d56df93e382f6f6f55d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
36KB

MD5
ffe97b4c573d1b00397948c7f0a29a39

SHA1
28990747d5a826a414f0cf2645c33f3fc451f3c4

SHA256
5d189459c24b9f7cdeef4e02fdf680f3734df54e297395d8f9cdf550eca77ffe

SHA512
187ee4ba742262fc45251d988d681ebf2d2a101a58912af8c71239c3f94efdeb090703091107c4d0d34ae2b0ca226b6485d0e24333cafe4bafb843bbe0209597

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
38KB

MD5
0d64bed7987df5ffce4d2c55ca2812a0

SHA1
989936cd59506eea7ebb526ea6c35896e81fd96e

SHA256
adec124a4822bc2d1ff3c144426af459effaa54580e76b3bd59f136bd3bc6288

SHA512
3389ef580e8e5896834aaeb15c50c28cfd832defc404aad4b8919c425dde79ef82790c87cbf27a0f1aa6a9f4436d5ad97d6128591d524f0db0a9f370ec4ff762

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
52f196e433038639fd76737118e8d98e

SHA1
92ed46d17799bd4cb74a93ddefedf289c7dca933

SHA256
d3b11a3034425b26645ac0b05e0586830d43f352c8c75c23001c95ac2280f68b

SHA512
662f62630ec6caef24bef1e03d56e860acffde11410b02884af4bf5066a6de0b1f2fa9e73f2394701120e0bb7ada2d2ee13ece4a16359ede9ef73f3a3a11ca59

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
6b3ddc47c4495c54c2f9552f5350a6c9

SHA1
bc447e88a150bbbc96fd7e31f390eeece9c05845

SHA256
4f14d979d398fe6273ce620c0ddedbf1f4f9aa63ab1fbad3ba5ecbc6ef7c73c9

SHA512
f8f2361b2689312a19282064016948c989bbcf304ab291f8cb26b74d6b5a382b21e0d6cf6282af13580d75686519fc3cc2fc9afc1d3b548009fdafd551c22ba9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
c73864cbccf6e66a4fbf116c2154d9e3

SHA1
4345f7461af8128494c103bbadfde2dd2a3518bf

SHA256
cf201d1525f702b347718ce905fa5a910e22887e79338bad8fb943ef7209008b

SHA512
0d7e9f38b87892ddc2424b9f10249e4f899f706f1b03d255f3777feba8f12c52a1101820cd58bc89967580ae1fcf51348fbdcbaa7811110807823fe4a81d1e8c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
6acef86152a0938fc125dbfb6179ba85

SHA1
91154dbdf35fbc386ae51282ac2524c78aac8640

SHA256
8368ff7a67a1cc6563b10abb08e9e2db73255bdf612555a1af096091a947bf84

SHA512
3c66fbc9e6e972b9c601667e41a937039350252ebed4f10863cf5b2d9ca26284559208feeec12deacb44e9cbd86b44428936db46255efe2aa70b9c0f601aec81

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
224cd9fda6d4604b59582308e785cafa

SHA1
ef1d2b8306c754c79d42c2d5623bda177900bc7a

SHA256
02fbbe38797bd19b09af2685c2137c9b32e7022e6f7e63d4c0be692497fb6c4e

SHA512
4a0e738299d1476bcedf0e745e15057363da5886308943c906461604ac25dd3f9fbc07f9abc5792cae2023e425933f24ee142c47dcf8bd40b0052062abf2189e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
b0022a820c69bc4341445c346268d11b

SHA1
abead2ec3044a6cc8776852989026d3d9fa0a43e

SHA256
13a4b5c349a16b65bd2e602119d59558026253cfdbfb5c8eb7effd496233a450

SHA512
66e03e2e7fd2a3d7906cb551036762f600b21b95c520c179c2beb1748dd3700045e9174eb4d526add656e591f90257147acdf94fb15cce82a910bff34af24e1d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
6abe94ebc9753eaeabfa16706df1ee58

SHA1
f99f3a38b768e5e8c2f035f05ce005676b56a677

SHA256
3b322acc89d07426e28d5d874bdfbf223c852a3df5448bfab0debe1673ed7e5b

SHA512
4cd1144c0d7c013cb0ab9f7484775fc18bbf129fbb85a96af93e7284bcd9180efaca27da2af0de09d53cdfccb48995f1fa509687c60ed76c51a3fbe48d246114

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
ad3d375cbf21f336a7cf30f5f8d055b1

SHA1
acbdac998247245bed3131af6159e2bffef20f77

SHA256
035b16192ea4b6e193b46100e741aff60d80dcd7200cb65eb028e143b2bb14f7

SHA512
2c400902f4288673aeec75cd6cde9e48b0d57e66eb7cfb249175da6798fba53f75cfb6c125bef4baec7cd915e96fb523d848b1a38fc74a8e67967bf90f734afe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
523B

MD5
c4d76b672c5b61d7a0dc5617efc88752

SHA1
946dad15d19124c9e382653e0e5fd9b82aaee15c

SHA256
c319b161ee71a9106c1700a9704178587d37124902db1d8ea88ae687bb232654

SHA512
9c47a3e0183e810a39b1d18119db2c0733535d20a0f50440d4f0b3c70e6d2b917a607fbcb1a646f6be5b7464f5b0a382a697903690804afd7b76fe3c80ab22ef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
62ecaf67f431ab03e8fbffe34e31d27f

SHA1
dd7b534ac44ea89a56d547c4aab4650f7e1e9351

SHA256
d6e6d6e2b82afaf90222d23a86089967b971c7a8422a4d0f1c50be6a92b29d50

SHA512
1487933f7336916bb3f6c8294f75135e315c7a3adc632fad49162057d8d4b53174ea307d49b48672636454d46ddaf2757c637c8f265414976ed7c7f2c8279f84

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
847bcd57b503621e99992f4a3b9ca199

SHA1
63e5194b88130cbe60b9930625cde14075d76d1a

SHA256
9fda779ae7ee360da092360265c8ce4c32b1fe62f384380079f37894c1419e82

SHA512
f70bcb7464c494fbdacaf49fdf69524554d543d28780f2ae36bfbd6a4a723aa64dafe5bc101263ab3ac4a5572c982355f72a2f52ced00a80db32762beea060c5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
b6304675b9d6a21bf89942b532c491c3

SHA1
da5511026c86d5edf82c81f01bd7d9b2303b4923

SHA256
aa10eda6aa7e30fd602c97d540c25dfd957c34438fbd8a6f12587a0c683fa356

SHA512
326eed6fdbce3db2f5f466e40e1f98b84e1c741d54ee230c7c5da8bf3044cdda0f68a17ba70c0e7bdbd924b528e21ebd9cc9f4a2492ec6d4fd65eddd0133f481

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
74ec096c6677b1ac750b6b88c72ba464

SHA1
bf3389ff5d4079e3e753d26d7f22fa111807e453

SHA256
b22a7e0d116ce1ef80169ac4c841f4292f237503b84d2c7b45a5b900d55c3782

SHA512
0ba1be44ad5477a188388c55280f1f8c7cfd997b014ad5cab048ea270f9dd1e8e30a5a7616db20883987fe0ebcc8dcc27d5db33446108aad5c1f10d4e4cc614d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
07d6c4e5d0ff9008a5b1fa981913afba

SHA1
192a276d36593f3f00f406712acd1c4d38a5f705

SHA256
cd1abc4d766a56b0fec54d9505287cf09bb41fc0d4692c13b63e2a00ea6d8788

SHA512
c5db4bcf64e9116a535d6c49f68065ae10abf61d59e2310102a436de6d72ca5e4f5a2e81205367f825b33109ec24e7891a1e2005bb919af5bcc63a83bebf0b78

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
66335afefaadc86052dfeb81606d2243

SHA1
754f28c00e06f720d57894650062c3b2509b0702

SHA256
8feabe4556f3c71ad7cc341c589036b0be4332dcb90dde7e3ea146814850b692

SHA512
57df59ac544bb946b2767ed62ca49ac133ac436d453f69a12d7aa9f73d29480e209b23d275e57e0e5d71f8c48e4ad29a2e644f521fb616a1e96a472521e4e7cc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
89258b2c76524e448600966ab7e663a2

SHA1
f2956e44d47d5264673182a385f5d7ec1550f79d

SHA256
7b3db0c01adefb5567aaf60e664d9d335f08d018b210b7d6db9290eb3d15cb95

SHA512
f5c2c447076e146edc79ed065619a6565adffe81204c3a158ad5ed7c823a1e4c02b60ca8becbf83f92749cb63b02f59ee250bb04e575e1057fe853124d180ad3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
56029000551da32309614aa8bc84e609

SHA1
c57e9c6ee8fc7c4fc30a5ba166fb77a388907b52

SHA256
6acf0467e0eff6d8d24a45fa70692de5fe151cbce059a42ab17e42675b326a6a

SHA512
f77c6fd721289423110b298493b530a2f55acad0e31ab9cfa3ace01810f24bba94ba97d5648224a18fc1ab89df53a291dc602817c20ef77700f8b32766ff4b4a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
5a66ebf591dcf20aa8dd8e4899b864fa

SHA1
6c72b1e9d6d2e8a7b7099e5df3e0858a6d7f4572

SHA256
c3e13376dbac82f09d02ddf49cd9af476e71dd1322793264bf73470d9a61987e

SHA512
86ff5d4995c484cbdbb530ffa6821d85d6f7c64757e8ce30853142772362f9ecbcae7987169ab4d079d14fe54415414f66e71829938159cd49965facf8e0fdd4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1

Filesize
264KB

MD5
09ff4ae9e94ef677e3a9067e3434aa59

SHA1
25c749cc01f8170f1b81171d6e01b9f3c54e5bd6

SHA256
20fc03335eec39e10e1fb354cde5e4f7495d9a4c8af695dca4db646ca70e6b82

SHA512
52e4971bd0cd510287393e2b193e6e67960bbcd1874c064ff95126cd11e5c9f233a6c07d990261511dc5ee3c11b0e213ab58170355b46b410716c28a6177007a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
188KB

MD5
27bbaf57f2c092ef44f3fd06b2396b51

SHA1
d1f8626c3ea38269ebbeb6269b39ca0f293e151d

SHA256
4ec6978d7c7fa28a50bf6273614b145034f848375cccbe363a9345491a81e2d6

SHA512
9d1865d4ddafb4252da75bc96da9c7bf6ac33c47a90a4882b590881de1d9e79851deaa1350635462ea0bf6b8db4eea643e228d165d7b3a836b42c740e46c5508

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
188KB

MD5
279ccd59df7b5737bba637c2356e5b38

SHA1
970598e8a9e0d6501f446432334cb1055b33d730

SHA256
33cae1d853a6b9976c3b7b6922ff65881becc0c13bbe567f34909d521b0caa0e

SHA512
d3496dcaa517fd7750d5654accb79aba0e6da2dc688b6a02b4073006fffed76f8c3fdf01ad8efb7ef79f2d5ef3c56b94dbbf428789b1dcb81751acd37a5ba67e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
188KB

MD5
5842568c6c17e472c592ddf8b763aaff

SHA1
4a7b921fefc6930e065e76b85d5b1cb79cf57de1

SHA256
57624aa628e97d825e656b39a761522c0bfffdbe80809c69f61f824a60342989

SHA512
3ce8064e12802a3fd15092e91da84e0e3a31a1d7cad620a8ae8f2dd949d54ca0668dd34f7d0b959c645ed0138649ddc336914d5725505ef673ab3b5f82571582

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
188KB

MD5
cbc2ce2b0f86e6277dfa528b18b3300f

SHA1
e91bee04447e9b4026dcb69c87fd7dcef40abefe

SHA256
478f3bb644cdb0d0db3fc06a0a37ee966033d2d15c128ae12b895a0aef11c319

SHA512
a1c3a703f1198e37a4a10e260c33666f3248c005532123b998fae4cc7a0ff5ff1f35ed3eb5768048e11dc5f78fb6bc48144b7ab262018a76b7de91653af8cba7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f1998107017edc46fed4599ad24cfe53

SHA1
47e92f0646f0de9241c59f88e0c10561a2236b5e

SHA256
cc6838475e4b8d425548ceb54a16d41fb91d528273396a8f0b216889d79e0caa

SHA512
ef7228c3da52bf2a88332b9d902832ed18176dfff7c295abfbaab4e82399dc21600b125c8dad615eb1580fab2f4192251a7f7c557842c9cac0209033a3113816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
21cf39beee4d807318a05a10dc3f1bf3

SHA1
01ef7fc09919eb33292a76934d3f2b5ba248f79c

SHA256
b766823dabbf6f78e2ee7c36d231d6708800126dc347ce3e83f4bf27bc6e2939

SHA512
0baf8b0964d390b9eb7fafd217037709ac4ab31abcdf63598244026c31284cd838f12d628dcffe35d5661ba15a5e4f3b82c7c2d9226ac88856a07b5b7b415291

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
26KB

MD5
f5d0885e647761ba08ee6a46f8ae408e

SHA1
3ca4bddf8798083fba1cbdf974f082205c87f824

SHA256
c3f8a054f99bdeabed6272cc0ff9891b16e81fe3476188c1c35442c5a8b2ea61

SHA512
ee176870beddeb1245af0b59b834d1f226c1a1add04b15f8eb0d83e2dd6b7abd171ba054ac1a7a8069be8b760e3add8605703f7e20b5ea02df64e51c287cc7f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
32KB

MD5
bd045eba4c7d371de579dcfb09ac864b

SHA1
7b5f150bee082ff780e9a84343dd6c3b2482dd13

SHA256
9c0efbed8c94691cde323e005869334936c7bc981f6c55bc24259ac28f06e84c

SHA512
5be13da0eac690ce7f860047b2539357c970ae0b9f48c6b4195619d547b42c73d30e2142dad5171a1c220eec7b6f1ce93442be67c555cf0b6b8097023cd2bc45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
161KB

MD5
b252500c4c2bd33ae931c7ed428932ae

SHA1
7e58a40b7f473d19840223efff42c96d43dbbef2

SHA256
4ad6f0d96fd2e83efd58067f1d8ce2b4a6818ccd5ab7fb13fb91fb7720e66a5a

SHA512
52335532b8596dd7b1d17b3ea87a70d03fcac6b9a7fdde9480f47ee36a07691aa755530487c1a1e3fbb69890cfac4273f39e17e2358dc29cc768129fc7dc65db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
38KB

MD5
d7ebcf6e10a82cded06cba2d1867cbd6

SHA1
00ae8060ee01c91f14e5497226ce91249871188c

SHA256
c261132737170763614ef79e9e85e5c1379589aac0e5ec96321d0ab341b7d20e

SHA512
cdaeb990ef93a047675c856f98fa113395d0881f1a1e20cd29672eb9a4b1c074ff357586f70adccb03bc385e34fbdf5ecfe2ee84bcd78db8d0168bd893cdc44d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
51KB

MD5
18d4a11f27dfecc33f71ef63493d44d4

SHA1
7fc38a8c27551499e181e108e3ba9bc4a3f5cc5c

SHA256
1dd5718f0a3514bb9f6834f38b8f978c28e3883652b898b008a4c5db156bbb8d

SHA512
43357f34c4a765b4660de3fd186b2f2a5e9df946eaa07cfc49c3234e751366985aa6adb9de4e977a3381ca6c004c2d49bfac04d9a87aa63351e222355525abc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028

Filesize
27KB

MD5
19e25751a0c5cf9d79615c41e4753233

SHA1
535d3e6d1bd2d371e4a7cc67f34bfcf8ab29186a

SHA256
f9f8af0e5e6baefb12bbf86c37b3cf3a698dc7da8751908bc8afafaf07ff8a35

SHA512
50fc2ed9119592462cf560193b52da80f6fc3c81c1dd1d90fa46f1373e5e43ab11a115d4c3ebbfcfdbd4d84aa3f161a339f1d21d45b2df8129360f6d4fbea897

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000037

Filesize
20KB

MD5
12e636f1d788211d64c7e085be42b6d7

SHA1
45dd78f6c42a73de7fad6611abcc29e93751b483

SHA256
c7f6ad61c450bd027955c322f191e9eb4b9f87f70936f7f79ec6a73e0bdba1d7

SHA512
a49903ff20f1fd8a4873dfbf2d51e43a03e95bf0b939919007af5ad27f1507b5574165815bc75b499d20f4a925835b8e8167ed7e0b940c53d28dd1256cd5fc62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006e

Filesize
26KB

MD5
b8555cbde776674c4485047b5f12e4b3

SHA1
1ac6d502523dafa7d78b6ef6038eea67e64e7829

SHA256
388e30e4f9a944acb4b50fa753af88d623cc916cbbf7ecd3fc33cb17df52c98c

SHA512
5d3f3f9600ad9387565e34a5e5070cdd34caca36758549630190eb52254f07f02d1d36045b6303a9215a5233b5ba54ce9c3d1cfd83e7df931dac49979ed38085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
7c33f262342d4dc510840183b16249c0

SHA1
a8e09abc1365d8c722841f77fcd9c7be67497484

SHA256
43760b49486ca873d665daf10004027b50d715ff46fa87eebeae5af6b3c60fb7

SHA512
a3890b81305820e3180f2142d80bb968bbdc0e286c54fec8ee6a81d32d7d29a985f33276b5e6f58f2050955991b4cab3bda4d20e378603e5944fade326dc4f07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
805fc5a940474bff73d812fcb18ef778

SHA1
b54b6321038fb39db883d9f13d7b7b100199515d

SHA256
28c8891ad105806adfd63216797a48296b81d0b16b57d9fca37c8c1e0426223d

SHA512
973c742c8534421ca338d0ec0065ea9b15e57d92a2e417bf83bddef50276f6dfe560cd65b2d0051a6aff3dff0b5b26688e6e389dfaf8a09c11df3c0cc78748e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
13KB

MD5
e131721453e3a4a9d36881a0db1939d7

SHA1
ee3d3ef30b09d6fd2248c9d32c2253f58f71cd5d

SHA256
f3cfefdd5515093dd15694887b4b3d9c68aa8ecd623c7799b0c0c4a2dbd44987

SHA512
1a6eeff89b3fe46bc63f3646719cdba2971b7e21db3dae4daa9a0d35833cce00b086c7c7c845f0529d210dda6694f0d8111d231fb605560918e40ad2bea55065

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c76ddf9bbe4af4e0612fe138ea2af3dc

SHA1
063fcade52a56aecb6a5acf4ce4d58ce2438d863

SHA256
558fa9269f7166f515c51bdad9d0e24cf2391397f585376ee4efc2529835e03c

SHA512
39f62816882f525c30eb505eee3f232029f7881eb714fe97151083f8063139422cc0fc311fe71806747d5b2cffbf8d6ca3d5e5ba0b37a6a24201d241a39aabe3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e3b7fe13c0240b3ca943c61f85948b67

SHA1
79b1fe01e58b20ddce03700a84e76e457d42cf40

SHA256
bf680c9d9f343e4aace7c1701924ecfe5fd7e770a5992daafbcf7c20b3e9b130

SHA512
1a3e9d1141f29dc183e6de7b89a5801b85c12da6e2941ff2eefebd49856d4c9098a9ed38dd9f78cd49dd0a99a968c6a43207c222e473b76efa53421133f48aea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
93349c73bd0891bcc3909e197bd2ecfa

SHA1
3663cbea59f8838dac4d52d4f0f86fc9bcf9cf5a

SHA256
631f610c4a2a2a853888a70c9b7126a0adfcae6ac0e7b99718e928f41d6e839c

SHA512
5ec98275df521359293554fec14a1e0b521ed9e72a1514b6ea9a0e5603e323d161a66e82f44fcdcd78d51b66a920f20fe33e8eb97346b3873c8c7905c7b44bcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
f6dd27db1fb7dc7955e465cc8a356990

SHA1
66b6e7ab0520fd7a19c75332242aab36f93a06f6

SHA256
0f7ea4a469edc16dff9b6acf2f3080a34531587046bbb7d10abfcc9dcedb84cc

SHA512
6341ce1c33a23e10ab964b24d06647da869d110a8a0d0a93dfe57242e44c069ecb8231c59f82c878b6b8e0678dd6f9c7dd6663eac5c459e06a02c9a5a029a46e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
96eebdc0241498adce0f1dc9d5222d5c

SHA1
068c2842bc4f3fd1a323aa7ac1c047c3ebf008c3

SHA256
b69724ceeca6fc232863f7620c9c18d3639f1ef89737b93f781b80a8301d785f

SHA512
361b2dfd1c8f50a7c261d105d970718d7705d480fc24a110aeb18b489aa7544cd240a51235303d0e21f787095c0cccee84b3f1d6b1f47464ca2db96e70563f13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4e5c90ee408d0c26417472d3f2f33896

SHA1
e6eb82dfd6236b9d785daf1c100f6cafbcd81c4b

SHA256
9630d8ac546afc4fba15d79d9ff0121a782c468635c8bf2ed3c24a696709c3da

SHA512
9b595373b975e4d0934ca776df506e71c7ade34d806aa35bf5cd31b32065ee1848cf0955249ad142d0f18fc49774e16ea3e4620496ed7a8490057647e33b7b52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6fb642291655d8f7a34c8b60c3c042f2

SHA1
0f7af3e28328d387709e6b3cdba1b223b05c9eca

SHA256
b723876671da785f18027900b414e112af7cc9dcfbcba30f842d7ff17ed1818b

SHA512
2655d6a54425128dbdfee0721696b549d3db936633d6241494a9abdab06c12c743e7ca2ac3dd60f1acc360169a065f7d2eacc71a038a1957eaf7821209ca26ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
65d28a0fd253be0dbef62b36ef91cf96

SHA1
2aa35f30696bc43547b65ed83ca232b87cb663fc

SHA256
9ab5a4fe11f6cb7d65e64ca52ee5685b968a12efa5330804214d4bbd5788289a

SHA512
b4e882785c0e30710c6a816e04473dcf292f2e2fbfee846ff33ed030548fb77de96a22a4e4152bf17c63bdb5d09fc4a907ad3677715804edd89f3fafc52004a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
bf47ffa0b2bf04aaa279ef33807df68e

SHA1
5840fc7edfb2b703789e0f6beff44ce86027f4bb

SHA256
6f5a321e911b38e9325d9f85cd79ee093668956dbce73b5a71be8b281a472cb2

SHA512
7646816d5a529f0519d2ec2b6f7dc5c7e25ba53be251909fc72e635138a063750f5eeebc540dafd9d33729f6aa294af4c9b825b7c6c5d4579c80f19c090e30f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
8b640b623bd1f1a5396ee2876d3734c1

SHA1
1149dd453a30d6b5e7f785f7407ab6e1011095c6

SHA256
76fafbaef18ecbe356996d7bb3810f7703761d1b09423a4811d87bc73a5ce420

SHA512
ac28dca12ba9463f881e7fca888fe7787ddff8415187773ff869c70abe90f68d5064d0a802896d363760aad16af017c8f7e525642cc6c708fc306eab87127e29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
0746804bea940de43fa6851e4c2029b5

SHA1
bf278240b4a5eed286f655798ac813b3cac0a4c7

SHA256
70ffa1d0f983a24f7fd556e6d05e733c2d890580f4f4d29a6a980bdf3692d915

SHA512
4554d5910b8f22773fde12c7de6d5c2c703d0d3e570630a66a2c40ed66b6da29ecadb3d49c500162eb4df4b06c84e7b842b978663c793c8f547973065163d0c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
1c3a2031508a542f57989b9f07738085

SHA1
c9d6fd5cf40596c4086913d6b6cd4d04d901d97a

SHA256
0e01110c4bb91ff233e4d0285a4ba91bd36a9fc210b4ff05901151d7c254e8d6

SHA512
b9d7840221c7d17cc82ebf897838e690c0a33a9f88b6f5f5f6217c32c415ba804f3e36f854d9c30a181df90daddcbdf29a6bd672c762dec4a36ddf4a6308e9df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
2504c12c98edd0c955a9a8146debd6b4

SHA1
eeeb729f6898406a90de29fb938f696c122aaa2f

SHA256
901bed760147394c2353688486da235b3c1d3c8a01e907726d9cb23a12abc8f8

SHA512
2305aa4890717885725213597e369804a84888130953bab827bb9941c3817cd117355fa84fe5f86047cbe31d4222d79ad367fe817196adfee21e3986522eb8e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d37c.TMP

Filesize
872B

MD5
29e14534d3c5b2cd17ce6e6a18eb3ba9

SHA1
929922786435af37b9143cf76792b9d9b93c3a5d

SHA256
1d0b0d7ae79691f43b786b48b5e9ec59b64cdeaabf842e1e05f18941bd5695d0

SHA512
68e7ee1cd73db7d048574840ef7cbc51eb52d6ea4be32fcd5b1b8edc6f5f0c14b209a5b45069bcc3d53918660ce16120b8b9fea4a1b71b0e3fb44f9480f539dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000012

Filesize
26KB

MD5
8235f98068f731038d8520df4727c625

SHA1
6ef1e3ca36d59de490e593ec195b632e8e09565d

SHA256
98280dcf81e7ed7a29b2d383c12027481bf771aa6358012ee5ffcc8b3af21e38

SHA512
d75d4b688898ee9c9ee07f7be6e9dafd0154518ac54042270666969dd15dbc3b7c8cf92997c510f42f20a5ad8270d5324dd8f2ef91666a9d6d0450d60bacfd83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2a82da4a3ae7478c33bb0b7765bf0aff

SHA1
7a727d66e257fec58f488845b0b322e9c379d4ba

SHA256
975588ecd8acefb33e62499535e82f389273211442fbd4db8c7b64fbed767c92

SHA512
83b391833c034dafb053bcb6eb58541df63c9d8f14c405d8e07f6d2a8b4d5d11d10048af1d34e347cce1499c3476194632d984fcc08cba5935e86fbd56d3748b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ea44b2bc2135a6ffbe1ec8aa5bf635f4

SHA1
fadc3a3f2e7606c8a9400424e2b26de349c240ce

SHA256
02c398bfa157cd6d9f3c600b076807e71ddd86d347ea527f2f8ead0a8c8accff

SHA512
ddca96c0ffd75b567230613a2a95b8a917b9cb889e0e0c4a74887b32f51d6b1fd5fe99652ccfacc263eda993644b2104dd8a9d2ba6fc165f6fa1b071a0ccaf09

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit