bandook | 646d385c9b7168e97199fd0557a1c22ac0c0eca724e7684bf74a524466933693

Analysis

max time kernel
387s
max time network
380s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-09-2022 13:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PAGOS CANCELADOS_27D.exe
Size

3.6MB
MD5

135e03400f15e6058085d0f867d6d0ef
SHA1

2d1e0d30426d68fecb1bbc52321df8b4c0e4363d
SHA256

646d385c9b7168e97199fd0557a1c22ac0c0eca724e7684bf74a524466933693
SHA512

ba86e3b65848fe33d94d9daec17bbf7c1077a4abf36fceee36eff6ad65b72e4e69b1b8cab093afed589428793555357b716128afcfc2afa75a317db874f779fe
SSDEEP

49152:FbU6bMuLV01edOnZIPaKPm6Q7m4bjuBFnhHK4i/59Cfev3DeVN2oTIO4f:FbnbMZ

Score

10^/10

bandook discovery persistence ransomware rat trojan upx

Malware Config

Extracted

Path

C:\Program Files\7-Zip\History.txt

Ransom Note

HISTORY of the 7-Zip -------------------- 22.01 2022-07-15 ------------------------- - UDF support was improved to UDF version 2.60. - HFS and APFS support was improved. 22.00 2022-06-15 ------------------------- - 7-Zip now can extract APFS (Apple File System) images that can be used in DMG files. - 7-Zip now can create TAR archives in POSIX (pax) tar format with the switches -ttar -mm=pax or -ttar -mm=posix - 7-Zip now can store additional file timestamps with high precision (1 ns in Linux) in tar/pax archives with the following switches: -ttar -mm=pax -mtp=3 -mtc -mta - New switches for Linux version for TAR archives: -snoi : store owner/group ids in archive or set owner/group ids from archive to extracted files. -snon : store owner/group names in archive - New -snz switch to propagate Zone.Identifier stream to extracted files (Windows). - New option "Propagate Zone.Id stream" in Tools/Options/7-Zip menu. - New "Options" window in "Add to archive" allows to select what metadata must be included to archive. Also it allows to select new option "Do not change source files last access time". - Some bugs were fixed. 21.07 2021-12-26 ------------------------- - 7-Zip now can extract VHDX disk images (Microsoft Hyper-V Virtual Hard Disk v2 format). - New switches: -spm and -im!{file_path} to exclude directories from processing for specified paths that don't contain path separator character at the end of path. - In the "Add to Archive" window, now it is allowed to use -m prefix for "Parameters" field as in command line: -mparam. - The sorting order of files in archives was slightly changed to be more consistent for cases where the name of some directory is the same as the prefix part of the name of another directory or file. - TAR archives created by 7-Zip now are more consistent with archives created by GNU TAR program. 21.06 2021-11-24 ------------------------- - The window "Add to Archive" now allows to set a limit on memory usage (RAM) that will be used for compressing. - New switch -mmemuse={N}g / -mmemuse=p{N} to set a limit on memory usage (RAM) for compressing and decompressing. - Bug in versions 21.00-21.05 was fixed: 7-Zip didn't set attributes of directories during archive extracting. - Some bugs were fixed. 21.04 beta 2021-11-02 ------------------------- - 7-Zip now reduces the number of working CPU threads for compression, if RAM size is not enough for compression with big LZMA2 dictionary. - 7-Zip now can create and check "file.sha256" text files that contain the list of file names and SHA-256 checksums in format compatible with sha256sum program. 7-Zip can work with such checksum files as with archives, but these files don't contain real file data. The context menu commands to create and test "sha256" files: 7-Zip / CRC SHA / SHA-256 -> file.sha256 7-Zip / CRC SHA / Test Archive : Checksum The commands for command line version: 7z a -thash file.sha256 *.txt 7z t -thash file.sha256 7z t -thash -shd. file.sha256 New -shd{dir_path} switch to set the directory that is used to check files referenced by "file.sha256" file for "Test" operation. If -shd{dir_path} is not specified, 7-Zip uses the directory where "file.sha256" is stored. - New -xtd switch to exclude directory metadata records from processing. 21.03 beta 2021-07-20 ------------------------- - The maximum dictionary size for LZMA/LZMA2 compressing was increased to 4 GB (3840 MiB). - Minor speed optimizations in LZMA/LZMA2 compressing. 21.02 alpha 2021-05-06 ------------------------- - 7-Zip now writes additional field for filename in UTF-8 encoding to zip archives. It allows to extract correct file name from zip archives on different systems. - The command line version of 7-Zip for macOS was released. - The speed for LZMA and LZMA2 decompression in arm64 versions for macOS and Linux was increased by 20%-60%. - Some changes and improvements in ZIP, TAR and NSIS code. 21.01 alpha 2021-03-09 ------------------------- - The command line version of 7-Zip for Linux was released. - The improvements for speed of ARM64 version using hardware CPU instructions for AES, CRC-32, SHA-1 and SHA-256. - The bug in versions 18.02 - 21.00 was fixed: 7-Zip could not correctly extract some ZIP archives created with xz compression method. - Some bugs were fixed. 21.00 alpha 2021-01-19 ------------------------- - Some internal changes in code. - Some bugs were fixed. - New localizations: Tajik, Uzbek (Cyrillic) 20.02 alpha 2020-08-08 ------------------------- - The default number of LZMA2 chunks per solid block in 7z archive was increased to 64. It allows to increase the compression speed for big 7z archives, if there is a big number of CPU cores and threads. - The speed of PPMd compressing/decompressing was increased for 7z/ZIP/RAR archives. - The new -ssp switch. If the switch -ssp is specified, 7-Zip doesn't allow the system to modify "Last Access Time" property of source files for archiving and hashing operations. - Some bugs were fixed. - New localization: Swahili. 20.00 alpha 2020-02-06 ------------------------- - 7-Zip now supports new optional match finders for LZMA/LZMA2 compression: bt5 and hc5, that can work faster than bt4 and hc4 match finders for the data with big redundancy. - The compression ratio was improved for Fast and Fastest compression levels with the following default settings: - Fastest level (-mx1) : hc5 match finder with 256 KB dictionary. - Fast level (-mx3) : hc5 match finder with 4 MB dictionary. - Minor speed optimizations in multithreaded LZMA/LZMA2 compression for Normal/Maximum/Ultra compression levels. - bzip2 decoding code was updated to support bzip2 archives, created by lbzip2 program. - Some bugs were fixed. - New localization: Turkmen. 19.02 alpha 2019-09-05 ------------------------- - 7-Zip now can unpack files encoded with Base64 encoding (b64 filename extension). - 7-Zip now can use new x86/x64 hardware instructions for SHA-1 and SHA-256, supported by AMD Ryzen and latest Intel CPUs: Ice Lake and Goldmont. It increases - the speed of SHA-1/SHA-256 hash value calculation, - the speed of encryption/decryption in zip AES, - the speed of key derivation for encryption/decryption in 7z/zip/rar archives. - The speed of zip AES encryption and 7z/zip/rar AES decryption was increased with the following improvements: - 7-Zip now can use new x86/x64 VAES (AVX Vector AES) instructions, supported by Intel Ice Lake CPU. - The existing code of x86/x64 AES-NI was improved also. - There is 2% speed optimization in 7-Zip benchmark's decompression. - Some bugs were fixed. 19.00 2019-02-21 ------------------------- - Encryption strength for 7z archives was increased: the size of random initialization vector was increased from 64-bit to 128-bit, and the pseudo-random number generator was improved. - Some bugs were fixed. 18.06 2018-12-30 ------------------------- - The speed for LZMA/LZMA2 compressing was increased by 3-10%, and there are minor changes in compression ratio. - Some bugs were fixed. - The bug in 7-Zip 18.02-18.05 was fixed: there was memory leak in xz decoder. - 7-Zip 18.02-18.05 used only one CPU thread for bz2 archive creation. 18.05 2018-04-30 ------------------------- - The speed for LZMA/LZMA2 compressing was increased by 8% for fastest/fast compression levels and by 3% for normal/maximum compression levels. - 7-Zip now shows Properties (Info) window and CRC/SHA results window as "list view" window instead of "message box" window. - Some improvements in zip, hfs and dmg code. - Previous versions of 7-Zip could work incorrectly in "Large memory pages" mode in Windows 10 because of some BUG with "Large Pages" in Windows 10. Now 7-Zip doesn't use "Large Pages" on Windows 10 up to revision 1709 (16299). - The vulnerability in RAR unpacking code was fixed (CVE-2018-10115). - Some bugs were fixed. 18.03 beta 2018-03-04 ------------------------- - The speed for single-thread LZMA/LZMA2 decoding was increased by 30% in x64 version and by 3% in x86 version. - 7-Zip now can use multi-threading for 7z/LZMA2 decoding, if there are multiple independent data chunks in LZMA2 stream. - 7-Zip now can use multi-threading for xz decoding, if there are multiple blocks in xz stream. - New localization: Kabyle. - Some bugs were fixed. 18.01 2018-01-28 ------------------------- - 7-Zip now can unpack DMG archives that use LZFSE compression method. - 7-Zip now doesn't allow update operation for archives that have read-only attribute. - The BUG was fixed: extracting from tar with -si switch didn't set timestamps for directories. - Some bugs were fixed. 18.00 beta 2018-01-10 ------------------------- - 7-Zip now can unpack OBJ/COFF files. - new -sse switch to stop archive creating, if 7-Zip can't open some input file. - Some bugs were fixed. 17.01 beta 2017-08-28 ------------------------- - Minor speed optimization for LZMA2 (xz and 7z) multi-threading compression. 7-Zip now uses additional memory buffers for multi-block LZMA2 compression. CPU utilization was slightly improved. - 7-zip now creates multi-block xz archives by default. Block size can be specified with -ms[Size]{m|g} switch. - xz decoder now can unpack random block from multi-block xz archives. 7-Zip File Manager now can open nested multi-block xz archives (for example, image.iso.xz) without full unpacking of xz archive. - 7-Zip now can create zip archives from stdin to stdout. - 7-Zip command line: @listfile now doesn't work after -- switch. Use -i@listfile before -- switch instead. - The BUGs were fixed: 7-Zip could add unrequired alternate file streams to WIM archives, for commands that contain filename wildcards and -sns switch. 7-Zip 17.00 beta crashed for commands that write anti-item to 7z archive. 7-Zip 17.00 beta ignored "Use large memory pages" option. 17.00 beta 2017-04-29 ------------------------- - ZIP unpacking code was improved. - 7-Zip now reserves file space before writing to file (for extraction from archive). It can reduce file fragmentation. - Some bugs were fixed. 7-Zip could crash in some cases. - Internal changes in code. 16.04 2016-10-04 ------------------------- - The bug was fixed: 7-Zip 16.03 exe installer under Vista didn't create links in Start / Programs menu. - Some bugs were fixed in RAR code. 16.03 2016-09-28 ------------------------- - Installer and SFX modules now use some protection against DLL preloading attack. - Some bugs were fixed in 7z, NSIS, SquashFS, RAR5 and another code. 16.02 2016-05-21 ------------------------- - 7-Zip now can extract multivolume ZIP archives (z01, z02, ... , zip). - Some bugs were fixed. 15.14 2015-12-31 ------------------------- - 7-Zip File Manager: - The code for "Open file from archive" operation was improved. - The code for "Tools/Options" window was improved. - The BUG was fixed: there was incorrect mouse cursor capture for drag-and-drop operations from open archive to Explorer window. - Some bugs were fixed. - New localization: Yoruba. 15.12 2015-11-19 ------------------------- - The release version. 15.11 beta 2015-11-14 ------------------------- - Some bugs were fixed. 15.10 beta 2015-11-01 ------------------------- - The BUG in 9.21 - 15.09 was fixed: 7-Zip could ignore some parameters, specified for archive creation operation for gzip and bzip2 formats in "Add to Archive" window and in command line version (-m switch). - Some bugs were fixed. 15.09 beta 2015-10-16 ------------------------- - 7-Zip now can extract ext2 and multivolume VMDK images. - Some bugs were fixed. 15.08 beta 2015-10-01 ------------------------- - 7-Zip now can extract ext3 and ext4 (Linux file system) images. - Some bugs were fixed. 15.07 beta 2015-09-17 ------------------------- - 7-Zip now can extract GPT images and single file QCOW2, VMDK, VDI images. - 7-Zip now can extract solid WIM archives with LZMS compression. - Some bugs were fixed. 15.06 beta 2015-08-09 ------------------------- - 7-Zip now can extract RAR5 archives. - 7-Zip now doesn't sort files by type while adding to solid 7z archive. - new -mqs switch to sort files by type while adding to solid 7z archive. - The BUG in 7-Zip File Manager was fixed: The "Move" operation to open 7z archive didn't delete empty files. - The BUG in 15.05 was fixed: console version added some text to the end of stdout stream, is -so switch was used. - The BUG in 9.30 - 15.05 was fixed: 7-Zip could not open multivolume sfx RAR archive. - Some bugs were fixed. 15.05 beta 2015-06-14 ------------------------- - 7-Zip now uses new installer. - 7-Zip now can create 7z, xz and zip archives with 1536 MB dictionary for LZMA/LZMA2. - 7-Zip File Manager now can operate with alternate file streams at NTFS volumes via "File / Alternate Streams" menu command. - 7-Zip now can extract .zipx (WinZip) archives that use xz compression. - new optional "section size" parameter for BCJ2 filter for compression ratio improving. Example: -mf=BCJ2:d9M, if largest executable section in files is smaller than 9 MB. - Speed optimizations for BCJ2 filter and SHA-1 and SHA-256 calculation. - Console version now uses stderr stream for error messages. - Console version now shows names of processed files only in progress line by default. - new -bb[0-3] switch to set output log level. -bb1 shows names of processed files in log. - new -bs[o|e|p][0|1|2] switch to set stream for output messages; o: output, e: error, p: progress line; 0: disable, 1: stdout, 2: stderr. - new -bt switch to show execution time statistics. - new -myx[0-9] switch to set level of file analysis. - new -mmtf- switch to set single thread mode for filters. - The BUG was fixed: 7-Zip didn't restore NTFS permissions for folders during extracting from WIM archives. - The BUG was fixed: The command line version: if the command "rn" (Rename) was called with more than one pair of paths, 7-Zip used only first rename pair. - The BUG was fixed: 7-Zip crashed for ZIP/LZMA/AES/AES-NI. - The BUG in 15.01-15.02 was fixed: 7-Zip created incorrect ZIP archives, if ZipCrypto encryption was used. 7-Zip 9.20 can extract such incorrect ZIP archives. - Some bugs were fixed. 9.38 beta 2015-01-03 ------------------------- - Some bugs were fixed. 9.36 beta 2014-12-26 ------------------------- - The BUG in command line version was fixed: 7-Zip created temporary archive in current folder during update archive operation, if -w{Path} switch was not specified. The fixed 7-Zip creates temporary archive in folder that contains updated archive. - The BUG in 9.33-9.35 was fixed: 7-Zip silently ignored file reading errors during 7z or gz archive creation, and the created archive contained only part of file that was read before error. The fixed 7-Zip stops archive creation and it reports about error. - Some bugs were fixed. 9.35 beta 2014-12-07 ------------------------- - The BUG was fixed: 7-Zip crashed during ZIP archive creation, if the number of CPU threads was more than 64. - The BUG in 9.31-9.34 was fixed: 7-Zip could not correctly extract ISO archives that are larger than 4 GiB. - The BUG in 9.33-9.34 was fixed: The option "Compress shared files" and -ssw switch didn't work. - The BUG in 9.26-9.34 was fixed: 7-Zip File Manager could crash for some archives open in "Flat View" mode. - Some bugs were fixed. 9.34 alpha 2014-06-22 ------------------------- - The BUG in 9.33 was fixed: Command line version of 7-Zip could work incorrectly, if there is relative path in exclude filename optiton (-x) an

Signatures

Bandook RAT
Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.
rat trojan bandook

Bandook payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3672-177-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook
behavioral2/memory/3672-178-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook
behavioral2/memory/4572-184-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook

Executes dropped EXE 3 IoCs

Processes:

7z2201-x64.exe7zG.exePAGOS CANCELADOS_27D.exe

pid process

4376 7z2201-x64.exe
1676 7zG.exe
1688 PAGOS CANCELADOS_27D.exe

pid	process
4376	7z2201-x64.exe
1676	7zG.exe
1688	PAGOS CANCELADOS_27D.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

7z2201-x64.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2201-x64.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3672-175-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral2/memory/3672-176-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral2/memory/3672-177-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral2/memory/3672-178-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral2/memory/4572-184-0x0000000013140000-0x0000000014009000-memory.dmp	upx

Loads dropped DLL 2 IoCs

Processes:

7zG.exe

pid process

760
1676 7zG.exe

pid	process
760
1676	7zG.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msinfo32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	msinfo32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FCFO = "C:\\Users\\Admin\\AppData\\Roaming\\FCFO\\FCFO.exe"	msinfo32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

Processes:

7z2201-x64.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	7z2201-x64.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	7z2201-x64.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	7z2201-x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1920 3152 WerFault.exe

pid	pid_target	process	target process
1920	3152	WerFault.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exetaskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exechrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 20 IoCs

Processes:

7z2201-x64.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2201-x64.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exemsinfo32.exechrome.exechrome.exechrome.exechrome.exechrome.exetaskmgr.exechrome.exetaskmgr.exe

pid	process
2968	chrome.exe
2968	chrome.exe
204	chrome.exe
204	chrome.exe
4232	chrome.exe
4232	chrome.exe
1520	chrome.exe
1520	chrome.exe
2908	chrome.exe
2908	chrome.exe
4880	chrome.exe
4880	chrome.exe
2380	chrome.exe
2380	chrome.exe
3960	chrome.exe
3960	chrome.exe
3672	msinfo32.exe
3672	msinfo32.exe
5092	chrome.exe
5092	chrome.exe
444	chrome.exe
444	chrome.exe
4084	chrome.exe
4084	chrome.exe
1512	chrome.exe
1512	chrome.exe
2940	chrome.exe
2940	chrome.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2316	taskmgr.exe
2316	taskmgr.exe
2316	taskmgr.exe
2316	taskmgr.exe
2316	taskmgr.exe
2316	taskmgr.exe
2316	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

Processes:

chrome.exechrome.exe

pid	process
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

7zG.exetaskmgr.exetaskmgr.exe

description	pid	process
Token: SeRestorePrivilege	1676	7zG.exe
Token: 35	1676	7zG.exe
Token: SeSecurityPrivilege	1676	7zG.exe
Token: SeSecurityPrivilege	1676	7zG.exe
Token: SeDebugPrivilege	2632	taskmgr.exe
Token: SeSystemProfilePrivilege	2632	taskmgr.exe
Token: SeCreateGlobalPrivilege	2632	taskmgr.exe
Token: 33	2632	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2632	taskmgr.exe
Token: SeDebugPrivilege	2316	taskmgr.exe
Token: SeSystemProfilePrivilege	2316	taskmgr.exe
Token: SeCreateGlobalPrivilege	2316	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exechrome.exe7zG.exetaskmgr.exe

pid	process
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
1676	7zG.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

chrome.exetaskmgr.exe

pid	process
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
204	chrome.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe
2632	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 204 wrote to memory of 2512	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 2512	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 3228	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 3228	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 3228	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 3228	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 3228	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 3228	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 3228	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 3228	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 3228	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 3228	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 3228	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 3228	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 3228	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 3228	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 3228	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 3228	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 3228	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 3228	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 3228	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 3228	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 3228	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 3228	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 3228	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 3228	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 3228	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 3228	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 3228	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 3228	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 3228	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 3228	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 3228	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 3228	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 3228	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 3228	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 3228	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 3228	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 3228	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 3228	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 3228	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 3228	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 2968	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 2968	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 2328	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 2328	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 2328	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 2328	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 2328	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 2328	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 2328	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 2328	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 2328	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 2328	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 2328	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 2328	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 2328	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 2328	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 2328	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 2328	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 2328	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 2328	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 2328	204	chrome.exe	chrome.exe
PID 204 wrote to memory of 2328	204	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\PAGOS CANCELADOS_27D.exe
"C:\Users\Admin\AppData\Local\Temp\PAGOS CANCELADOS_27D.exe"
1⤵
PID:5056

C:\windows\SysWOW64\msinfo32.exe
C:\windows\syswow64\msinfo32.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3672

C:\windows\SysWOW64\msinfo32.exe
C:\windows\syswow64\msinfo32.exe
2⤵
- Adds Run key to start application
PID:4572

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:204

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7fff7bc74f50,0x7fff7bc74f60,0x7fff7bc74f70
2⤵
PID:2512

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1636,8947173872772906627,347424367389842380,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1616 /prefetch:2
2⤵
PID:3228

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1636,8947173872772906627,347424367389842380,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2016 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2968

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1636,8947173872772906627,347424367389842380,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2308 /prefetch:8
2⤵
PID:2328

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,8947173872772906627,347424367389842380,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2972 /prefetch:1
2⤵
PID:5104

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,8947173872772906627,347424367389842380,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
2⤵
PID:4668

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,8947173872772906627,347424367389842380,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3872 /prefetch:1
2⤵
PID:4672

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,8947173872772906627,347424367389842380,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4548 /prefetch:8
2⤵
PID:744

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,8947173872772906627,347424367389842380,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4560 /prefetch:8
2⤵
PID:5112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,8947173872772906627,347424367389842380,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4792 /prefetch:8
2⤵
PID:3308

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,8947173872772906627,347424367389842380,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4232

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,8947173872772906627,347424367389842380,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4984 /prefetch:8
2⤵
PID:1004

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,8947173872772906627,347424367389842380,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1520

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,8947173872772906627,347424367389842380,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4616 /prefetch:8
2⤵
PID:3968

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,8947173872772906627,347424367389842380,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4612 /prefetch:8
2⤵
PID:4384

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,8947173872772906627,347424367389842380,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5360 /prefetch:8
2⤵
PID:5108

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,8947173872772906627,347424367389842380,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
2⤵
PID:1848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2520

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 468 -p 3152 -ip 3152
1⤵
PID:4148

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3152 -s 1676
1⤵
- Program crash
PID:1920

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3664

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:4880

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff7bc74f50,0x7fff7bc74f60,0x7fff7bc74f70
2⤵
PID:3472

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1620,12447549538613371744,2242786857925429661,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1980 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2908

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1620,12447549538613371744,2242786857925429661,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1644 /prefetch:2
2⤵
PID:1072

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1620,12447549538613371744,2242786857925429661,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2320 /prefetch:8
2⤵
PID:1084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,12447549538613371744,2242786857925429661,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2908 /prefetch:1
2⤵
PID:3448

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,12447549538613371744,2242786857925429661,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2884 /prefetch:1
2⤵
PID:4772

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,12447549538613371744,2242786857925429661,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:1
2⤵
PID:4696

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,12447549538613371744,2242786857925429661,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4524 /prefetch:8
2⤵
PID:1332

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,12447549538613371744,2242786857925429661,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4808 /prefetch:8
2⤵
PID:3784

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,12447549538613371744,2242786857925429661,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4568 /prefetch:8
2⤵
PID:3980

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,12447549538613371744,2242786857925429661,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2380

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,12447549538613371744,2242786857925429661,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4976 /prefetch:8
2⤵
PID:628

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,12447549538613371744,2242786857925429661,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3960

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,12447549538613371744,2242786857925429661,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2456 /prefetch:1
2⤵
PID:796

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,12447549538613371744,2242786857925429661,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5092

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1620,12447549538613371744,2242786857925429661,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5472 /prefetch:8
2⤵
PID:1832

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1620,12447549538613371744,2242786857925429661,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5532 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:444

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,12447549538613371744,2242786857925429661,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2480 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,12447549538613371744,2242786857925429661,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
2⤵
PID:2044

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,12447549538613371744,2242786857925429661,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3096 /prefetch:1
2⤵
PID:2340

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,12447549538613371744,2242786857925429661,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=808 /prefetch:8
2⤵
PID:3628

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,12447549538613371744,2242786857925429661,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5812 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1512

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,12447549538613371744,2242786857925429661,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
2⤵
PID:3784

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,12447549538613371744,2242786857925429661,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
2⤵
PID:1644

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1620,12447549538613371744,2242786857925429661,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2384 /prefetch:8
2⤵
PID:4192

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1620,12447549538613371744,2242786857925429661,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3128 /prefetch:8
2⤵
PID:3640

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,12447549538613371744,2242786857925429661,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6024 /prefetch:8
2⤵
PID:3232

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1620,12447549538613371744,2242786857925429661,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5988 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2940

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1620,12447549538613371744,2242786857925429661,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5972 /prefetch:8
2⤵
PID:4504

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1620,12447549538613371744,2242786857925429661,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5924 /prefetch:8
2⤵
PID:2520

C:\Users\Admin\Downloads\7z2201-x64.exe
"C:\Users\Admin\Downloads\7z2201-x64.exe"
2⤵
- Executes dropped EXE
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
PID:4376

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,12447549538613371744,2242786857925429661,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5756 /prefetch:8
2⤵
PID:2232

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,12447549538613371744,2242786857925429661,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6124 /prefetch:8
2⤵
PID:2684

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1620,12447549538613371744,2242786857925429661,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1536 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4644

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,12447549538613371744,2242786857925429661,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3636 /prefetch:8
2⤵
PID:1448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3604

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\PAGOS CANCELADOS_27D\" -spe -an -ai#7zMap17624:102:7zEvent3566
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1676

C:\Users\Admin\Downloads\PAGOS CANCELADOS_27D\PAGOS CANCELADOS_27D.exe
"C:\Users\Admin\Downloads\PAGOS CANCELADOS_27D\PAGOS CANCELADOS_27D.exe"
1⤵
- Executes dropped EXE
PID:1688

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2632

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2316

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Filesize
40B

MD5
a3a937930c5b01ecd542f094135aa0a4

SHA1
79234b7656f2a562129f98b27bc0762dc867d7fa

SHA256
985145fe40ae859f59ca7f31f100fe1a194f21810f50f5fd26c4c73c25b03ff9

SHA512
7fa94881f580973ffe4c6b67b811d47e7c104681b1fb8b36c6754ca0d29e731e89c252a9ea62e1888edf2eb3ffc8aa9f6462ed78f61c9683ddbe0d3f50f7ca41

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\data_0
Filesize
44KB

MD5
9467fb7782350769164d43d5518cc006

SHA1
a7dade6f3096b0aa75def01d8a33206d957315c2

SHA256
c5c1b1e82bed926cd6409b60dcac7512b7b9309bf87df7e20d5499316f244648

SHA512
124f68e1146141991cbcb2ffeaffc6a0179c369d8f11036f790485aa9af8e33c40f21a59a6854ae6d8b35cea4de22cc7180be2edeb2452b4a2867ebbd4709e1a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\data_1
Filesize
264KB

MD5
128aa250c0a3ed0b89bbeccf770456c0

SHA1
39f0cace98b22c8d3c3ebac4da06039374e0dbb4

SHA256
93e8b72a85d980a278d94d6a589863f7bcc88b8dec3f5e7a7fa23cdae5a43176

SHA512
6789420b414dc69de57596fb1e6ad48879d8ad58f4a438ce94468bb1e5de152cf944073cb210283647922bf42e71309c08128f87c0f02c37d01b37445f9188eb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3
Filesize
4.0MB

MD5
69dc9917270abbca1e05b4432bfd4f6d

SHA1
24acff63aadb8cc7f6316719cb4963ae80053d93

SHA256
bf4c8cd426e922a5167aa474f630cfb0e162aa475571795d5ae8e12b6c0e7efe

SHA512
e62f1288915eff217fc36c81935ee265b8ab357ebcc0ca1704dc5eefb7607a5a48e8d4db51ef00a3d6c3f1c5c2deb545505de07df6670dae978f09a3814af4a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000001
Filesize
39KB

MD5
f3134c2c53ae6e1e768ad42d4f63aa3f

SHA1
da57bd50eae145d33854e1904be1957cb2ddf045

SHA256
10ae99d9c7d3c87d054b63c8721a32e676da2e93f4830df3021660a43fae5ed4

SHA512
416f7c0574ca281d2a73746a3ddc15708553be1571705b62bc48e6a634f706c817fa50de76a753fb893aa9760b3f980659972761f34285ecfa12ec14417ace4c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000002
Filesize
49KB

MD5
88a91890e14f1a8ae4e4264c515b38e3

SHA1
6e3c1a4903768e6cb32e6f898bb2e74c46912e3f

SHA256
a0d5dcb379336ba10d79ae9b3af9bd36412efc86a02e77446099a82b6030ceb0

SHA512
1150e59fb1af188ad47f5109e3d3e67832c77c5d8dfdc56acc9a335fdb19f23cde6a94da22f5e6351461c49ad476480789367b43add3f78c04f0b8220fde6830

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000003
Filesize
35KB

MD5
48ff0e8782ee2e49fb2fc1e680e7953a

SHA1
669792e69fa69c053a346ce0c75272fb6ec4e330

SHA256
84496f0ae0347138128eb776b51457f470452aa1e7284653af71efa3d4954c62

SHA512
6e37171b9394685d2686895d9f47500302937e603c7e7af4190bc39f08f4b9e8b3d01cb844c442a8ade6eaa5eab41b66cd7b4eea261190a70f5d0597e2b85c6d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log
Filesize
399B

MD5
a15ac2782bb6b4407d11979316f678fd

SHA1
b64eaf0810e180d99b83bba8e366b2e3416c5881

SHA256
55f8fa21c3f0d42c973aedf538f1ade32563ae4a1e7107c939ab82b4a4d7859a

SHA512
370b43c7e434c6cc9328d266c1c9db327621e2c95ad13d953c4d63457a141fbf2be0b35072de96becc29048224d3646535a149229fc2ba367c7903d3e3e79bdb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Filesize
317B

MD5
d566242002a51fafebbf91190b26e9da

SHA1
c4ed7212b7e939bfbfdc26fd65393c1baa906d1f

SHA256
7896fcb98e13588b1493dc4db9b7a97e81c08ee9d952e3dc1ae7391c5ea47ac5

SHA512
6dd2c695f935a2d37c94d830bdcfe85d101bd6f80f48f896dd5194e1f2420176963da5bafb5f9664acc5d1929362f6ccb87b4106971daa2ecc4a0ea37c2435f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json
Filesize
10KB

MD5
90f880064a42b29ccff51fe5425bf1a3

SHA1
6a3cae3996e9fff653a1ddf731ced32b2be2acbf

SHA256
965203d541e442c107dbc6d5b395168123d0397559774beae4e5b9abc44ef268

SHA512
d9cbfcd865356f19a57954f8fd952caf3d31b354112766c41892d1ef40bd2533682d4ec3f4da0e59a5397364f67a484b45091ba94e6c69ed18ab681403dfd3f3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\verified_contents.json
Filesize
7KB

MD5
0834821960cb5c6e9d477aef649cb2e4

SHA1
7d25f027d7cee9e94e9cbdee1f9220c8d20a1588

SHA256
52a24fa2fb3bcb18d9d8571ae385c4a830ff98ce4c18384d40a84ea7f6ba7f69

SHA512
9aeafc3ece295678242d81d71804e370900a6d4c6a618c5a81cacd869b84346feac92189e01718a7bb5c8226e9be88b063d2ece7cb0c84f17bb1af3c5b1a3fc4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
Filesize
264KB

MD5
5cc901d022c4fbc36a6eed4a8d62a699

SHA1
f2a8728b12c1dfb7f96e5414bd3bb775697f5e9c

SHA256
2c9b6a865f201b0e550a816ce5b2f024f05f5f87d195bc68eb717fd3a789db86

SHA512
03cca499c12faa6fe2920fbc4291575d30f7a3ef318a2a3255f927798f2981bd7e01f0c33ede5d406c638eacfea2e7cb3ba3648a2d43dd94e82bcd0efae162ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Filesize
329B

MD5
b2a205b2de840ce19e8e99057b5d03c1

SHA1
d130bf96fae0369f8dba4baf1632af69ab7b8d67

SHA256
d5e8927a04441ef5ded489b84de01747c0a8924edff2968e0b8b567bf7d9ee32

SHA512
d67f72b38ac8e700d94526d3eb8551db085029d7466df710cc4b37030d63795aa9459061ce7b26ff2612fa1597d0cfa7c49185a447b4e33fc8e11b4c48de34c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State
Filesize
1KB

MD5
32982bd630caa832510795b22bfd4ff8

SHA1
a06e5b63a9323f6efda7d198dff6295717686c20

SHA256
42b8de709bb50e3f10fadcb628201e8d4653f2842c892a938af73bf8d77576a7

SHA512
16fb283f69fe1e2789bf8de0eb82ae6ed9582205879473c372ebe935d52b9c1cf74e80830e9d58c7e4c7b9df5068ecb1c7ef3aa6120ba054352d38128d79f0f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\LOG
Filesize
331B

MD5
2d665c28eeffeba7d1be34105e7e1620

SHA1
00f6ea48b61663f8e80199702ce8f401e788102d

SHA256
c6e5a547ce5c8fac7f4b41e6388486ae47a00230893232e4b5e18dcb4f16cf7a

SHA512
68d4a68ce4531ec18079f5254669ae000356311c9fb776bad657e5b431f979412c4840a36b771cee2eddc6449fbcd8f4f3d600abe32b41dffb005c02228e75b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
4KB

MD5
2313edf50e51693b40eb39d62dc5cc47

SHA1
ed2fef3ab647f193c7c37747367f8e7cde22a7ec

SHA256
60fe14d87040f6be101d4fb0037bfa0cf65da4cc369befeddd14a27bce7e7561

SHA512
97379f55760ddce6bf60661af18c34b7762971ec42a68d0b0dffe3a38d1548561c1e167028e104e89e19a33c2deb0acbd9e0e58330f5350ac9762663c87a6c60

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferredApps
Filesize
33B

MD5
2b432fef211c69c745aca86de4f8e4ab

SHA1
4b92da8d4c0188cf2409500adcd2200444a82fcc

SHA256
42b55d126d1e640b1ed7a6bdcb9a46c81df461fa7e131f4f8c7108c2c61c14de

SHA512
948502de4dc89a7e9d2e1660451fcd0f44fd3816072924a44f145d821d0363233cc92a377dba3a0a9f849e3c17b1893070025c369c8120083a622d025fe1eacf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Reporting and NEL
Filesize
36KB

MD5
021ba8a2b15ee68ab0204ba6986aba8c

SHA1
59ce840b6e819a29696311d7cf0891cf39e71d26

SHA256
c5b2b7a540359b9a0f318c258a8677ecb890a792ee7a84cc4a1b1c94dbe790a5

SHA512
f84c522da0b514c263b6f80aa29542b1f764950bd1df86ba77a473ddfaa4501058bcac268c5afb54c42d6aafb843efddf5d82378a498b05961d7b67f6ec32fa2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
17KB

MD5
1a4b4fa23c83ebe185f954fc5480c08f

SHA1
5c7f8260f31ebf69bf96bb6e00ac2a6e36f24930

SHA256
6cb68aa132508ae42cfb6f721f8358e7416d455cb093c4155b2f2be0c783ed04

SHA512
68668054cf048f917aae81f25f715deadf27e45c56997dd8de340ef06231cbfc2e69e41f5b76f00969eb3951452f197e8180d0dc048f7649cedbab1f75bd70e8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log
Filesize
194B

MD5
d7d9437445aa960dcea52ffe772822dc

SHA1
c2bbf4ac0732d905d998c4f645fd60f95a675d02

SHA256
4ff49903bec1197017a35995d5c5fc703caf9d496467345d783f754b723d21c1

SHA512
335eb1ba85670550ed1e1e4e14ea4b5d14f8306125bf147a42de4def5e5f75f14c422b014414030cf30378c04f748ac875cf056adda196511a0b057b3598fe9a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG
Filesize
317B

MD5
7001fca435d3c6fd45ddba5afe84b094

SHA1
126a4223553ef0b18231e5cc754ec7f6e94de2b5

SHA256
eb272e3131c12627729af5a0534f3146fab986ce127767d42ce7aa993940e21d

SHA512
db5aefb4314782e2b6496a5d8177ec3a724a8a9f3181115317d401021523260e122c66bdc13574e3d7a315c5c2eae785379f3e71fbbe68d54b18a8dac94b7a98

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Tabs_13308940678932679
Filesize
669B

MD5
133c73c4f559cdbadd3ad0f7c487aecc

SHA1
3295baf1b33229bb92aae724d1dabd05173ce618

SHA256
79bc00574c875834a847de949672a1bcdcc8bae8689ef0158ff69be4d1d0005a

SHA512
bbfc8d5c481c35d06dabc55f4e3646c70835c1c05f7fe204ce89d570dac56e318fe5689a0ad2d9fe90357e3e3a85403d2ff8085b02c4688845b711c4fd3d234d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shortcuts
Filesize
20KB

MD5
8be985ece811ba0a3f10087f5f4e6fd4

SHA1
c87c84d4fe182ffb8362f3cabd33349af94e9b55

SHA256
da78d36c765d3248b1a72ead5f83b7a58cba7d361f17a6831332ee994cee939a

SHA512
901932baea8712e89188cfce00a6b2388ba38697bcbfeebcf8b83b88b0cb26c7323b098ba6983c312ded1041f6e297412010113a32e99a9350aa4492ca40efa9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Filesize
345B

MD5
ecf6b86fb865b6b29340ea64b97a6b34

SHA1
ca31d12be959cae841e206054132ec63d45020f8

SHA256
3a2ef97960e229a235b40521106ac390ddafe718f959eeaf5f2e0531a019317f

SHA512
167883cfab48f3db9af07c8ee04a96ca403dfad16458124b42bc5aa5818aa1174f8543cc25fc9ef5f025cf8a6515c8494f53f17cd61ec6d50554824625874763

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000003.log
Filesize
160B

MD5
de92ad90be6d3364745b2f73f4c3cf73

SHA1
9158681463bd30e5af4dda4baac81f93cedbda77

SHA256
0025a3e0d3b834401b3b5f820e1991ef7e810d9a4b8b6b579e6301c94e7031a0

SHA512
9e81cefc195439439f4b23ee7696309d7bc3c08e5b444d2abde26d2f12b2d3bcfd124fb9a2d40c6389e9f787741676fad366a2e9982674e7b931028c014d8a79

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Filesize
321B

MD5
bebca65c4f60a5845d9de40cc86bce56

SHA1
7e45bf3da80a5981455d4855724894eb9338839b

SHA256
42334bc76cf42f430085bc649acfdffb47147654e1c040af9cb0d77b1506dc5b

SHA512
a4f5e52b5fe2e6818f854a46e4f3a24461c157990bcff147a365364dc93cc517ece1bd922a84b63b95413c25466792361560b786408484b5ab71425b38d6d2b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\TransportSecurity
Filesize
538B

MD5
2b33e8b801013f026e01b0fdccdfa175

SHA1
31fc46dce12b7fde5378aa6e4c307048cc381772

SHA256
3f44d671d27fdf1be105eda4c19dcf2b73c05d12a9e26d8cc402f296ffc6d0a8

SHA512
181c661aa6e15a05029d15fa1e86052cf86e3f7289b754a90d23c7650576824e32490da35a21427607cd89cb87e2bd6eecff5bc99105fcae094d668fa179e7fa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG
Filesize
45B

MD5
ead5229376df30bd117a5767f643e040

SHA1
59580aebeaf606e0e8bbaefe3b8fa925e7085692

SHA256
5b120755e7010721087cc2f91ac89d01ac403baea66528db224d8db3a8c6a22a

SHA512
82be4acb29892227e1d2555d84b0a8c20c63af4b727456adbe86e452ed72f6dc69b4a0858692cab9c345f64bb723bb722114c8cd3629ed8943483c1e6da32a1a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000002
Filesize
50B

MD5
22bf0e81636b1b45051b138f48b3d148

SHA1
56755d203579ab356e5620ce7e85519ad69d614a

SHA256
e292f241daafc3df90f3e2d339c61c6e2787a0d0739aac764e1ea9bb8544ee97

SHA512
a4cf1f5c74e0df85dda8750be9070e24e19b8be15c6f22f0c234ef8423ef9ca3db22ba9ef777d64c33e8fd49fada6fcca26c1a14ba18e8472370533a1c65d8d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db
Filesize
16KB

MD5
9a8e0fb6cf4941534771c38bb54a76be

SHA1
92d45ac2cc921f6733e68b454dc171426ec43c1c

SHA256
9ee9211a57c3f6fa211fe0323fa8cd521e7cbffcd8ff0896645a45795dc472be

SHA512
12ed22537dcc79d53f6c7d39e92a38f8fea076d793198928f5b7a5dd1234d50a3c0b4815632f3fadf8bc4ef0499773d22bd83f961d2d0ffd8afacf471bd3a5ae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\previews_opt_out.db
Filesize
16KB

MD5
d926f072b41774f50da6b28384e0fed1

SHA1
237dfa5fa72af61f8c38a1e46618a4de59bd6f10

SHA256
4f7b0e525d4bfc53d5df49589e25a0bccf2fcf6a1a0ca3f94d3285bb9cf0a249

SHA512
a140df6ec0d3099ef374e8f3ece09bf91bc896ac4a1d251799a521543fe9bdea796ba09fa47932bd54fa939118495078f9258557b32c31d3d4011b0666a4723f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\GPUCache\data_1
Filesize
264KB

MD5
87c0823540a7a141ed14447e40abbbbb

SHA1
d83e5f3e536d3ff695368f70b5a7916068655fe4

SHA256
bfbcc0d00c0ad03e808793d20d780b63f5b165d5680df6f0cccc776f46ac08eb

SHA512
0d8c690d44dff6d19e1342f77c1e017340f5bc315af07e03d29d6b70993131b5b5c59992c0845c3d75c049e9a8e4186b2d6ab15eab736e0e7495fc70e0450042

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Filesize
13B

MD5
b63048c4e7e52c52053d25da30d9c5ab

SHA1
679a44d402f5ec24605719e06459f5a707989187

SHA256
389caa40ea458e84bc624a9af1e0dec60fa652b2db2b81c09b1dfe22822cc3d1

SHA512
e86c58c5a25e24f21ad79ed526a90c120a09c115f4820663bd2ebbc59e7bb1c4c418267eb77645522aa20b2c1b53fba8e31690db7bae9b21e4eff3db06316359

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
96KB

MD5
e0994a7117402c8fe9baa91027bd88c7

SHA1
8dc5ca09edd4dd8c36fdeb19011165e2c3231a78

SHA256
9d3fc168981726b399e36097921b10d88f5a63ad45b28b777ac6d88d3fbb4e37

SHA512
4547fcd69cc78c61d2a9f803aecf9d79ed55146584f28fd6cf8957c7cad86b5f40de7abd0dfe6cbabc9b712e9f51e6b74a70b4f301121e082440869604e68e7d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1
Filesize
264KB

MD5
450998a1f331d315c5281f06d3317059

SHA1
f02dd07802c2051b05f6c9a603139a12eaa7947e

SHA256
f60fbc7c0a443c8ae0e42300a434b227e48ad190183b846ad0612a1dbc14a6fc

SHA512
7c8f1109474128ed6aa922f210a1c55b206c4a9a7b178c4e655796f99c2249d7a308f190eb084d5784ba72c5604c180c8ef0b997006a35ab90dda1d0e85831d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt
Filesize
4B

MD5
e09f61118b4be1386d24242390fb563f

SHA1
ab5fb1c699c36b4510743fa24f0b06dc70ab8397

SHA256
99c931f38383eb00b3322318221f1f28e4272264eaac7da21afacf5cb4eda814

SHA512
ea751bfaa5cf483325bead5716ac726716089c6d7966f7da32c8bc4559d7e898f50b8ab7a6f936968981f18dc6aa987594c4dcdf8d6ea6de11bea57a278eb0f1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.acl
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
\??\pipe\crashpad_204_OECUCPDIBEXACNZP
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\crashpad_4880_SREOANVEIQRSYZUS
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/3672-174-0x0000000000000000-mapping.dmp

Download
memory/3672-175-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/3672-176-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/3672-177-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/3672-178-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/4376-179-0x0000000000000000-mapping.dmp

Download
memory/4572-180-0x0000000000000000-mapping.dmp

Download
memory/4572-184-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download