6682a3330604aaf31f6916ddbf3b78251abda3a019d15a53b1ce33b72d5cd072

Resubmissions

20/06/2026, 04:12

260620-eskwyset5v3

20/06/2026, 04:08

260620-eqg3aaet4z8

20/06/2026, 04:05

260620-entnaset4x8

Analysis

user interaction
yes
max time kernel
127s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/06/2026, 04:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SteamAchievementManager-7.0.41.zip
Size 55KB
Sample260620-entnaset4x
SHA256 6682a3330604aaf31f6916ddbf3b78251abda3a019d15a53b1ce33b72d5cd072
MD5 29e63de8febe21c5fcf3df5b25971366
SHA1 b22697b6bb31563c14452e3342679f6d2cd7576f
SHA512 4d38b47164b322ad9bc657ecb5b490ecc5235bfa6f3103040b194730f85c747e11c968f76ba6db5d4952820035b5f77ff67dac563a45479f344f04dbba07cfad
SSDEEP 1536:Frh2jtHLlBz6MVu2k5a11V08DG6ChP5tVLI:FUjtHKMvF1a8KVk
TLSH
T113430154C2CFA6B5CF22CD322DDCD95B4A81AA86D24B5DC457C840D9CF3EA07E2ADB40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SRU\SRU.chk	svchost.exe
File opened for modification	C:\Windows\system32\SRU\SRU.log	svchost.exe
File opened for modification	C:\Windows\system32\SRU\SRUDB.dat	svchost.exe
File opened for modification	C:\Windows\system32\SRU\SRUDB.jfm	svchost.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF	svchost.exe
File created	C:\Windows\system32\NDF\{7C973DA6-3878-4640-ACC9-61F12DD82FD8}-temp-06202026-0407.etl	svchost.exe
File opened for modification	C:\Windows\system32\NDF\{7C973DA6-3878-4640-ACC9-61F12DD82FD8}-temp-06202026-0407.etl	svchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk\rasphone.pbk	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3000	chrome.exe
4856	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5600	ipconfig.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264019754639686"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\RAS AutoDial	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\RAS AutoDial\Default	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2040	chrome.exe
2040	chrome.exe
5680	sdiagnhost.exe
5680	sdiagnhost.exe
6120	svchost.exe
6120	svchost.exe
2040	chrome.exe
2040	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 31 IoCs

pid	Process
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
5344	msedge.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeDebugPrivilege	5680	sdiagnhost.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2624	msdt.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1716	2040	chrome.exe	92
PID 2040 wrote to memory of 1936	2040	chrome.exe	93
PID 2040 wrote to memory of 1936	2040	chrome.exe	93
PID 2040 wrote to memory of 3000	2040	chrome.exe	94
PID 2040 wrote to memory of 4216	2040	chrome.exe	95
PID 2040 wrote to memory of 4216	2040	chrome.exe	95
PID 2040 wrote to memory of 4800	2040	chrome.exe	97
PID 2040 wrote to memory of 3960	2040	chrome.exe	98
PID 2040 wrote to memory of 4800	2040	chrome.exe	97
PID 2040 wrote to memory of 3960	2040	chrome.exe	98
PID 2040 wrote to memory of 2804	2040	chrome.exe	99
PID 2040 wrote to memory of 2804	2040	chrome.exe	99
PID 2040 wrote to memory of 1712	2040	chrome.exe	101
PID 2040 wrote to memory of 1712	2040	chrome.exe	101
PID 2040 wrote to memory of 4336	2040	chrome.exe	102
PID 2040 wrote to memory of 4964	2040	chrome.exe	106
PID 2040 wrote to memory of 4964	2040	chrome.exe	106
PID 2040 wrote to memory of 3872	2040	chrome.exe	112
PID 2040 wrote to memory of 3872	2040	chrome.exe	112
PID 2040 wrote to memory of 2328	2040	chrome.exe	114
PID 2040 wrote to memory of 2328	2040	chrome.exe	114
PID 2040 wrote to memory of 3240	2040	chrome.exe	116
PID 2040 wrote to memory of 3240	2040	chrome.exe	116
PID 2040 wrote to memory of 3216	2040	chrome.exe	120
PID 2040 wrote to memory of 3216	2040	chrome.exe	120
PID 2040 wrote to memory of 2128	2040	chrome.exe	121
PID 2040 wrote to memory of 2128	2040	chrome.exe	121
PID 2040 wrote to memory of 3596	2040	chrome.exe	122
PID 2040 wrote to memory of 3596	2040	chrome.exe	122
PID 2040 wrote to memory of 1768	2040	chrome.exe	123
PID 2040 wrote to memory of 1768	2040	chrome.exe	123
PID 2040 wrote to memory of 2512	2040	chrome.exe	124
PID 2040 wrote to memory of 2512	2040	chrome.exe	124
PID 2040 wrote to memory of 896	2040	chrome.exe	125
PID 2040 wrote to memory of 896	2040	chrome.exe	125
PID 2040 wrote to memory of 4968	2040	chrome.exe	126
PID 2040 wrote to memory of 4968	2040	chrome.exe	126
PID 2040 wrote to memory of 3820	2040	chrome.exe	127
PID 2040 wrote to memory of 3820	2040	chrome.exe	127
PID 2040 wrote to memory of 3988	2040	chrome.exe	128
PID 2040 wrote to memory of 3988	2040	chrome.exe	128
PID 2040 wrote to memory of 2624	2040	chrome.exe	129
PID 2040 wrote to memory of 1560	2040	chrome.exe	130
PID 2040 wrote to memory of 3216	2040	chrome.exe	131
PID 2040 wrote to memory of 3640	2040	chrome.exe	132
PID 5680 wrote to memory of 5844	5680	sdiagnhost.exe	135
PID 2040 wrote to memory of 5888	2040	chrome.exe	136
PID 2040 wrote to memory of 5888	2040	chrome.exe	136
PID 5680 wrote to memory of 4512	5680	sdiagnhost.exe	141
PID 2040 wrote to memory of 5224	2040	chrome.exe	148
PID 2040 wrote to memory of 5224	2040	chrome.exe	148
PID 5680 wrote to memory of 5600	5680	sdiagnhost.exe	151
PID 5680 wrote to memory of 5636	5680	sdiagnhost.exe	152
PID 5680 wrote to memory of 5812	5680	sdiagnhost.exe	154
PID 2040 wrote to memory of 3368	2040	chrome.exe	156
PID 2040 wrote to memory of 3368	2040	chrome.exe	156
PID 2040 wrote to memory of 5104	2040	chrome.exe	158
PID 2040 wrote to memory of 5104	2040	chrome.exe	158
PID 2040 wrote to memory of 2136	2040	chrome.exe	159
PID 2040 wrote to memory of 2136	2040	chrome.exe	159
PID 2040 wrote to memory of 6092	2040	chrome.exe	160
PID 2040 wrote to memory of 6092	2040	chrome.exe	160
PID 2040 wrote to memory of 3548	2040	chrome.exe	161
PID 2040 wrote to memory of 3548	2040	chrome.exe	161

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\SteamAchievementManager-7.0.41.zip
1⤵
PID:4264

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff58eec728,0x7fff58eec734,0x7fff58eec740
  2⤵
  PID:1716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,10203503302135875877,13879387310482535335,262144 --field-trial-handle=1916,i,6928544101053984441,7861201390644265417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  PID:1936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=1616,i,4272976354061903791,11883946810574763605,524288 --field-trial-handle=1916,i,6928544101053984441,7861201390644265417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=2412,i,14842761018315531253,1716682461660113773,524288 --field-trial-handle=1916,i,6928544101053984441,7861201390644265417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:4216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,914836354080483369,2214752942593096803,2097152 --field-trial-handle=1916,i,6928544101053984441,7861201390644265417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,7547255625299417508,8813987701535635306,2097152 --field-trial-handle=1916,i,6928544101053984441,7861201390644265417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4444,i,9592897970577903538,16812760268268037489,2097152 --field-trial-handle=1916,i,6928544101053984441,7861201390644265417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4488 /prefetch:2
  2⤵
  PID:2804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4764,i,8221614034546427626,2944949607876805451,2097152 --field-trial-handle=1916,i,6928544101053984441,7861201390644265417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5556,i,15412332585088544998,7211731724161896104,524288 --field-trial-handle=1916,i,6928544101053984441,7861201390644265417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5904,i,10341837354298391049,1535084940346759121,2097152 --field-trial-handle=1916,i,6928544101053984441,7861201390644265417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5684,i,17072279392144845193,8346217797319866859,2097152 --field-trial-handle=1916,i,6928544101053984441,7861201390644265417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4772,i,7104467516997635653,17323345338322858754,2097152 --field-trial-handle=1916,i,6928544101053984441,7861201390644265417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5952,i,10673826436417577048,1368369827837236942,2097152 --field-trial-handle=1916,i,6928544101053984441,7861201390644265417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6092,i,4980760566823122282,16846826679639176877,2097152 --field-trial-handle=1916,i,6928544101053984441,7861201390644265417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6004,i,8700271500829347052,4638527461068354901,2097152 --field-trial-handle=1916,i,6928544101053984441,7861201390644265417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5904,i,14741136313276122760,2646797070128312282,2097152 --field-trial-handle=1916,i,6928544101053984441,7861201390644265417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3292,i,9917484972782115260,9040152944225349294,2097152 --field-trial-handle=1916,i,6928544101053984441,7861201390644265417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5932,i,11681227653008232526,12400920362676014149,2097152 --field-trial-handle=1916,i,6928544101053984441,7861201390644265417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3256,i,5872592437846644328,6255160043587494545,2097152 --field-trial-handle=1916,i,6928544101053984441,7861201390644265417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3964 /prefetch:1
  2⤵
  PID:896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3452,i,6376883784237884876,16485166663450256325,2097152 --field-trial-handle=1916,i,6928544101053984441,7861201390644265417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6264,i,16032857348493071628,4001346307684998785,2097152 --field-trial-handle=1916,i,6928544101053984441,7861201390644265417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6196,i,18228661914094840201,1895911703401991030,2097152 --field-trial-handle=1916,i,6928544101053984441,7861201390644265417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:3988
- C:\Windows\system32\msdt.exe
  -modal "590476" -skip TRUE -path "C:\Windows\diagnostics\system\networking" -af "C:\Users\Admin\AppData\Local\Temp\NDFE20E.tmp" -ep "NetworkDiagnosticsWeb"
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:2624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=3444,i,7145582014528653824,1262643102616619569,524288 --field-trial-handle=1916,i,6928544101053984441,7861201390644265417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  PID:1560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=6040,i,11701217897318559412,365635520838023133,524288 --field-trial-handle=1916,i,6928544101053984441,7861201390644265417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6484 /prefetch:8
  2⤵
  PID:3216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=3296,i,8995042056083889743,10154493004066475117,524288 --field-trial-handle=1916,i,6928544101053984441,7861201390644265417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3492 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=4492,i,8919574944270709697,17119489879305576258,2097152 --field-trial-handle=1916,i,6928544101053984441,7861201390644265417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6456 /prefetch:1
  2⤵
  PID:5888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6536,i,16481477130642778542,11831799982756610559,2097152 --field-trial-handle=1916,i,6928544101053984441,7861201390644265417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1568 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6016,i,15302918347867774919,8059176573363927011,2097152 --field-trial-handle=1916,i,6928544101053984441,7861201390644265417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=3320,i,13287993487959702536,3222430238401033873,2097152 --field-trial-handle=1916,i,6928544101053984441,7861201390644265417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6264,i,9868886285664636991,2549628121165528552,2097152 --field-trial-handle=1916,i,6928544101053984441,7861201390644265417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=3444,i,234596135280216984,7678769679132211904,2097152 --field-trial-handle=1916,i,6928544101053984441,7861201390644265417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:6092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6356,i,8743911985409418822,9087276845760716351,2097152 --field-trial-handle=1916,i,6928544101053984441,7861201390644265417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=5932,i,1388709648465198369,3553360833669948604,2097152 --field-trial-handle=1916,i,6928544101053984441,7861201390644265417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=4600,i,11859550778876087447,15174002021654593643,2097152 --field-trial-handle=1916,i,6928544101053984441,7861201390644265417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6484 /prefetch:1
  2⤵
  PID:5456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=4776,i,5061996836657134578,16131970330196678218,2097152 --field-trial-handle=1916,i,6928544101053984441,7861201390644265417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6636 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=4820,i,11016380651597088745,4313754065681925830,2097152 --field-trial-handle=1916,i,6928544101053984441,7861201390644265417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=6576,i,11599389253803774026,13333061430900674786,2097152 --field-trial-handle=1916,i,6928544101053984441,7861201390644265417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=3260,i,10597185818567553470,9362591149749751856,2097152 --field-trial-handle=1916,i,6928544101053984441,7861201390644265417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:5932

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1728

C:\Windows\System32\sdiagnhost.exe
C:\Windows\System32\sdiagnhost.exe -Embedding
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5680
- C:\Windows\system32\netsh.exe
  "C:\Windows\system32\netsh.exe" trace diagnose Scenario=NetworkSnapshot Mode=NetTroubleshooter
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5844
- C:\Windows\system32\netsh.exe
  "C:\Windows\system32\netsh.exe" trace diagnose Scenario=NetworkSnapshot Mode=NetTroubleshooter
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4512
- C:\Windows\system32\ipconfig.exe
  "C:\Windows\system32\ipconfig.exe" /all
  2⤵
  - Gathers network information
  PID:5600
- C:\Windows\system32\ROUTE.EXE
  "C:\Windows\system32\ROUTE.EXE" print
  2⤵
  PID:5636
- C:\Windows\system32\makecab.exe
  "C:\Windows\system32\makecab.exe" /f NetworkConfiguration.ddf
  2⤵
  PID:5812

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork -p -s DPS
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:6120

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s WdiServiceHost
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:816
- C:\Windows\System32\rundll32.exe
  "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\winethc.dll",ForceProxyDetectionOnNextRun
  2⤵
  PID:3216

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost
1⤵
PID:4240

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:5388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault94a6f1c7hbe12h40b9ha7d3hb2a115d1883b
1⤵
PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault94a6f1c7hbe12h40b9ha7d3hb2a115d1883b --edge-skip-compat-layer-relaunch
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:5344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7fff53bbc188,0x7fff53bbc194,0x7fff53bbc1a0
    3⤵
    PID:5672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,10732934324189606832,18091159590567089094,524288 --field-trial-handle=2552,i,4072236207950237123,10992858219800791758,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,11913385653763990356,3550387489367460196,262144 --field-trial-handle=2552,i,4072236207950237123,10992858219800791758,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:2
    3⤵
    PID:2124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,1156535638525282002,1645396671438087189,524288 --field-trial-handle=2552,i,4072236207950237123,10992858219800791758,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:8
    3⤵
    PID:4304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --no-pre-read-main-dll --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=2644,i,15295458587905756059,3248336141904248571,2097152 --field-trial-handle=2552,i,4072236207950237123,10992858219800791758,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:2
    3⤵
    PID:4908

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NetworkDiagnostics.debugreport.xml

Path C:\Users\Admin\AppData\Local\ElevatedDiagnostics\460911090\2026062004.000\NetworkDiagnostics.debugreport.xml
Size 209KB
SHA256 0ec5697db7aa3bc7bbfdad3e9b26e21952e107f3f38d1d0b54e5ed465de7ee05
MD5 755c050307d8749f19acdf107589c03f
SHA1 678aeba57e3283d7189a7b9a587e6b391b5b73cc
SHA512 cff26ab14b7071b317b81a79ba3cd901359e4555a462c54b7df376636e1819696db894686f343c783732ac1e7e68e5dc1e9117a36e7ba05eed7bdd17014b04a5
SSDEEP 768:sv8H+8Zqb/MNqZx8YjPQDPhcq3IsPjPQDPhcuL3IsCjPQDPhcuL3Is1:sv8e8cJf8tPhcq0PhcyvPhcyN
TLSH
T122240182B94E7BD04507AF53A4BDB1C60A74F50F1196B2E949BF23D421CBA91EFD3221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResultReport.xml

Path C:\Users\Admin\AppData\Local\ElevatedDiagnostics\460911090\2026062004.000\ResultReport.xml
Size 38KB
SHA256 8cdc1caf052ea6e29e68b938ad80e00c85a4f7e1f91bca1df64cf7493eecaf6f
MD5 09bfdc089ad553e02b5e1d1ea893932e
SHA1 af6c1f528143e7c1618446975ed17cd7e87864bd
SHA512 2c78e28e342de6526956f6e2356db4d164720a5dd72ddad20010c1a63a2427e9810a7a9d3b605f5ee32bdaea3dd3871ea3a1936cb46db01e2c786184e5795272
SSDEEP 384:sioDWBkiVHnVHnrVH0bapkVXNapkVoNapkVlNapkVLVH8hx1kVfhx1kVshx1kVdS:sbt73yxoWByro13UIPGY
TLSH
T156030101E57A1A40C55F13AB496CFA417E78677E12DAE18D3DEC9110658EF84FF2B342
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

results.xsl

Path C:\Users\Admin\AppData\Local\ElevatedDiagnostics\460911090\2026062004.000\results.xsl
Size 47KB
SHA256 67401342192babc27e62d4c1e0940409cc3f2bd28f77399e71d245eae8d3f63c
MD5 310e1da2344ba6ca96666fb639840ea9
SHA1 e8694edf9ee68782aa1de05470b884cc1a0e1ded
SHA512 62ab361ffea1f0b6ff1cc76c74b8e20c2499d72f3eb0c010d47dba7e6d723f9948dba3397ea26241a1a995cffce2a68cd0aaa1bb8d917dd8f4c8f3729fa6d244
SSDEEP 768:hUeTHmb0+tk+Ci10ycNV6OW9a+KDoVxrVF+bBH0t9mYNJ7u2+d:hUcHXDY10tNV6OW9abDoVxrVF+bBH0tO
TLSH
T16723CCA4B09CDF394BB5716BD8F2A582F61BCC366B356091F0FDB233029DD245622627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 91d9a3dafa6de1e3d9ba7447ec30bb817bf3cdb4d4feeb075fc3f1d0cfb6348a
MD5 1e603d5e787cfdf9670b49d9c1680774
SHA1 6a9c8c30d16340a78d7fa458f59e5409ecab0958
SHA512 2d05b34678fc69c69865401444a202144d7afd001bb458e4c4da5ae19aca8be3284d251847a0803e615e29dfcb9e0d413aed1b8bda15318ccafe7a9d510cda13
TLSH
T1EAE02BAAC821EC275CFD476D50944649EB2113572BA0845B363C81088FB16B7028585C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c9f5426f65871eae51e2ed53fdbd1cf2db5034328795be64071abd9b8ed26b98
MD5 9cf1cb1bb9e2477f4a2523be1929f8c0
SHA1 6e5412db0843bf69944c714d9ad1682e48060cf2
SHA512 b4deddd03c8d0662b914f880cb2f3bc97da6ff6c136e06a50e203e25be2286529404323d63af5790ce6eba356f4867744d86e2864acbf0f19fa1eedc8f80534c
SSDEEP 192:CRs3g/DYM89Nhv7AhAPRp2l9qHJ3b+WNnmOdxII24A7aiuVyIsnAUgtaJ:CRswLY5xk8Xmk/XdxZ2f7aD8
TLSH
T1ED42C82EFE10697B9CDBC219FA667753E7F5203521942E84E6FC8A2C15DB5CC221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 03659da14c846164152b8b4c534d632f418a22d831691c6c26d3016b6a7aaa1a
MD5 8dbac6dbf86836b9b066ebfe17ccdac3
SHA1 dd39d4752e65f376443346dc05ded5ab147c9a04
SHA512 2b38c8d692cb87b5a90622df80ccc2b05b0f616cf5f2cf23169b647bd54d4c17f61a447a27326ee7c18fd3901c7ac508006bc742c9120d1225a1308e9ebf905f
SSDEEP 192:8RMcBe3g/DYM89khuv7AhaPRpMnE99qHJ/b+WNnaJ2Tw2+VaI24A7aiTVyIsnAUp:8RMmewLYghKkSXfkfIp2+VX2f7aOe
TLSH
T1D852C62EED11797B9CDBC219F9657B23E7F5203521942E84E6FC8A1C15E79CC221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 bf1f62f18b9ad8e2080a635a9ef19510ac1a2029c19cff02b2637d3e7f8b4f7a
MD5 9e897b32e8c88f37cb346e852902f52d
SHA1 a254d182e562b0c1db1632f1012b2de06b4774d4
SHA512 a68a56ff7ef45d5fd065844a1347bb1b91f54c345897160561c3fc72f20c13d841e752effe53d7c488cd81a5fdb3687e9a5c58c473fc293e7bac39643b0ee9f7
SSDEEP 192:5RMcBe3g/DYM89zGv7AhAPRp2nES9qHJ/b+WNnpVyqII24A7aiuVyIsnAUgtaJ:5RMmewLYnyk8XGkfLyqZ2f7aD8
TLSH
T12E52D72EBE10797B9CDBC219FA267763E7F5202521942EC4E6FC8A2C15D75CC221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 55a95217330f016d7da1265c76cacc87abae3c162fa87fa7c2003f4b46037ba7
MD5 54d6530b660f555cace9fdebfebb6dfc
SHA1 fc30669e563512e0a2d898f80087d799ff8cc096
SHA512 5a5e4ec23005ff3b79182eb9961a5bdfbebc34a874abbbde6d556aec43ef98d64dacbca6b3616863c4857b3352537f3f6be031a7429b7c4170a38fcf506ab345
SSDEEP 192:ERMcBe3g/DYM89suv7AhAPRp2nEAY9qHJ/b+WNne+S1yRI24A7aiFVyIsnAUgraJ:ERMmewLYAKk8X3kfX0ye2f7aye
TLSH
T18952C82EBD10797B9CDBC219FA267763E7F5202521942E84E6FC8A2C15D75CC221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 eac34a73d2c9246c4a8ce17c0f008f2ce9b526df2b351d8b82958ffee867979b
MD5 f948e373267d6ff3e859ccb31a4ef8ae
SHA1 a658770f4a8a0a5648419189c6f075de2822ffac
SHA512 14561fa5a4f19ea84018748b6ff83ec143d9c474d5db3f79025e10a15df92e4969a10251d818a4434d53e1493fc9c412ea3ec0d055901898bf23f162524c8252
SSDEEP 192:8RMcBe3g/DYM89Zuv7AhaPRpMnE89qHJ/b+WNnaJ2pO2jVaI24A7aiTVyIsnAUge:8RMmewLYtKkSXakfIB2jVX2f7aOe
TLSH
T1A352D62EBD11797B9CDBD219F9657B23E7F4203521942E84E6FC8A1C15E79CC221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 8a4df05617d93fdcf10be18185702ef276cf8a1e75c5d1a831401649f0cc6701
MD5 d5eb1696b59bff624343399a101d00d1
SHA1 dad3cf012123fc057706298826a15eca2d3aeaba
SHA512 c46956d338c951a7d154d4da6ac4a9b84ec11eecff47b00dbef24236c0b7d298e922a5d139694cdbfa26d5dde7e86936ce0c7a5c408bfc4b3a722ae3ff56b6ea
TLSH
T1C9B0124580015151C00202F82A4254C872149F10AA0A1F0243E0AD2288359508424052
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bff0.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58bff0.TMP
Size 96B
SHA256 906bac994d75e83479fbe1154840480254284d631db64e3afdd86d64fea041c8
MD5 a405471fb1e80a9ec3153764be16592f
SHA1 6288f3b1081812f35cce5add1f695021f6d48df9
SHA512 d1f32e4c2ba2b8190617e77f08c105393dd01ff0e6bf8a9df114f44b0af0971fce2d3066662b889eb8236c701c47b6a088d4b6801a0105c016f5df4f2b790d01
TLSH
T129B02288C003A202C30203B02CCCCBC83020CF30C2030202C3E00A32CC32230002C020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 166KB
SHA256 e376034c2d5e50900d711c5f09637f6c9345f6a1ea1830f04b61413b08d600da
MD5 ccfe84cf834eb264a298bb2256014f07
SHA1 9ed9c1bc336487404b368503b0e9ab4e50dcae18
SHA512 13d620567841b9424d1d0932160e859bdbbf251359e5c10476183182e30048d36ffe6c52e172f16eec6a9ac58ec7d22429ed58f3215adfc240e65a64f1b2ee28
SSDEEP 3072:xEUvG0ABP8X+UDhzU87Qs1ybgHlGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMB:y3nBShsism7Rkm1tYpBeh2BAoB
TLSH
T117F3123B5D64B8374DF5F76EA10A1A0F1CF18BF3DD30D945C8C86A0427EAB981986974
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 c9a21c66f76e54e56a8784b238943821810fd0ec3274a46e4ae39615f15db19f
MD5 0b4c547c7d7324f8f05174bd65dcb3bb
SHA1 a67570d82bd48fd5ff57dbe45e1d9387989f9285
SHA512 9704a7d7928efab6fc8f7ae9a2ddc04c2ef5080296bf64e215f1c877a77ee64c329bcfc8bd7de4520c5b8defd1c69ad59e17ea5f6216e274d6a60d0aa1940a0e
SSDEEP 3072:A7Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Vm7Rkm1tYpBeh2BAog
TLSH
T12EC3023B5E75EC3B5CB5A74EB08E0B1E2EF149A6C930DE9288D85A0437F97CD0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 4ab59050b36ba837ea93682f2b8e8ba28eee1c7a08e18f45484b5289e3e26483
MD5 c4546ab6e6033c729c4600ec072d1103
SHA1 0a5d6ec0d8662021c6e6f3e0a6fe8ed4b01cad8b
SHA512 597a6c340be0aa6a14421f8b9e0d43ec1944454fcf4a2bd88f2b7d00b5fddfd3b9a5e23ee339e744e70bd9df496f9f566ca5bcc71587ac3f7c54599c1b5c8fd7
SSDEEP 3072:yNGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMB:/m7Rkm1tYpBeh2BAoB
TLSH
T114C3023B5D64E8375DB5A75EB08E0A1F1EF149A7C920DE92C8D85B0423F97CD0A49A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 b83da71e1a2848209cd02090a1e1ea7ce6f2cc6b8ef2ea5a7feb35c092bced90
MD5 2a263f93170e01fd69d6fdea2f7973e5
SHA1 6df21f22b64bc5a89307d4fb9449c2f7e047bc6a
SHA512 ebef1b5aba9f6352a52a1a8c87b4ca8a28db5fe67cad6aa72cf7b842bd1994c5690d46f1b37c249e4f99d3e356aaaa7a055d30745a0e05cab7763f6b3bbc1fb5
SSDEEP 3072:ygGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMB:gm7Rkm1tYpBeh2BAoB
TLSH
T114C3123B5D64E8375DB5B75EB08E0A1F1EF149A7C920DE92C8D85B0423F97CD0A49A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 11cd4f327d034a483548e90b4bd2e8c528be5fa6a7d8d47e4b61c7349fe05505
MD5 8b3d21207b2d29ddf5eccc315a23ce6a
SHA1 f18b8b13dade133660f31716b3d39553c0f123c1
SHA512 d8b1c1dfc17b4e812cd3a2a8454dc6c6c5c054a11daa376eb5571e8df9262c45d0cf44d03eccdfe7b8ba10865c75436154bcea7b731579fec18d7b8c48c99ce8
SSDEEP 3072:xrGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMB:Um7Rkm1tYpBeh2BAoB
TLSH
T135C3023B5D64E8375DB5B75EB08E0A1F1EF149A7C920DE92C8D85B0423F9BCD0A49A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 166KB
SHA256 1fb0032dc2ae0b39217ae7ff7217627a38858e5075872045cb99adad478ee7e3
MD5 46b4f246ea7faa4a63d0ce307e6a1811
SHA1 62fdb7982a7374c7ff1cf400e2a8cba5f83b3138
SHA512 58e5304b31ee64902aaf9bdf033552e2ad76f4de2185995461c327dad69cd138ab65639c1d714d0618f6faaef4b144ecd50c1c68220d3b8e9f5610c13ed8a0a9
SSDEEP 3072:xzUvG0ABP8X+UDhzU87Qs1ybgHlGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMB:d3nBShsism7Rkm1tYpBeh2BAoB
TLSH
T1F4F3123B5E64B8374DF5F76EA10A1A0F1CF18BF3DD30D945C8C86A0427EAB981986974
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 166KB
SHA256 10761c041b4bc5fe6fb6182a9df4ce5675026136f07a42c316f720dd18c803ca
MD5 1e6f243de784ea440462beab12b6c077
SHA1 ab58d82161094859f5494302f22dae16ea1dbd58
SHA512 7006a03cda646d423ab1d506f452c5f542a6fd77a036facf8a96628cc9c1783f0932496bb299e09ffbd6c37aa2b19e700a3575549cb9fd1b5d76cd0b881b57ff
SSDEEP 3072:xxUvG0ABP8X+UDhzU87Qs1ybgHlGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMB:X3nBShsism7Rkm1tYpBeh2BAoB
TLSH
T1E2F3123B5E64B8374DF5F76EA10A1A0F1CF18BF3DD30D945C8C86A0427EAB981986974
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 7e5ef358e73b82706a21b8b8669d2c36097c4f144b4b637659fb18c7ec270988
MD5 4c02ffd8ea71d108336cac0b1629e0c4
SHA1 8b101bc5ef4b8a333adbb9e28966d31eda9744f6
SHA512 3913d1c20aa3dbf72fa9c89eae8595bc56ef3a53e736b968bf14f09609ebb6043acef609d0b80adc817df87d0efb26e5681fcbec0f16972224a6fa8ae03f417a
SSDEEP 96:sa2viEDWH0scmCb9YnljdHWU6W6hfuH9EOx+WVoMfm+uecpYQjrp67VwUhgNVDB:sxvuUs7NlJ5HW6+WNGY7xhgF
TLSH
T170E1C8536E28697B8CCBE11DBA66BB53E2F5103266C5194CEAFC865C05977CD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 26KB
SHA256 2459e3f0f116ac62af92c5c2cf62284f21f839ee9f3ff6f409a89117c6ff1356
MD5 bd04cec9381d63ec9bd1baf5977bd607
SHA1 1c4a37de0dd479804914450fe86958de2df9196a
SHA512 5da82899dc50dc5b6678e7fad8d1adafd68c19a01b5487f9b459d9ecb629ffa1220f5cec54d49cabb262bacf209aa8dfcbb23bb47ced8b11dfce309fc6f0b713
SSDEEP 768:fnk7u70WvqiEa8F1+UoAYDCx9Tuqh0VfUC9xbog/OV35LlWYS7LroypPY0:fnk7u70WvqiEau1jai5LA374N0
TLSH
T1EFC2EA3B744CCB7E4F801E9DAC566F973E9802C7A6948D4087FA994C02C77EA51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 998c577507c2c00bb646c81b06a0af3e7c401fd4931f8ae343eaa8e6b51d90d9
MD5 cc3f4dfe02838757f222a379ca350284
SHA1 6defc4d43b9176a32fb292edb6bb76bf97a487a7
SHA512 424834ec6fdbca21d3d857b642f1de3c7a551a5f17c39a3a1e3295de1fb1b6092de3b7c3af8d6198d6c830c18f3aab636da6de156feab91ec720819026bf2bca
SSDEEP 192:jsND64BbWQmiUyabJRaGBPKScC256bePNNYWNYqZoUO:jsND6ebyhdRn2VNv0UO
TLSH
T104121B35ACAAAD2B8DA6A100F0C637575EB41177E944AF40FAE85B0C01D739C3B0B51B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a3d1bd0423169fb53c666180109b0908da12c406b8a7d3b0e7ce704e03ee5fdf
MD5 e7e1337ca6d8ec245eaf520d9faf613e
SHA1 0b5f52aeb855d41f13acaf48a17c088694195120
SHA512 2a893f90ab6f19014ccae2e31e6dfb82da65f0f7179b35a96575830aa5739f121a22e959d7638bf9aec21d16e752888aa0298f1aae7be7c18e21cc6114b1bfd9
SSDEEP 192:MONa64BAQmiUyY1qW5GBPKScC2567aDlphU6:MONa6eAnUWE2BZU6
TLSH
T12002FA39AC796C7BDEB2AD45F48737175FA4117BE6946B44EAE82B0C00D764C230392B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 16bd34650c0251fbe5110b6c5ba7b9367a39332eb344b5eb554bb666d2503888
MD5 eed0d6005e287329318285a7a79c75ac
SHA1 0e14ec26955cc817e3130564b7ff2de1aa399859
SHA512 5f52b270bea30cc914b8b30085d30dad8e22568aebb1c5c3ee81c9b6adcd0590515c003e4d55c39194f100e39b38e44a141b997bff57b4484991c868b9e5234b
SSDEEP 192:jsND64BbWQmiUybbJRaGBPKScC256bePNNYWNYqZoUO:jsND6eby0dRn2VNv0UO
TLSH
T170122B35ACAAAD2B8DA6A100F0CA37575EB41177E944AF40FAE85B0C01D739C3B0B51B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6d10334c03d183a70b83c58d84aff803dbe653a290006ec45d7ff5915df94f99
MD5 ca002ac15c799954e5b3c586e007f13e
SHA1 63b0f76fc57908bfa1a26d00a33c785f354fcda7
SHA512 ba3710aea56f48a305d03b61d40881ee74fa9bdc3f5dd09426034e9d13f40cd038ff44db3872fdc903f08e515828a8bb1800db9355766b2307af8704cef3c048
SSDEEP 192:jONy64BNQmiUymbqR5GBPKScC256bePNNYWwkqZoU6:jONy6eLF2RE2VN+4U6
TLSH
T1EA122B35ACBAAD2B5EA6B100F0C633575EA411BBE984AF40F6E85B0C01D775C3B0B51B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NDFE20E.tmp

Path C:\Users\Admin\AppData\Local\Temp\NDFE20E.tmp
Size 3KB
SHA256 904b48d7f7c6f079ddf5453bfe05bd98118a7e69d0bba17a75f2209a7a5389bd
MD5 e310e5578a38aa0803fe501af84e061d
SHA1 ec4e52893b7da842778df8d6658b356de731249b
SHA512 36465ac3ee139947b6623b0efc85cbf66dc8640dbb41abb613057b7d4b48e816bb67cc4893bd994f4f81d2978397f0a8361b2300eb5fb38cb0dcf01a546bceb2
TLSH
T12361E83773FA3D2BE1B6C7C89EF15A5BB00AB8767A41D58CD49A175D02A0D30689122E
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_u1npnqov.ame.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u1npnqov.ame.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

NetworkConfiguration.cab

Path C:\Users\Admin\AppData\Local\Temp\tmp835F.tmp\NetworkConfiguration.cab
Size 1KB
SHA256 8629761a9bd8986a790b875fd84b79f9d8d36df5cdf8a1260f3a5de65bb95818
MD5 a657514db73ee6bf049eff3629a8688c
SHA1 12ba7154a974a3790c7d23ca345cd9e415acd07e
SHA512 56be9cdddb075e66e43e76217540b72bc4a77788a776cc470d71426a801cb9e33c8b9e9ab7a3fc1e293e181bbb8a049b1d7b2b50eff47f5bbdab6cdd4cdbff08
TLSH
T17311B62E64446A82D306C5F2C2280B835F9CB89098D4A2D03405A5687B059E82FE3757
MD5 SHA1 SHA512 TLSH

Submit Download

NetworkConfiguration.ddf

Path C:\Users\Admin\AppData\Local\Temp\tmp835F.tmp\NetworkConfiguration.ddf
Size 231B
SHA256 ffeafbb8e7163fd7ec9abc029076796c73cd7b4eddaeeda9ba394c547419769e
MD5 00848049d4218c485d9e9d7a54aa3b5f
SHA1 d1d5f388221417985c365e8acaec127b971c40d0
SHA512 3a4874a5289682e2b32108740feea586cb9ccdad9ca08bf30f67c9742370c081ad943ea714f08dbf722f9f98f3b0bb307619a8ba47f96b24301c68b0fd1086d9
TLSH
T154D0A9A238AC9A9126A53E8AD7600546B0A040D760CA428E8EABE2C60C280406B8923B
MD5 SHA1 SHA512 TLSH

Submit Download

ipconfig.all.txt

Path C:\Users\Admin\AppData\Local\Temp\tmp835F.tmp\ipconfig.all.txt
Size 1KB
SHA256 b986117af2fbecbc8daab078f236ebe632ce048813939a5b6e12b6e7b4984cc7
MD5 95e86c8f7e716380593787fa60965da5
SHA1 8fcd0480f23d0f8d14b35c29a0b2b3e4983a64aa
SHA512 da407e5e74c7c653189cf83c8b18eeff888e2c464d1b2df378d320ecf9123bcd9c227997118fcf5cd9ff0a75b29aface4e58912a6a7b44a2590484f75d8e84ee
TLSH
T1DB41061E42ED030472B24A5A5AF740641B337819D9FC8F1C20C8A31E0FE7E0199ACFAB
MD5 SHA1 SHA512 TLSH

Submit Download

route.print.txt

Path C:\Users\Admin\AppData\Local\Temp\tmp835F.tmp\route.print.txt
Size 4KB
SHA256 f6a4cd7736085068ef3d18db8aac565a0bdf217f5ab3a75c9673b00ec80a8a85
MD5 71506beca6359d778a86b6973ce7184d
SHA1 3dc315f2f60c6e15cb40c380ffca41d2ad40687d
SHA512 3d033853a975b9a64ced141d2c0409e7a3e9edca71dbc892e41ae6573e879a738d7c367088b542ef58fff8563c8dd57c842f0b5582478338567239443e74f2f4
SSDEEP 24:Qct4o28EwO+5okAFLKDSumF5cDG4v8tau6NkWg0eLOSImfckAFLeAasSqtG/+f+i:Rm9wO+50sti5cDitau6NkR8XeAJr0M9
TLSH
T12B912D1E099913405169D71AD4E6002BEA373862ECB8479920CF2BEE1BE344079D7FEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.inf

Path C:\Users\Admin\AppData\Local\Temp\tmp835F.tmp\setup.inf
Size 978B
SHA256 e720bb03594d33fcd2830032045945331ca312b694514d6c84222711f92f4959
MD5 9785020824ef80b16b4427b84c7ffd35
SHA1 0ea3238158762d244e62bed3243e10ea0813b1d2
SHA512 d9eed205f900f15f4290d367fc6655f5d431ec162aba053a73ea2b7067bec533684580e3b6d0189f92ae75042397c8ff6d8b5a4b6db5a5877dc5d3668e849029
TLSH
T1E311305606E38D4B147392C25AE0C2C0F464C142A05A3D9D741DF9B99F5FF97C568059
MD5 SHA1 SHA512 TLSH

Submit Download

setup.rpt

Path C:\Users\Admin\AppData\Local\Temp\tmp835F.tmp\setup.rpt
Size 283B
SHA256 535a1faa9310cf793030b6294a816c41ad32f24d15a99b2066b11d287960909b
MD5 51a7ecbb80606c634a3944a080bb83d8
SHA1 67f412635a0325c341a6fea24b99210c34bc0d53
SHA512 26e3b052c65be14dbbc461c3f5d932ff1204ae5e1c9be6b025a805d88685c83d70fae9202e5f2143b65c63548b691005bd9ac8ffc1f63db0fc61ce6bb7a7c2cd
TLSH
T1BBD0A98A080D81498E35C0E34F88C3A43255F03B34250C32F08F0EC00763329CEA888C
MD5 SHA1 SHA512 TLSH

Submit Download

NetworkDiagnosticsResolve.ps1

Path C:\Windows\TEMP\SDIAG_90eb63b6-19a4-498c-a1c1-87709efc13dd\NetworkDiagnosticsResolve.ps1
Size 11KB
SHA256 4662c3c94e0340a243c2a39ca8a88fd9f65c74fb197644a11d4ffcae6b191211
MD5 d213491a2d74b38a9535d616b9161217
SHA1 bde94742d1e769638e2de84dfb099f797adcc217
SHA512 5fd8b91b27935711495934e5d7ca14f9dd72bc40a38072595879ef334a47f99e0608087ddc62668c6f783938d9f22a3688c5cdef3a9ad6c3575f3cfa5a3b0104
SSDEEP 192:eLXYPXsa+OjfI9HIufxAey+3OG78/ce+eT5WjifrM+BK:VPXaifqdfxAey+ecmAu7k
TLSH
T115428687E606D9E000BA65BD9F570056FB25016F695CD22C7AEC43F41FB823BC619F8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetworkDiagnosticsTroubleshoot.ps1

Path C:\Windows\TEMP\SDIAG_90eb63b6-19a4-498c-a1c1-87709efc13dd\NetworkDiagnosticsTroubleshoot.ps1
Size 25KB
SHA256 e3940266b4368c04333db89804246cb89bf2073626f22b8de72bea27c522282a
MD5 d0cfc204ca3968b891f7ce0dccfb2eda
SHA1 56dad1716554d8dc573d0ea391f808e7857b2206
SHA512 4d2225b599ad8af8ba8516f12cfddca5ec0ce69c5c80b133a6a323e9aaf5e0312efbcfa54d2e4462a5095f9a7c42b9d5b39f3204e0be72c3b1992cf33b22087c
SSDEEP 384:UlSoNnCiXTShob5bbVbgWT6rZTvxlBNexTKmh+xdxBUNQGJ:GSo3h8Jq
TLSH
T129C295F16D46C29518F71179DE52E018FB26026F229EB7763DBC83851FB0210E666F8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetworkDiagnosticsVerify.ps1

Path C:\Windows\TEMP\SDIAG_90eb63b6-19a4-498c-a1c1-87709efc13dd\NetworkDiagnosticsVerify.ps1
Size 10KB
SHA256 a32e13da40ac4b9e1dac7dd28bc1d25e2f2136b61ff93be943018b20796f15bc
MD5 9b222d8ec4b20860f10ebf303035b984
SHA1 b30eea35c2516afcab2c49ef6531af94efaf7e1a
SHA512 8331337ccb6e3137b01aeec03e6921fd3b9e56c44fa1b17545ae5c7bfcdd39fcd8a90192884b3a82f56659009e24b63ce7f500e8766fd01e8d4e60a52de0fe67
SSDEEP 192:YORm9mJWriv3iriv3oyriv3vgriv3qB3b8FnHayrBJckzrSartt0qF+rSG/rSurT:YORm9mJDv33v3oHv3lv3qB3b8FnHrrBA
TLSH
T1AC3242E51B44E1A51CFFA0F98E60A027F766026F151DC3F37CAD42542B31226E16EF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartDPSService.ps1

Path C:\Windows\TEMP\SDIAG_90eb63b6-19a4-498c-a1c1-87709efc13dd\StartDPSService.ps1
Size 567B
SHA256 d19677234127c38a52aec23686775a8eb3f4e3a406f4a11804d97602d6c31813
MD5 a660422059d953c6d681b53a6977100e
SHA1 0c95dd05514d062354c0eecc9ae8d437123305bb
SHA512 26f8cf9ac95ff649ecc2ed349bc6c7c3a04b188594d5c3289af8f2768ab59672bc95ffefcc83ed3ffa44edd0afeb16a4c2490e633a89fce7965843674d94b523
TLSH
T1C2F0F673E05785359E679CBB0D00C0544928A1CF727A1DEAB1658AA0B30A78EABB7F51
MD5 SHA1 SHA512 TLSH

Submit Download

UtilityFunctions.ps1

Path C:\Windows\TEMP\SDIAG_90eb63b6-19a4-498c-a1c1-87709efc13dd\UtilityFunctions.ps1
Size 53KB
SHA256 3891846307aa9e83bca66b13198455af72af45bf721a2fbd41840d47e2a91201
MD5 c912faa190464ce7dec867464c35a8dc
SHA1 d1c6482dad37720db6bdc594c4757914d1b1dd70
SHA512 5c34352d36459fd8fcda5b459a2e48601a033af31d802a90ed82c443a5a346b9480880d30c64db7ad0e4a8c35b98c98f69eceedad72f2a70d9c6cca74dce826a
SSDEEP 768:AaDgc60FE2UMeV6HQEqEVBWMBaRNdKdNh5BIW6Mk7svkxtFJuAQQW:j0a4bKcW6MkcSuj
TLSH
T1A733A4B57883967255B316749F47A008FE79031F0AE84168FDEC86C62FB4514C3BAF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UtilitySetConstants.ps1

Path C:\Windows\TEMP\SDIAG_90eb63b6-19a4-498c-a1c1-87709efc13dd\UtilitySetConstants.ps1
Size 2KB
SHA256 de5c231c645d3ae1e13694284997721509f5de64ee5c96c966cdfda9e294db3f
MD5 0c75ae5e75c3e181d13768909c8240ba
SHA1 288403fc4bedaacebccf4f74d3073f082ef70eb9
SHA512 8fc944515f41a837c61a6c4e5181ca273607a89e48fbf86cf8eb8db837aed095aa04fc3043029c3b5cb3710d59abfd86f086ac198200f634bfb1a5dd0823406b
TLSH
T1DC51BE03DF8D5744BC9E6ABA60E133646598F92771C4618CA93CED50B89D13F92953C3
MD5 SHA1 SHA512 TLSH

Submit Download

LocalizationData.psd1

Path C:\Windows\TEMP\SDIAG_90eb63b6-19a4-498c-a1c1-87709efc13dd\en-US\LocalizationData.psd1
Size 5KB
SHA256 0637af30fc3b3544b1f516f6196a8f821ffbfa5d36d65a8798aeeadbf2e8a7c2
MD5 380768979618b7097b0476179ec494ed
SHA1 af2a03a17c546e4eeb896b230e4f2a52720545ab
SHA512 b9ef59e9bfdbd49052a4e754ead8cd54b77e79cc428e7aee2b80055ff5f0b038584af519bd2d66258cf3c01f8cc71384f6959ee32111eac4399c47e1c2352302
SSDEEP 96:iLsmw/9nwbgDwlwn0iYveuQzRkkwj0pD+Eij4FvJG5B9c1rO4L:iLsZklGeKxGfw
TLSH
T15CB17C4263FE2658F2F36F44AEFA15615E36BCA9BC38D25C1150050E0AB2E40DDA1BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagPackage.dll

Path C:\Windows\Temp\SDIAG_90eb63b6-19a4-498c-a1c1-87709efc13dd\DiagPackage.dll
Size 478KB
SHA256 5b7aa413e4a64679c550c77e6599a1c940ee947cbdf77d310e142a07a237aad2
MD5 580dc3658fa3fe42c41c99c52a9ce6b0
SHA1 3c4be12c6e3679a6c2267f88363bbd0e6e00cac5
SHA512 68c52cd7b762b8f5d2f546092ed9c4316924fa04bd3ab748ab99541a8b4e7d9aec70acf5c9594d1457ad3a2f207d0c189ec58421d4352ddbc7eae453324d13f2
SSDEEP 6144:0ZC0lEOC2Us6eEyAc0jbJYOjlCLHUZQsxjuaJ7oSEvcdfSc0jbJYOjlCLHUZQ:0ZFLUe6vJ/wLIvavyfEvJ/wLI
TLSH
T189A49E8BA6848DF0C72A0674C42BCDF04E267C76DC11772E6B99F66F4CB2291644B71E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagPackage.dll.mui

Path C:\Windows\Temp\SDIAG_90eb63b6-19a4-498c-a1c1-87709efc13dd\en-US\DiagPackage.dll.mui
Size 17KB
SHA256 8be175e8fbdae0dade54830fece6c6980d1345dbeb4a06c07f7efdb1152743f4
MD5 44c4385447d4fa46b407fc47c8a467d0
SHA1 41e4e0e83b74943f5c41648f263b832419c05256
SHA512 191cd534e85323a4cd9649a1fc372312ed4a600f6252dffc4435793650f9dd40d0c0e615ba5eb9aa437a58af334146aac7c0ba08e0a1bf24ec4837a40f966005
SSDEEP 96:+mbJmdYVotzW1xcFjPe/dQTVOd5RLQ9/5HgVqz+4MLRvTLGlyQzwv7KCbVeog3+S:+mx1xyexdXeoR4gsgKvHWlTWn
TLSH
T1AF727901A3F90618F2FB7FB46DBA56654D3ABCA6AD38D28D0504005E59B2E90CDB1B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7C973DA6-3878-4640-ACC9-61F12DD82FD8.Diagnose.Admin.0.etl

Path C:\Windows\Temp\SDIAG_90eb63b6-19a4-498c-a1c1-87709efc13dd\result\7C973DA6-3878-4640-ACC9-61F12DD82FD8.Diagnose.Admin.0.etl
Size 192KB
SHA256 aba989f30cc4cbbfe009981c1e1c4fc34d64af1d1bc1023bdc34e53c17d4f391
MD5 974491c0466a7d3d8bc5c22291092da5
SHA1 d7fe35dfe240498f6f94bfff3c3ee3ae2c0e07fc
SHA512 20d6119359435d8140261e9ba8cb7be1506d04dac5862ea96e070f5a3db6d0ee90cd8f81e415cdc3e6f044ed11fa95f565535c2d99ee198eee0cd538694f6c84
SSDEEP 768:m74wophzD1k09KpnEViR0US/R+fQk01WnZzcrcRxvNaBaiL7wQs3B8pmkwBSGM:Xwx1a8Gmk2SGM
TLSH
T14814FE41A3FA0204F6B76FF2EEFA26510ABB7D515975C62E0548B70D0873925EC32F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2624-582-0x00000211F2B00000-0x00000211F2CAE000-memory.dmp

Download

memory/2624-515-0x00000211F2B00000-0x00000211F2CAE000-memory.dmp

Download

memory/2624-497-0x00000211F2B00000-0x00000211F2CAE000-memory.dmp

Download

memory/2624-476-0x00000211F2B00000-0x00000211F2CAE000-memory.dmp

Download

memory/5680-454-0x000001E8C0CE0000-0x000001E8C0D02000-memory.dmp

Download

memory/6120-485-0x0000022638670000-0x0000022638671000-memory.dmp

Download

memory/6120-482-0x000002262EBC0000-0x000002262EBD0000-memory.dmp

Download

memory/6120-477-0x000002262EB70000-0x000002262EB80000-memory.dmp

Download