0422d184e8bdae44fd1daefc6e712fcad06295bbdc8d80565806c27e95be3e51

Analysis

user interaction
yes
max time kernel
689s
max time network
691s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
main/amdgpio3.sys
Size 32KB
Sample260804-xd26ssck4y
SHA256 0422d184e8bdae44fd1daefc6e712fcad06295bbdc8d80565806c27e95be3e51
MD5 86a0ac35353119bcf30a37473efe5555
SHA1 3adde4c4763f256b114daea67d35ed2614c3b66f
SHA512 fac45aeab430fe54790fccd5f27a45f9c75cfbb2ee325585211fe0fe1a297d8eaeb979700a6f528acbbf1de15959cdaeceb80d2d53521d105b40513f5ff33d11
SSDEEP 384:Bo/CvvVw0qFWx0L2KU+onoISBbPL3nVSonVqFRZ2lmTx4uImQSDDi7FRkcWwlTI9:BeCHVrqWwUxknVMNTVDDi/+GB
TLSH
T137E26CC19A7864C3EE839D7053E8EA977C38F3C31950841D11EAE5E50D83BD6BB1852E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
185	pastebin.com
186	pastebin.com
188	pastebin.com
189	pastebin.com
182	pastebin.com

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1724	sc.exe
4440	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4584	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1856	chrome.exe
1104	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303430376374279"	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{CF80E416-914C-4806-96F5-3D63645A6122}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
4136	chrome.exe
4136	chrome.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
5444	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3316	chrome.exe
Token: SeCreatePagefilePrivilege	3316	chrome.exe
Token: SeShutdownPrivilege	3316	chrome.exe
Token: SeCreatePagefilePrivilege	3316	chrome.exe
Token: SeShutdownPrivilege	3316	chrome.exe
Token: SeCreatePagefilePrivilege	3316	chrome.exe
Token: SeShutdownPrivilege	3316	chrome.exe
Token: SeCreatePagefilePrivilege	3316	chrome.exe
Token: SeShutdownPrivilege	3316	chrome.exe
Token: SeCreatePagefilePrivilege	3316	chrome.exe
Token: SeShutdownPrivilege	3316	chrome.exe
Token: SeCreatePagefilePrivilege	3316	chrome.exe
Token: SeShutdownPrivilege	3316	chrome.exe
Token: SeCreatePagefilePrivilege	3316	chrome.exe
Token: SeShutdownPrivilege	3316	chrome.exe
Token: SeCreatePagefilePrivilege	3316	chrome.exe
Token: SeShutdownPrivilege	3316	chrome.exe
Token: SeCreatePagefilePrivilege	3316	chrome.exe
Token: SeShutdownPrivilege	3316	chrome.exe
Token: SeCreatePagefilePrivilege	3316	chrome.exe
Token: SeShutdownPrivilege	3316	chrome.exe
Token: SeCreatePagefilePrivilege	3316	chrome.exe
Token: SeShutdownPrivilege	3316	chrome.exe
Token: SeCreatePagefilePrivilege	3316	chrome.exe
Token: SeShutdownPrivilege	3316	chrome.exe
Token: SeCreatePagefilePrivilege	3316	chrome.exe
Token: SeShutdownPrivilege	3316	chrome.exe
Token: SeCreatePagefilePrivilege	3316	chrome.exe
Token: SeShutdownPrivilege	3316	chrome.exe
Token: SeCreatePagefilePrivilege	3316	chrome.exe
Token: SeShutdownPrivilege	3316	chrome.exe
Token: SeCreatePagefilePrivilege	3316	chrome.exe
Token: SeShutdownPrivilege	3316	chrome.exe
Token: SeCreatePagefilePrivilege	3316	chrome.exe
Token: SeShutdownPrivilege	3316	chrome.exe
Token: SeCreatePagefilePrivilege	3316	chrome.exe
Token: SeShutdownPrivilege	3316	chrome.exe
Token: SeCreatePagefilePrivilege	3316	chrome.exe
Token: SeShutdownPrivilege	3316	chrome.exe
Token: SeCreatePagefilePrivilege	3316	chrome.exe
Token: SeShutdownPrivilege	3316	chrome.exe
Token: SeCreatePagefilePrivilege	3316	chrome.exe
Token: SeShutdownPrivilege	3316	chrome.exe
Token: SeCreatePagefilePrivilege	3316	chrome.exe
Token: SeShutdownPrivilege	3316	chrome.exe
Token: SeCreatePagefilePrivilege	3316	chrome.exe
Token: SeShutdownPrivilege	3316	chrome.exe
Token: SeCreatePagefilePrivilege	3316	chrome.exe
Token: SeShutdownPrivilege	3316	chrome.exe
Token: SeCreatePagefilePrivilege	3316	chrome.exe
Token: SeShutdownPrivilege	3316	chrome.exe
Token: SeCreatePagefilePrivilege	3316	chrome.exe
Token: SeShutdownPrivilege	3316	chrome.exe
Token: SeCreatePagefilePrivilege	3316	chrome.exe
Token: SeShutdownPrivilege	3316	chrome.exe
Token: SeCreatePagefilePrivilege	3316	chrome.exe
Token: SeShutdownPrivilege	3316	chrome.exe
Token: SeCreatePagefilePrivilege	3316	chrome.exe
Token: SeShutdownPrivilege	3316	chrome.exe
Token: SeCreatePagefilePrivilege	3316	chrome.exe
Token: SeShutdownPrivilege	3316	chrome.exe
Token: SeCreatePagefilePrivilege	3316	chrome.exe
Token: SeShutdownPrivilege	3316	chrome.exe
Token: SeCreatePagefilePrivilege	3316	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe
3316	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5396	msconfig.exe
5396	msconfig.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 4912	3316	chrome.exe	123
PID 3316 wrote to memory of 3196	3316	chrome.exe	124
PID 3316 wrote to memory of 3196	3316	chrome.exe	124
PID 3316 wrote to memory of 1856	3316	chrome.exe	125
PID 3316 wrote to memory of 4352	3316	chrome.exe	126
PID 3316 wrote to memory of 4352	3316	chrome.exe	126
PID 3316 wrote to memory of 4160	3316	chrome.exe	128
PID 3316 wrote to memory of 3224	3316	chrome.exe	129
PID 3316 wrote to memory of 4160	3316	chrome.exe	128
PID 3316 wrote to memory of 3224	3316	chrome.exe	129
PID 3316 wrote to memory of 2848	3316	chrome.exe	130
PID 3316 wrote to memory of 2848	3316	chrome.exe	130
PID 3316 wrote to memory of 1484	3316	chrome.exe	131
PID 3316 wrote to memory of 1484	3316	chrome.exe	131
PID 3316 wrote to memory of 3552	3316	chrome.exe	132
PID 3316 wrote to memory of 3256	3316	chrome.exe	137
PID 3316 wrote to memory of 1656	3316	chrome.exe	138
PID 3316 wrote to memory of 3752	3316	chrome.exe	139
PID 3316 wrote to memory of 1880	3316	chrome.exe	140
PID 3316 wrote to memory of 1880	3316	chrome.exe	140
PID 3316 wrote to memory of 3500	3316	chrome.exe	141
PID 3316 wrote to memory of 3500	3316	chrome.exe	141
PID 3316 wrote to memory of 4928	3316	chrome.exe	142
PID 3316 wrote to memory of 4928	3316	chrome.exe	142
PID 3316 wrote to memory of 400	3316	chrome.exe	143
PID 3316 wrote to memory of 400	3316	chrome.exe	143
PID 3316 wrote to memory of 3088	3316	chrome.exe	144
PID 3316 wrote to memory of 3088	3316	chrome.exe	144
PID 3316 wrote to memory of 540	3316	chrome.exe	145
PID 3316 wrote to memory of 540	3316	chrome.exe	145
PID 3316 wrote to memory of 1468	3316	chrome.exe	146
PID 3316 wrote to memory of 1468	3316	chrome.exe	146
PID 3316 wrote to memory of 808	3316	chrome.exe	147
PID 3316 wrote to memory of 808	3316	chrome.exe	147
PID 3316 wrote to memory of 2272	3316	chrome.exe	149
PID 3316 wrote to memory of 3192	3316	chrome.exe	148
PID 3316 wrote to memory of 3192	3316	chrome.exe	148
PID 3316 wrote to memory of 2872	3316	chrome.exe	150
PID 3316 wrote to memory of 2872	3316	chrome.exe	150
PID 3316 wrote to memory of 2996	3316	chrome.exe	151
PID 3316 wrote to memory of 2996	3316	chrome.exe	151
PID 3316 wrote to memory of 1820	3316	chrome.exe	152
PID 3316 wrote to memory of 1820	3316	chrome.exe	152
PID 3316 wrote to memory of 2052	3316	chrome.exe	153
PID 3316 wrote to memory of 2052	3316	chrome.exe	153
PID 3316 wrote to memory of 3536	3316	chrome.exe	154
PID 3316 wrote to memory of 3536	3316	chrome.exe	154
PID 3316 wrote to memory of 1220	3316	chrome.exe	155
PID 3316 wrote to memory of 1220	3316	chrome.exe	155
PID 3316 wrote to memory of 2808	3316	chrome.exe	156
PID 3316 wrote to memory of 2808	3316	chrome.exe	156
PID 3316 wrote to memory of 2136	3316	chrome.exe	157
PID 3316 wrote to memory of 2136	3316	chrome.exe	157
PID 3316 wrote to memory of 1952	3316	chrome.exe	158
PID 3316 wrote to memory of 1952	3316	chrome.exe	158
PID 3316 wrote to memory of 4300	3316	chrome.exe	159
PID 3316 wrote to memory of 4300	3316	chrome.exe	159
PID 3316 wrote to memory of 2664	3316	chrome.exe	160
PID 3316 wrote to memory of 2664	3316	chrome.exe	160
PID 3316 wrote to memory of 4476	3316	chrome.exe	161
PID 3316 wrote to memory of 4476	3316	chrome.exe	161
PID 3316 wrote to memory of 4136	3316	chrome.exe	162
PID 3888 wrote to memory of 1724	3888	cmd.exe	163
PID 3888 wrote to memory of 4440	3888	cmd.exe	165

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\main\amdgpio3.sys
1⤵
- Executes a command shell one-liner
PID:4584
- C:\Users\Admin\AppData\Local\Temp\main\amdgpio3.sys
  C:\Users\Admin\AppData\Local\Temp\main\amdgpio3.sys
  2⤵
  PID:976

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3420

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Windows\system32\sc.exe
  sc create amdgpio3 type= kernel start= demand error= normal binPath= C:\Windows\System32\drivers\amdgpio3.sys
  2⤵
  - Launches sc.exe
  PID:1724
- C:\Windows\system32\sc.exe
  sc start amdgpio3
  2⤵
  - Launches sc.exe
  PID:4440

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc060ec728,0x7ffc060ec734,0x7ffc060ec740
  2⤵
  PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1780,i,13206307917324843975,13682547695251873101,262144 --field-trial-handle=2028,i,9813118008106239640,17522114922951387072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:3196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2140,i,7415267072819067602,14110387946782125843,524288 --field-trial-handle=2028,i,9813118008106239640,17522114922951387072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2440,i,1472058000939618306,6623926584135076981,524288 --field-trial-handle=2028,i,9813118008106239640,17522114922951387072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2400 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3272,i,18052787690183240986,13741825627028352477,2097152 --field-trial-handle=2028,i,9813118008106239640,17522114922951387072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3416,i,15720490472449676053,12012220308197758729,2097152 --field-trial-handle=2028,i,9813118008106239640,17522114922951387072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3956,i,13524759386824660699,6301811102001642223,2097152 --field-trial-handle=2028,i,9813118008106239640,17522114922951387072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4512 /prefetch:2
  2⤵
  PID:2848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4812,i,4637218126607334917,7665315136184813381,2097152 --field-trial-handle=2028,i,9813118008106239640,17522114922951387072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,17487976361881511771,4732571422980436529,524288 --field-trial-handle=2028,i,9813118008106239640,17522114922951387072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:3552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5776,i,15821859540445721354,9608531263052673046,524288 --field-trial-handle=2028,i,9813118008106239640,17522114922951387072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:3256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5768,i,18174871848002971234,4897861512915630279,524288 --field-trial-handle=2028,i,9813118008106239640,17522114922951387072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5812,i,6900006403443722174,9456990142564637899,524288 --field-trial-handle=2028,i,9813118008106239640,17522114922951387072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:3752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5800,i,1806480994013685823,14523772846684691810,2097152 --field-trial-handle=2028,i,9813118008106239640,17522114922951387072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4720,i,9147680806274965062,14394524773002470483,2097152 --field-trial-handle=2028,i,9813118008106239640,17522114922951387072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4816,i,9931558044366102095,5797205444203311700,2097152 --field-trial-handle=2028,i,9813118008106239640,17522114922951387072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3740,i,2562795865349268934,10260481961047118199,2097152 --field-trial-handle=2028,i,9813118008106239640,17522114922951387072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6176,i,3215253323532866072,16113631614334459857,2097152 --field-trial-handle=2028,i,9813118008106239640,17522114922951387072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6320,i,12392441879272996485,3756405103016396370,2097152 --field-trial-handle=2028,i,9813118008106239640,17522114922951387072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6500,i,8531765431933644085,941273575873397780,2097152 --field-trial-handle=2028,i,9813118008106239640,17522114922951387072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=1300,i,3411248089020904535,13347923019118638995,2097152 --field-trial-handle=2028,i,9813118008106239640,17522114922951387072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6332 /prefetch:1
  2⤵
  PID:808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6064,i,12084950766002767164,7259216063458809639,524288 --field-trial-handle=2028,i,9813118008106239640,17522114922951387072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3976 /prefetch:8
  2⤵
  PID:3192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3484,i,12231274082322921487,15048153462373684199,524288 --field-trial-handle=2028,i,9813118008106239640,17522114922951387072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6676,i,17698751033132112387,17542448764200484343,2097152 --field-trial-handle=2028,i,9813118008106239640,17522114922951387072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6684 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6872,i,2923707363670095541,5688795643105819286,2097152 --field-trial-handle=2028,i,9813118008106239640,17522114922951387072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6988 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6820,i,2933681900713106551,7896873854497525409,2097152 --field-trial-handle=2028,i,9813118008106239640,17522114922951387072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6780,i,2999383780460428818,2497958324257265568,2097152 --field-trial-handle=2028,i,9813118008106239640,17522114922951387072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6768 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6452,i,15954962782079562984,10278385081096367869,2097152 --field-trial-handle=2028,i,9813118008106239640,17522114922951387072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6972,i,15363127513915707971,8072345910294597224,2097152 --field-trial-handle=2028,i,9813118008106239640,17522114922951387072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=7292,i,7906719176648911256,13945870195488424398,2097152 --field-trial-handle=2028,i,9813118008106239640,17522114922951387072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7328 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=7360,i,13490526361574344368,2569008435172495786,2097152 --field-trial-handle=2028,i,9813118008106239640,17522114922951387072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7460 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=7680,i,4334646573648348158,440383062963391954,2097152 --field-trial-handle=2028,i,9813118008106239640,17522114922951387072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=7784,i,4004403169136689552,5492581842342917837,2097152 --field-trial-handle=2028,i,9813118008106239640,17522114922951387072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7796 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=7948,i,17349973639135355403,14167671561339589548,2097152 --field-trial-handle=2028,i,9813118008106239640,17522114922951387072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7960 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=8080,i,7537301952512081961,5165558285899843265,2097152 --field-trial-handle=2028,i,9813118008106239640,17522114922951387072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8104 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=8480,i,15267972310512025600,12690529766297544551,262144 --field-trial-handle=2028,i,9813118008106239640,17522114922951387072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8352 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=7088,i,2187920268461599252,3428994567044766622,524288 --field-trial-handle=2028,i,9813118008106239640,17522114922951387072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8684 /prefetch:8
  2⤵
  PID:5892

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:1256

C:\Windows\system32\msconfig.exe
"C:\Windows\system32\msconfig.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:5396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault436760e8h5244h4fcdh8d0bh33e02e30e763
1⤵
PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault436760e8h5244h4fcdh8d0bh33e02e30e763 --edge-skip-compat-layer-relaunch
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:5444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x28c,0x7ffbffd1c188,0x7ffbffd1c194,0x7ffbffd1c1a0
    3⤵
    PID:5460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,6949013280425845861,730428421185931936,262144 --field-trial-handle=2116,i,627268247511475801,9937291563899119459,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:2
    3⤵
    PID:5152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,10858620866790833046,8300032947442155432,524288 --field-trial-handle=2116,i,627268247511475801,9937291563899119459,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,3340645629253932486,1733581046302530839,524288 --field-trial-handle=2116,i,627268247511475801,9937291563899119459,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:8
    3⤵
    PID:2148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3104,i,12642576098765835684,14962419206197893721,2097152 --field-trial-handle=2116,i,627268247511475801,9937291563899119459,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:2
    3⤵
    PID:6160

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 51104d9ab9653811209b772e38df4fbfe7055f9367bfb948d3b6ab9ba0440162
MD5 5a185c92ad6af95f9f480685392e1bab
SHA1 7fd4357fed312eb5c63bca217f107eb66a705ed4
SHA512 8a0a6eda4dd0bdeab2d9334f86ccfa9b6e302af76cd0ce1443c7efc0bb9d0455c35644618e304ec5bfaa33f7de86e75b18204a4f8d79a51c8ba4dba1dd7d7152
TLSH
T134E0AB64C861EC2704FC0718A0442342E756236F2A40881B7A3CD10C8FB16364581D2E
MD5 SHA1 SHA512 TLSH

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b
Size 436KB
SHA256 0b320d2cf00e9215763a5377904e2301b2edb7a5d299bd319259714cf8bcd9a9
MD5 38e965609b7e0769e6754549cfa3c2fd
SHA1 8ef9e62fa3ae6d8b371f5a9e9344a6cdf31515fe
SHA512 18cff962b979abf3e3d06261422f35502463a0e196aa0cf801cadcff8833a83f20c9e9f22fb3133041e406fdf2304088a0a5eaa4bbb8aff07ab15a0c1b46b0e4
SSDEEP 6144:HT+7EhQjYpz+XUGr9+7Km54TxcjJJEWv6p0qOJ7kuKtAiDL6GnkES7+S8HBWzDi2:6vj0iUI9EKFEJdU0p7riDxw7L8oviJ3c
TLSH
T147942367DF08D99BDA158361EA30EBDD1158EB6EE00A3CC844BB462CE54C0F9F6913C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000024

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000024
Size 86KB
SHA256 f9fca4955ebe5c4fa36f0644660ab0e4d1dfffdabd3a14cec912f0dd377940e6
MD5 4bf78d4a77065c52dd0f11c68113fd33
SHA1 2a32b38138cb31c2a188de281b5cc674982ca1cc
SHA512 2edfc01cbc5e4640b7e99ee5c9cf1cd98b6ca4ff810000261acd552775ca01c1a3d6ccf37fe465b0bd3ef8e6bbddcf218a9bfbe930bf85b8db69137f7953b3d8
SSDEEP 1536:wUxudCDKphiti2E+Z2KKZ9PvEgHaxJ/DlcQgyTNMuTWxeS5ueKMjmW:wUCSKpqYKGPcgHYHJFHLW
TLSH
T18283128E2F3DE7F74AAD0DEC96000668376D4DFFB48ADD56A47D11D166362E026820CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003f
Size 21KB
SHA256 de772f8e3ac182a446d62b202a5ad7889b3099e39dcfc0ca5505014c842dc6b3
MD5 3e73b21097fd8484f54f7ae2319c0022
SHA1 53aea255aabf3b4c6f3b83470e2eddcddcfddf38
SHA512 7a2c1b87a79b80027bd3b560be9f5ad11acc4bf5d52e2a54d50545bcfd8d6d7865543374e5e17c5bfd378c0c1cf0f3aa9cd4f41ac7f640b1b73a594f805a3019
SSDEEP 384:BHxam1SlIC1+6y5nkzx6QEZl+7D5FjybwjkXREYlkPfHnqYpba4UL:BsTN+lnkzx6QEZl+f5Zys9Y+nqYp+7L
TLSH
T1C4A2E1283936D4083205C778C1D4304E8B68FFB57DAD27D65A930CD43AB6ACB62ABF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 a17c209ab7ffb0391f52263628c948d5e7b1bb4f978ba61d646003958155aafd
MD5 38205c496781f64af55c31cfe15d30c1
SHA1 487822b9f7bcc885a0160702dbe7e26c1647980f
SHA512 e9d6cf8bf9aec7247c89703ac603cfeaba88e8a8d6cf378ac1db45f4cd439972ae3ae7282cd62bb76414000842119f2214cd6b2e65f4ddcadc56bbe0022c0029
SSDEEP 96:kJO3dQQ6gR2pu5wgriGyYS922HTtaodkyurZ5E:kedQldGO9x+B5E
TLSH
T1F0911E9531A9EC1DCF9844741AC93B54F0A20D43E5D68EEB4A2309BD331B3B5BEC154D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 37KB
SHA256 ae8dcd91cdba8a3a0431364e74fe82d7887dea56acc148a817cad0086ae72613
MD5 db8f1293ee5c1417321c894ec5b3ed9c
SHA1 6cedbaf36448286f4581fb53b1391a44e6e939f2
SHA512 a38eba8e861b324d1525a145551ee7ef36078b229aa3fab57ee9dbda7f35fff6fbe735297876e21e298230b04cb7f2ccaddb263f47dec289f1380806bdc55037
SSDEEP 384:DDDChvr+b0ZmkoeSiBeRGQDiCJgJ7+JinSxcDDBe9GHNLRCd4/aIuCVZCA0Z4DrU:46GTbxlSMtSMj5v5CXuiqkJehCic
TLSH
T1FD0390F3C7F49D2DCD2151F4EB262E1FCE690924476C387A85D87E56A3E5832E201A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 35KB
SHA256 9cf357430a8d5b9770ac41c77eb46e7f461cc3b85343b7913e0f3aff6b9125a2
MD5 68e8091a9a8cbed3f9a94c63384c0834
SHA1 5051ed83cf69685332951f3c702576bb6d2fdaa9
SHA512 58f525bec8c07ed2a8c461b520d09c5ff76fa3e26cce95e04c98ca9a50ef0e08c5c3fcffc4ff1387c5baecff547ed68ed17c92d6e91e067921d31f22e2eca565
SSDEEP 384:DDDChvr+b0ZLkoeSiBeRGQDiCJgJ7+JinSxcDDBe9GHNvaIuCDVYgK8gC7um0vYV:56GT8c9XzlSMmrEj5w5CXui0g+k/j
TLSH
T156F28EF3C7F49D2DCD2151F4EB262E1FCE690924476C387A85D87E56A3E5832E201A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 bd3aff69e3f4afccaf10fc42c0ff87f051b3a84d429316e489079698e4220386
MD5 7cab20d1d220facffce78901af1ef8c5
SHA1 dd0e5e33ba5556c4cef152968698a8b749accaa3
SHA512 07ecb409dc23ae09377b47cf839ec0a44f5ee8e2858dd3e56c6a884dfce91f9b0a19de88809639f7fe586b3529ae1e1d6e633da463ce12770597f85d8248cd8e
SSDEEP 384:DDDChvr+b0ZLkoeSiB2aIoYR3L8ArcU2BNhMaFVYgK8gC7um0vYvBVBLD4DrB8oE:5dNccKACzlSMmrR
TLSH
T1EA726BF3C7F49D2DCD2151F4EB162E1FCE690924536C386AC4D4AE57A3E5872E200A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 189408de6deff5e86e658cc6007308b5eb5f613c398af3361a21e34a37015385
MD5 b11b00b7a16ccf295c53a44a225e9a55
SHA1 9f149ea55f4a81ac2376de5f81af35d8edbc639d
SHA512 1e17bea3415dfcd4b827e3af4e40f72d4ae21cd19f7fd3543c968efd5b4ae19cff73a0d999261f9d4859f3ac637c5d7fb69af0f1678fb722864c8c16caf9f2d4
SSDEEP 192:HRXcBhNYh0Xpwv76hzPRp/dAHeT9+Hsb+WN47+Tyq2+cNs2q3aJ3Y8yIsnAUgraJ:HRXmhN1psWlX58w/K3sbape
TLSH
T19B62E72AAA502E7B6DDBD229FD51B757D7F2202125A91E94E7FCCA2C04D36CC321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 dc26fb31b0197a62117796bae2b23df240719e5e1cc57321fd676d0a6391d91f
MD5 699c4197bfb3f8d6751cb12cab2c0644
SHA1 98406b8144d704651fa8fd4515a42a995b017203
SHA512 e22642ee7a70aac1600b983d8820ab687fcfa0e34243a3296800b62271b6a47c1cddb75299e1da190e5c219aa47f3908276b65648ddd6b23f7bb185e2a8f0894
SSDEEP 192:HRXcBhNYh0XBzv76hzPRp/dAHeT9+Hsb+WN47+Tyq2+cNs2q3aJ3Y8yIsnAUgraJ:HRXmhN1BLWlX58w/K3sbape
TLSH
T10262E72AAA502E7B6DDBD229FD51B757D3F2202125A91E94E7FCCA2C05D36CC321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 1c0ee46a01d43881fd0c18196b5f6090480fd518dadf9b112bc14d7b60a7bd44
MD5 9cd1c007ca085ceb1b2677e29dce1e56
SHA1 675af3ecabd9146c042af1686191cc91e608830f
SHA512 da2b01d4161d56b04bae546ce964b370fab5844aed1b749ba2f9e4f0d030cd753a5b3dc32fc3494a3c877d4c0d61558e2dbd54dc9e271e7c9ee1a1fb54d2c37b
SSDEEP 192:HROcBhNYh0XBGv76hzPRp/dAHex9+Hsb+WN47+TySYAFcNsQq3aJ3Y8yIsnAUgrK:HROmhN1ByWlX38w/EAysxape
TLSH
T10A62E72AA9102E7B6DDBD269FD51B767D7F2202125A91E94E7FCCA2C04D35CC321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e2f1d048d8e807db8fc52b4d4ea9729ec1c2edee24d827de9c08ecee410e465c
MD5 ccb2ef627cf4cfc78b100399f96bd42a
SHA1 d818cdbd6b0a69eed661e3176168ae34c5067e92
SHA512 9cb98abb528c256c313a27038c4084202afb797ea44656c635e2556627c694265f27dc03f6e6e4086090bb5e886d99d1cd686d361fe53e01d1ccaaebce9cea02
SSDEEP 192:NRXcBzNYh0Xnwv70hAPRp2dAgaT9+Hsb+WN47mqrnGK2OLq3aJ3MVyIsnAUgraJ:NRXmzN1nsg8XN8w+bn2O2aie
TLSH
T12D52C52EAA102A7B6DDEC22AFD51B767D7F2202124D91E94E7F8CA2C05D75CC212741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 53c00e2a290654b3ebfeb524e944619f1e672aa2e45a107d04098d1f15d9e310
MD5 9d9d147a3ce6f98e40b6af3682e5001b
SHA1 cead289d8ba73dbc7a5fbf1b074533ec87474eb4
SHA512 29c602039d2fd732b7c22f09ee0fc7498591dcd1a6232626bfb397040491bca175cf4f34e526db51cc3f3685e3bd3bc09855564d0648d52a308a167088420207
SSDEEP 192:HRXcBhNYh0XZwv76hzPRp/dA46T9+Hsb+WN47+Tyq2+JeEnq3aJ3Y8yIsnAUgraJ:HRXmhN1ZsWlX48w/KrEqape
TLSH
T1A262E72AA9502E7B6DDBD22AFD51BB57D7F2202124A91E94E7FCCA2C04D36CC311701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 ca4c932ec5d27bffcd90e83fa33337b474f8a7b427395e75b94199f358b3d31c
MD5 9d53fb45126f3b55a004afffdb897f0c
SHA1 f1d77a73e98755628f498e5be7222e146097194a
SHA512 e413bc2ebf37ebe40d0bf7407ad0e99449e42f4caf4e337770fa9d6ab99828d6e4670587da3eea8a7a74de6c70c7c658193d494eff7f7d5da9661b326975b3af
SSDEEP 192:HRXcBzNYh0XZwv76hzPRp/dAfDT9+Hsb+WN47+Tyq2+0tWqq3aJ3YVyIsnAUgraJ:HRXmzN1ZsWlXm8w/KDWXame
TLSH
T1C762F62AA9502E7B6DDBD22AFD51BB57D3F2202124A91E94E7FCCA2C04D36CC311701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 218822365b7fd48ce49dc7e38e4213655fec25c054556d819a5537a8fc0c4c06
MD5 923ae19434852e327382875bef7d1a4e
SHA1 39a196141f8284b23f44861a46318accf391154d
SHA512 a53b4dd30e39c8e68bf99755109d91fdffb243eed0021648e3a2d16fceffd16d654eaff33eb7e6c539633121daa42246f4b2ace7c62f5c27f6d1da8f81eff7e7
SSDEEP 192:HRXcBhNYh0XBGv76hzPRp/dAHex9+Hsb+WN47+TyVDWcNsvq3aJ3Y8yIsnAUgraJ:HRXmhN1ByWlX38w/U/sCape
TLSH
T17C62E72AA9102E7B6DDBD26AFD51B767D7F2202125A91E94E7FCCA2C04D35CC311701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1345f7b18856638d745405f0a6212280408241eac379af45f0dccd5d50b8a268
MD5 6f2b54f74ca2a724921183449e0ba52f
SHA1 15118636a05f353e413839d3903cb9cb4b6ae5d2
SHA512 dafd4240ef23fd99a0dfe2377a2908c8199dbaa130dd2e415a4e40f9261480d43ebda3a9736061f63589ed5a49e9c0bb37931b6a9fb5d03a35ac5a939624bd95
SSDEEP 192:NRrNYh0XuOv70hAPRp2dj9+Hsb+WNnmqtwq3aJ3MVyIsnAUgraJ:NRrN1uqg8X68wztRaie
TLSH
T10642C62EAA10693B6DDEC229FD517753D7F6202125992E94E7F8CA2C09E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 22661777626e54ccccb66e106e0f960c259c1c1c83632106096a4330d8967049
MD5 80c364a1f775cdb47edcace174941cc0
SHA1 4f171a18716c7a729620cd610048632be2cb644c
SHA512 cadf41c42ff2848d5587432a96daa9a1b5c9798c8ef7529c7a74c05d4322368c3a4ff389e1f7062ba58b4fa690c82a5dae830d42f23e1b54f0ebe364412f5067
SSDEEP 192:NRrN/OG0Xucv70hAPRp2dj9+Hsb+WNnIo0qq3aJ3AVyIsnAUgtaJ:NRrNMuIg8X68wv0Xae8
TLSH
T19242C52EAA506D3B5DDFC229FD517753D7F6202124992E98E6F8CA2C09E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 82bbaeb0109e2ac380b557ee38bad45149c42f4a1af9b86792c92177a252d0d7
MD5 bb943b6f57216e04546bda8ebade445b
SHA1 bf38041e162689c24d64b16b296369a7a9a0b4d7
SHA512 f78e1b9ae5755c8c973b3724ea0be05c9a28f676418b3c9f172b007b284400609614724bb6129a334aa52276ebd519af748b58aa7156d03e62027401bddd4a28
TLSH
T13FB01200C402560DC05607B413472488B2146F1D9A0B170143F07F23C8291B18434060
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5da3e4.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5da3e4.TMP
Size 96B
SHA256 9f9b06822e82f2ce87229074cce48b113a3d9741f9cab25e2071663076c3a4b3
MD5 11ff4a84bf0ede3cfd479c7a83f6adf2
SHA1 859fe28c38a2e0d2426872229d1b2e1927130229
SHA512 01638043649c2ed8aaa666ca3aa6e279a1fad3f32bd714762efc7e582994c047ebb45d0faed8776bb11831600b66e8e1a11f6ef11b03622444b96141b910225f
TLSH
T1D5B02220C0032202C08A03B0308080ECB220EF30CA0B0203C2E00A22EC2223088200B0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 35dc1d183d8cce283c32b43b03962b5c2d257739e57efa20d46a495b0eb63acf
MD5 63b1096b7af17a56a5150b33d48b19c3
SHA1 6c4a65589abe08754e338e914c14bdf78783bbc4
SHA512 d02ba6a37607c9eaa8a6f67e97cfc365b5daebae9f092324788298e395e7671ab0b4eb525ca5eb52262b01f558788a0dc129f2df69004e8bc4e171996aca6ee6
TLSH
T199B022C080020823F08823F208E20220322C8C32AEA328C0ABE002A080A0B003B82800
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 144B
SHA256 4f8519db6c311ef0e0e4cd0bb6eded7fe8daeb56db17217350e1d6167e6b2577
MD5 3c7b898410786cc53802fe531fe30c27
SHA1 57b0c6e59543612f7fcca90eeaf19da74485820f
SHA512 0d4529a396fa159e75408b9a8d5206705a69c62b7da65b74192725766ad887d0728e1706501d9c1417946559f40f3def5d89a6e29ad0378237b5f767d4918736
TLSH
T1CDC012C868725EA9E8D1E3F10DD756302355ED30DD51A083D3D0104050D15413FEBA08
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 120B
SHA256 3d97ced9efa03a77cb8f26c3090be1abcdaff023d269d7b02cbe826c8b8843cd
MD5 76f09cc3a63b517b756aa6adec17aee7
SHA1 d86b3c3b8c2539a37eda2fb337b18125f1239563
SHA512 89fb9302ffb867c0f241aaf3d3bd269eb8ecf754f60d7742c6cd5e503cfdd8d5da3d52550003a8dc77c6c3a38b35dabef562610a36eb8ec9e25b3ad2a249058f
TLSH
T18DB0121028502F21DC51D7F604C1A04022556C205CC26602D190021081D92403B52440
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\index.txt
Size 234B
SHA256 2f95b6e6b9cb6f92772114f9b2be3cc399c542007b57c643c0c298a30136f471
MD5 db523be5196532a59dc1220ad35b3108
SHA1 9390b4bb530009a122879e3b52276c8294ca11e0
SHA512 072e07557d503900a45c229f08153018cc8eb19101aec4f53c63a6b632f8491a9d8a6e2557e18ef1bd0bc85389ba8e3c53563c13aeef61811cce22ffdfb2f56a
TLSH
T19DD0A9C71330884B1B70EB8C7038266D91278A688CA9DCED8808B15678F9F33D42267E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\index.txt
Size 150B
SHA256 e28fb00e600bec4fad1511a22fd3c9a9176772dc2a262ed3c9164ffed7ed6fdc
MD5 569e1e71bdd878b0dc09b9404e457734
SHA1 2b4d8ba43b32dde490b66b02b69e35526b24809e
SHA512 69a61927d027ba6564583dd5962e7c409e34de7addb7cbe86155f9dd73e4871155c602d822fbcc3f72adbf91e095af8132654f3f066c7495d894f7ea6f4a6761
TLSH
T163C08CD31620484B0770DACC3028322CC127824C8CE4CCFC880880022578E33440243C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5e9e9f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\index.txt~RFe5e9e9f.TMP
Size 157B
SHA256 dd8be478a5911401e898f3f83bcb54bf48ab5da8589b1e60de699cf6d03abea1
MD5 44794acae99e31b417cd940b380371b0
SHA1 9991d6f23d8c6bfbcd81521161b47899b93074e4
SHA512 d4e56ea9dbe75b6bcfe693b57c861a5725b7e9c408e0f5790eb1bf9b6797ff9aa3213200195d22e76cc576e752261a9200e7d35c47eed3ac5adbd43499ecefb1
TLSH
T109C08CD3062008470730D9CC2038722CC12B8D5C8CD0CCF88804B0023178E33840183C
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 02360acbd3e38dfd139412e091af6aa252d0ad8cd57f08170695aa493aeeebfa
MD5 492de89f0db49f96085a8a7dbb3c042c
SHA1 aede1ef64b29a7b7bfcac59153ce4c1a6ac827d2
SHA512 9dc2194154233e1f13e308d642056a20f4d66643a57086b410e21975ec5904946856a3b4cea110b0214447a35c30c4127a92496729cb9e74261bd6afd87a89b2
SSDEEP 1536:b+LyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:iqfd7NtZL8cHQRZEQ6Sps3
TLSH
T121C30237ABC21F339E92CF64B9130FD657B644A99030D301AAAD37FB7C83591684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 731db67fb07c379bbc7f144434be1a5beed259f788b7ca50f09dbd2a27c14c77
MD5 01446a060877d08606811e6bde5d630b
SHA1 c7f1fa3c3ac1ab725fc119c8d5b6f087efd3c475
SHA512 0b05540dd068ede396054b4cb462464bc394a008ac9dffb377c13db09b72ea3ef4e1902b2a1178f0dde0a9b131aca49722c8b8e634a0800c57be9c6a6ca56d4a
SSDEEP 6144:C+3qx7lKnwptJoSB5H3w2+YgXnqZ/ZLW3ExO:FqxhKnwptJoSngXqZ/piQO
TLSH
T1D13412379A912F335E6B9B7272230F874EF6585BC165C6406FEC37AB788395058438E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 54650cbbec8124a955a934690210791827f3e55eea21b756160d896e677b7be3
MD5 30ce84032ae8ef88387e297044a1c23d
SHA1 387bfbf402a90f9dc97a081b7879ee278a4977d3
SHA512 c6321e8c67421279b10cbbb877769f8e347dea6bb73a44437cb191f5c5aa43cdf19619e095824eb60b490066de20d8e39419d70161155690e85a1c9e66fdc3d5
SSDEEP 6144:i3qx7lKnwptJoSB5H3w2+YgXnqZ/ZLW3ExO:yqxhKnwptJoSngXqZ/piQO
TLSH
T1BC341237D7952F336E5B9B3272630ECB4AF6586680A5C2416BEC37AF788395058434E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 a03c03e6da40eb9b900f982646a0bc1094377a857bf19c558364bd34f134d2a7
MD5 0fc3f0775fb4747c50afaf3cc544d90b
SHA1 c90a1b6e4e9e007d129630a1aeb983968740d16a
SHA512 f8f9bb3b8066e2c9b998b902148bdc21a6a7db5c40d8d7ece013f8fde9cf89669b594d8838131ba16f9c90ee6b093eac4cfc9df650dab8f501d80620405abc46
SSDEEP 6144:93qx7lKnwptJoSB5H3w2+YgXnqZ/ZLW3ExO:FqxhKnwptJoSngXqZ/piQO
TLSH
T140341237D7952F336E5B973272630ECB4AF6586680A5C2416BEC37AF788395058434E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 571521a2f14846dc98b9427730abf4c32d2054ce93e4fd3d2c5131ecb108e8b3
MD5 34c35b1d2b974480448b68ca39b919e1
SHA1 04b40b6f681ae7206b61794cf38d7ef7c7e39160
SHA512 492402a64ff1e6d0ec9ac90dd20bdaf7eddb993e4057dcf616393322121d0b3e2831d6e9d3a4ea8a6fb56c6d0f4e543a067c486451c096d064645242c0fdadc2
SSDEEP 6144:1+3qx7lKnwptJoSB5H3w2+YgXnqZ/ZLW3ExO:0qxhKnwptJoSngXqZ/piQO
TLSH
T1843412379A912F335E6B9B7272230F874EF6585BC165C6406FEC37AB788395058438E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 54c0cec06ebf1a8761062cae21f99d0f1711ae7bf6b39b2d74417badb32aafcd
MD5 2b28501b812c28e4765c98474c9ffc13
SHA1 dc3ff372c1c8141072bb27766f7a2430aa215206
SHA512 913e362cb4f82f4efea87d460363198938b12713144c7f80fcb22ab37aae7496bf94aaf7392baa5c2f7effacb266af2a34634c2a8f879a7b2649fc98c877e2e2
SSDEEP 6144:9+3qx7lKnwptJoSB5H3w2+YgXnqZ/ZLW3ExO:cqxhKnwptJoSngXqZ/piQO
TLSH
T1C1341237DA952F335E6B9A7272230F874EF6585BC155C6406FEC37AB788391058438E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 61c834b7beccd29dc8dc79f3d3e488bd77195a5343abf0b856db05ebd4a75d1b
MD5 fb8bb24a1042f7e0419d2d23ce9020e1
SHA1 402b1d45e439116d2d32a690e0ecd5d04401779f
SHA512 dcf7738e9bb8e92ab2de78034d3af17f785897a7e6f9fec18fff5dcb33b61d4387b761f80cdb45f04877c52a1bd98635d54c9311f37f2a5a62993c12d25960fe
SSDEEP 96:sa2jFiEDWxpsczb9w5AdHWU6W6hfuH9EOx+WVoMfm+uecpYQjC/u67YWwUhgNVDB:sxZu3sl5m5HW6+WNGYMWxhgF
TLSH
T153E1C8526E38697B4CC7D11DFB267B53E2F6103266C51948AAFC9A6C089B6CD230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 26KB
SHA256 32091d6376008c114bbe1b5b99cc0f7325acdc7145c09f18aca29b4c1139eabc
MD5 77f76694cebff521b01852860914e02a
SHA1 65465edbe6100b77ef9dd58749dd685fcfd63013
SHA512 685c10b5bcd883c6551bd528d8bef15fe0dffd99fa06546367d1816baa7da5a5e3d2199b2b806e257980573d527512f4dabdc18a44b67f39ffa2b8b44b3fc077
SSDEEP 768:WtqirTNWvx7jr8F1+UoAYDCx9Tuqh0VfUC9xbog/OVMALl6op3droMjUnA:WtqirTNWvx7jru1ja5ALoc3WQUA
TLSH
T1CEC2EB3B640CCB7E4FC05A9DDC5A6F973EA802CB5A948D4047FA994C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 ab8e4e6d851e317c19f80c16a8838379ef7f8fb3c120a75e1be219900183ad0b
MD5 cb2fa121475c34e137f0f24ef33f3e7f
SHA1 7d61d000ff4ec9901fddbd20223a72fa2d0ea4d8
SHA512 057b56f4a87423a57e3a56ae5142bda72f1d89ff907dc0fffd3e43cf600d04ad91f003b1ffd6b27a559bf943cbab6add63ebdb4717d14a2bd5270be728130718
SSDEEP 192:zaJsNl6kmXQmiUyi3Wk036r1EYZcIBqilUO:zYsNl6Z51Wk/rqIJUO
TLSH
T1BD12293068A8BC7B8DD3A505F58737635FA52077DE896F95D9D81B2C04C768C2B0B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ab3b253ef84e13b74392b8bdd13b38635c69b4f8d7bee326c7290885f92cefe1
MD5 8f18cad2d7116fd096e69c8327ca7618
SHA1 3fc2ef7f39f503d5420238b4f73dd0699979b4c8
SHA512 e3c41069662e5143f0abb366a449b175a92a089e6fde7e9fbdb90d957b761e34b9e22cc07cb178e27b175653b7e256aa0087ae055b682da4b9138e5ed39471c1
SSDEEP 96:ZqONk3QsjpfmUTmDK5ih/cIPURHl8h4otop525DgBhPwivh50xy0SFYKQAxsYssZ:gONz6kDfQmiUyQEZ9036TQikU5U6
TLSH
T13C020935A8787CBB8EA36E46F48737275FA5212BEA852F84D9E81B1C04D764C1307837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 ffeb262db1e46fac922a923a3b97ccbe569acec6f502648451c9d274dc3c05e3
MD5 7b4528ca5cea5311cdc0f216becc32e7
SHA1 793cf7b6a24ae95038756e075e7431ac43d08ffc
SHA512 f6fd9d15ce78b6e697d540dbe806b16a775ca029e0f87f9ac075567aa8e9bc5ce9814e0a2ee1256e55f06a450df40edd190e73d585fe3ba30060cac24c9f1ba9
SSDEEP 192:zaJsNl6kmXQmiUy/3Wk036r1EYZcIBqilUO:zYsNl6Z5EWk/rqIJUO
TLSH
T13C12293068A8BC7B8DD3A505F58737635FA52077DE896F95D9D81B2C04C768C2B0B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4690b088ab215c3b6028882cd9a05a77a9af11b8875abd8f10b84b451db5fc40
MD5 33ed54e5f733b8504a0eedb381fead6a
SHA1 fd496fe5922b648ac3a3c6e5a16c2d219d7ffeb3
SHA512 8cde78473813a36f3df3d01bdfc08248d05c80b0f56413846c493998af2adf3310bbbfe9dd06e414207b10cd24102e962149f3241f0b5a36be875a8b072719d7
SSDEEP 192:iJONk6kQQmiUyiEW9036r1EYZcRkGqilU6:gONk6lWW9/rqRkkU6
TLSH
T1B91228706478BC7B5DD3A505F48737A35EA42077DE896F95D5E8162C08C768C2B0B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/976-0-0x00007FF6F2C10000-0x00007FF6F2C1A000-memory.dmp

Download