hxxps://drive[.]google[.]com/uc?id=12WBT8qXg0FZyiIfnQfimIrN-sUpoTREP&export=download

Analysis

max time kernel
409s
max time network
412s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
31-03-2023 20:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/uc?id=12WBT8qXg0FZyiIfnQfimIrN-sUpoTREP&export=download

Score

10^/10

agilenet bootkit discovery evasion persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

wscript.exewscript.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe

Downloads MZ/PE file
Executes dropped EXE 9 IoCs

Processes:

7z2201-x64.exe7zG.exeNRVP.exe7zG.exeMrsMajor 3.0.exeeulascr.exeMrsMajor 3.0.exeeulascr.exedismhost.exe

pid process

4204 7z2201-x64.exe
2476 7zG.exe
2584 NRVP.exe
2628 7zG.exe
4576 MrsMajor 3.0.exe
796 eulascr.exe
1436 MrsMajor 3.0.exe
1872 eulascr.exe
2636 dismhost.exe

Loads dropped DLL 11 IoCs

Processes:

7zG.exe7zG.exeeulascr.exeeulascr.exedismhost.exe

pid	process
3148
3148
2476	7zG.exe
2628	7zG.exe
796	eulascr.exe
1872	eulascr.exe
2636	dismhost.exe
2636	dismhost.exe
2636	dismhost.exe
2636	dismhost.exe
2636	dismhost.exe

Obfuscated with Agile.Net obfuscator 3 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\F534.tmp\eulascr.exe	agile_net
C:\Users\Admin\AppData\Local\Temp\F534.tmp\eulascr.exe	agile_net
behavioral1/memory/796-1038-0x0000000000870000-0x000000000089A000-memory.dmp	agile_net

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

7z2201-x64.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2201-x64.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Windows\CurrentVersion\Run	chrome.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

MEMZ.exe

description ioc process

File opened for modification \??\PhysicalDrive0 MEMZ.exe
Drops file in System32 directory 1 IoCs

Processes:

systemreset.exe

description ioc process

File opened for modification C:\Windows\system32\Recovery\ReAgent.xml systemreset.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

description	ioc	process
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	systemreset.exe

Drops file in Program Files directory 64 IoCs

Processes:

7z2201-x64.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7z2201-x64.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	7z2201-x64.exe
File created	C:\Program Files\7-Zip\Lang\tk.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	7z2201-x64.exe

Drops file in Windows directory 64 IoCs

Processes:

systemreset.exeMicrosoftEdge.exeMicrosoftEdge.exetaskmgr.exe

description	ioc	process
File opened for modification	C:\Windows\Logs\PBR\Panther\UnattendGC\diagwrn.xml	systemreset.exe
File created	C:\Windows\Logs\PBR\Panther\cbs_unattend.log	systemreset.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\diagerr.xml	systemreset.exe
File opened for modification	C:\Windows\Logs\PBR\setuperr.log	systemreset.exe
File opened for modification	C:\Windows\Logs\PBR\INF\setupapi.dev.log	systemreset.exe
File created	C:\Windows\Logs\PBR\Panther\UnattendGC\setuperr.log	systemreset.exe
File created	C:\Windows\Logs\PBR\Panther\DDACLSys.log	systemreset.exe
File created	C:\Windows\Logs\PBR\Panther\MainQueueOnline0.que	systemreset.exe
File created	C:\Windows\Logs\PBR\Panther\MainQueueOnline1.que	systemreset.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\setuperr.log	systemreset.exe
File created	C:\Windows\Logs\PBR\setupact.log	systemreset.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\_s_565E.tmp	systemreset.exe
File created	C:\Windows\Logs\PBR\SessionID.xml	systemreset.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	systemreset.exe
File created	C:\Windows\Logs\PBR\Panther\UnattendGC\diagwrn.xml	systemreset.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\setupact.log	systemreset.exe
File created	C:\Windows\Logs\PBR\setuperr.log	systemreset.exe
File opened for modification	C:\Windows\Logs\PBR\INF	systemreset.exe
File opened for modification	C:\Windows\Logs\PBR\ReAgent	systemreset.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\actionqueue	systemreset.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\UnattendGC\setuperr.log	systemreset.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\Contents1.dir	systemreset.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\setupinfo	systemreset.exe
File opened for modification	C:\Windows\Logs\PBR\ResetSession.xml	systemreset.exe
File opened for modification	C:\Windows\Logs\PBR\SessionID.xml	systemreset.exe
File opened for modification	C:\Windows\Logs\PBR\CBS\CBS.log	systemreset.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\actionqueue\specialize.uaq	systemreset.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\diagwrn.xml	systemreset.exe
File created	C:\Windows\Logs\PBR\Panther\_s_5A86.tmp	systemreset.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\_s_5A86.tmp	systemreset.exe
File created	C:\Windows\Logs\PBR\BCDCopy	systemreset.exe
File created	C:\Windows\Logs\PBR\PushButtonReset.etl	systemreset.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\Logs\PBR\INF\setupapi.dev.log	systemreset.exe
File created	C:\Windows\Logs\PBR\Panther\UnattendGC\diagerr.xml	systemreset.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\cbs_unattend.log	systemreset.exe
File created	C:\Windows\Logs\PBR\Panther\setup.etl	systemreset.exe
File created	C:\Windows\Logs\PBR\Panther\_s_565E.tmp	systemreset.exe
File opened for modification	C:\Windows\Logs\PBR\BCDCopy.LOG1	systemreset.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	systemreset.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\actionqueue\oobeSystem.uaq	systemreset.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\UnattendGC\setupact.log	systemreset.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\setup.etl	systemreset.exe
File opened for modification	C:\Windows\Logs\PBR\Panther	systemreset.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File created	C:\Windows\Logs\PBR\INF\setupapi.offline.20170318_140323.log	systemreset.exe
File opened for modification	C:\Windows\Logs\PBR\INF\setupapi.setup.log	systemreset.exe
File created	C:\Windows\Logs\PBR\Panther\actionqueue\specialize.uaq	systemreset.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\MainQueueOnline0.que	systemreset.exe
File opened for modification	C:\Windows\Logs\PBR\PushButtonReset.etl	systemreset.exe
File created	C:\Windows\Logs\PBR\DISM\dism.log	systemreset.exe
File created	C:\Windows\Logs\PBR\Panther\diagwrn.xml	systemreset.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\MainQueueOnline1.que	systemreset.exe
File created	C:\Windows\Logs\PBR\Panther\setupact.log	systemreset.exe
File created	C:\Windows\Logs\PBR\Panther\setupinfo	systemreset.exe
File created	C:\Windows\Logs\PBR\Panther\_s_5872.tmp	systemreset.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\_s_5872.tmp	systemreset.exe
File opened for modification	C:\Windows\Logs\PBR	systemreset.exe
File created	C:\Windows\rescache\_merged\1601268389\3877292338.pri	taskmgr.exe
File created	C:\Windows\Logs\PBR\CBS\CBS.log	systemreset.exe
File created	C:\Windows\Logs\PBR\Panther\setuperr.log	systemreset.exe
File created	C:\Windows\Logs\PBR\Panther\unattend.xml	systemreset.exe
File created	C:\Windows\Logs\PBR\ResetSession.xml	systemreset.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1476 2584 WerFault.exe NRVP.exe

pid	pid_target	process	target process
1476	2584	WerFault.exe	NRVP.exe

Checks SCSI registry key(s) 3 TTPs 7 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vds.exetaskmgr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	vds.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exebrowser_broker.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe

Modifies data under HKEY_USERS 17 IoCs

Processes:

chrome.exeLogonUI.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133247765797882412"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeNRVP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe7z2201-x64.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings	NRVP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 010000004e6ad6cad817cad200fba87d1b8d8e5b762347726c7c11f97d1d462f4b369d6ad7f7a825438f825818356f52a2ff8e31156bed5d21c46da6b7e530aa16fdd9ff2a42dba8abcf4f0ac6135b8305f09fd1c6ee33677fd248d93f87	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = d09727ee2364d901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2201-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\NextBrowserDataLogTime = 10479c4e5664d901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OpenSearch	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-08760 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2201-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliForms	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Rating Prompt Shown = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\SettingsVersion = "2"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OpenSearch\OpenSearchDescriptionData = baffc49ee383374a8abf67e99635ea1e0100000053b06a1abe27334898108231552c52911f0061002a0000007700770077002e0067006f006f0067006c0065002e0063006f002e0063006b0000001f00630082000000680074007400700073003a002f002f007700770077002e0067006f006f0067006c0065002e0063006f002e0063006b002f0073006500610072006300680064006f006d00610069006e0063006800650063006b003f0066006f0072006d00610074003d006f00700065006e0073006500610072006300680000001f005c002400000047006f006f0067006c006500200053006500610072006300680000001f0000000a000000000000000000	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\LastClosedWidth = "800"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exechrome.exeeulascr.exeeulascr.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exe

pid	process
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
2376	chrome.exe
2376	chrome.exe
796	eulascr.exe
1872	eulascr.exe
2580	MEMZ.exe
2580	MEMZ.exe
4728	MEMZ.exe
4728	MEMZ.exe
4140	MEMZ.exe
4140	MEMZ.exe
2120	MEMZ.exe
2120	MEMZ.exe
4576	MEMZ.exe
4576	MEMZ.exe
2120	MEMZ.exe
4728	MEMZ.exe
4728	MEMZ.exe
2120	MEMZ.exe
2580	MEMZ.exe
2580	MEMZ.exe
2120	MEMZ.exe
2580	MEMZ.exe
2120	MEMZ.exe
2580	MEMZ.exe
4728	MEMZ.exe
4576	MEMZ.exe
4728	MEMZ.exe
4576	MEMZ.exe
4140	MEMZ.exe
4140	MEMZ.exe
4576	MEMZ.exe
4728	MEMZ.exe
4576	MEMZ.exe
4728	MEMZ.exe
2580	MEMZ.exe
2580	MEMZ.exe
2120	MEMZ.exe
2120	MEMZ.exe
4140	MEMZ.exe
4140	MEMZ.exe
2120	MEMZ.exe
2120	MEMZ.exe
2580	MEMZ.exe
2580	MEMZ.exe
4728	MEMZ.exe
4728	MEMZ.exe
4576	MEMZ.exe
4576	MEMZ.exe
4140	MEMZ.exe
4140	MEMZ.exe
4140	MEMZ.exe
4576	MEMZ.exe
4140	MEMZ.exe
4576	MEMZ.exe
4728	MEMZ.exe
4728	MEMZ.exe
2580	MEMZ.exe
2120	MEMZ.exe
2580	MEMZ.exe
2120	MEMZ.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

Processes:

OpenWith.exe7zG.exesystemreset.exe

pid process

4392 OpenWith.exe
2628 7zG.exe
1216 systemreset.exe
Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

pid process

336 MicrosoftEdgeCP.exe
336 MicrosoftEdgeCP.exe
2440 MicrosoftEdgeCP.exe
2440 MicrosoftEdgeCP.exe
2440 MicrosoftEdgeCP.exe
2440 MicrosoftEdgeCP.exe

pid	process
4392	OpenWith.exe
2628	7zG.exe
1216	systemreset.exe

pid	process
336	MicrosoftEdgeCP.exe
336	MicrosoftEdgeCP.exe
2440	MicrosoftEdgeCP.exe
2440	MicrosoftEdgeCP.exe
2440	MicrosoftEdgeCP.exe
2440	MicrosoftEdgeCP.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

Processes:

chrome.exe

pid	process
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exe7zG.exemshta.exe7zG.exe

pid	process
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
2476	7zG.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4728	mshta.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
2628	7zG.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

chrome.exetaskmgr.exe

pid	process
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe

Suspicious use of SetWindowsHookEx 56 IoCs

Processes:

7z2201-x64.exeOpenWith.exeMrsMajor 3.0.exeMrsMajor 3.0.exeMicrosoftEdge.exeMicrosoftEdgeCP.exesystemreset.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeLogonUI.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exe

pid	process
4204	7z2201-x64.exe
4392	OpenWith.exe
4392	OpenWith.exe
4392	OpenWith.exe
4392	OpenWith.exe
4392	OpenWith.exe
4392	OpenWith.exe
4392	OpenWith.exe
4392	OpenWith.exe
4392	OpenWith.exe
4392	OpenWith.exe
4392	OpenWith.exe
4392	OpenWith.exe
4392	OpenWith.exe
4392	OpenWith.exe
4392	OpenWith.exe
4392	OpenWith.exe
4392	OpenWith.exe
4392	OpenWith.exe
4392	OpenWith.exe
4392	OpenWith.exe
4392	OpenWith.exe
4392	OpenWith.exe
4392	OpenWith.exe
4392	OpenWith.exe
4392	OpenWith.exe
4576	MrsMajor 3.0.exe
1436	MrsMajor 3.0.exe
2616	MicrosoftEdge.exe
336	MicrosoftEdgeCP.exe
336	MicrosoftEdgeCP.exe
1216	systemreset.exe
5012	MicrosoftEdge.exe
2440	MicrosoftEdgeCP.exe
2440	MicrosoftEdgeCP.exe
2228	LogonUI.exe
4576	MEMZ.exe
2580	MEMZ.exe
4140	MEMZ.exe
2120	MEMZ.exe
4140	MEMZ.exe
4576	MEMZ.exe
2120	MEMZ.exe
4728	MEMZ.exe
2580	MEMZ.exe
4728	MEMZ.exe
4728	MEMZ.exe
2120	MEMZ.exe
4576	MEMZ.exe
4140	MEMZ.exe
4728	MEMZ.exe
2580	MEMZ.exe
2580	MEMZ.exe
2120	MEMZ.exe
4140	MEMZ.exe
4576	MEMZ.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 4012 wrote to memory of 4612	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 4612	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 3824	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 3824	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 3824	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 3824	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 3824	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 3824	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 3824	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 3824	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 3824	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 3824	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 3824	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 3824	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 3824	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 3824	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 3824	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 3824	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 3824	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 3824	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 3824	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 3824	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 3824	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 3824	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 3824	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 3824	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 3824	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 3824	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 3824	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 3824	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 3824	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 3824	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 3824	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 3824	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 3824	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 3824	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 3824	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 3824	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 3824	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 3824	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 3508	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 3508	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 968	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 968	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 968	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 968	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 968	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 968	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 968	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 968	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 968	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 968	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 968	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 968	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 968	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 968	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 968	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 968	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 968	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 968	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 968	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 968	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 968	4012	chrome.exe	chrome.exe
PID 4012 wrote to memory of 968	4012	chrome.exe	chrome.exe

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

Processes:

wscript.exewscript.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://drive.google.com/uc?id=12WBT8qXg0FZyiIfnQfimIrN-sUpoTREP&export=download
1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0x90,0xd8,0x7ffc89b09758,0x7ffc89b09768,0x7ffc89b09778
2⤵
PID:4612

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1636 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:2
2⤵
PID:3824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1716 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:8
2⤵
PID:3508

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2140 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:8
2⤵
PID:968

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2976 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:1
2⤵
PID:4432

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3056 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:1
2⤵
PID:4472

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:8
2⤵
PID:4216

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4816 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:8
2⤵
PID:3408

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:8
2⤵
PID:3544

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5092 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:1
2⤵
PID:5024

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5248 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:1
2⤵
PID:4340

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3680 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:8
2⤵
PID:4316

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5568 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:8
2⤵
PID:5104

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5668 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:1
2⤵
PID:1856

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3080 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:1
2⤵
PID:2004

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5904 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:1
2⤵
PID:212

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5308 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:8
2⤵
PID:4160

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5064 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:8
2⤵
PID:3736

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:8
2⤵
PID:3912

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5344 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:8
2⤵
PID:3928

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6128 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:8
2⤵
PID:4376

C:\Users\Admin\Downloads\7z2201-x64.exe
"C:\Users\Admin\Downloads\7z2201-x64.exe"
2⤵
- Executes dropped EXE
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4204

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4836 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:8
2⤵
PID:1860

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:8
2⤵
PID:2284

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6100 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:8
2⤵
PID:1892

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=1608 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:1
2⤵
PID:816

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=932 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:1
2⤵
PID:4148

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5596 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:8
2⤵
PID:3848

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2592 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:8
2⤵
PID:3304

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=5696 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:1
2⤵
PID:3312

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=5152 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:1
2⤵
PID:2628

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=5184 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:1
2⤵
PID:4444

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5740 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:8
2⤵
PID:1808

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5640 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:8
2⤵
PID:680

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5980 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:8
2⤵
PID:4152

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5680 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:8
2⤵
PID:4292

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4732 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:8
2⤵
PID:2744

C:\Users\Admin\Downloads\NRVP.exe
"C:\Users\Admin\Downloads\NRVP.exe"
2⤵
- Executes dropped EXE
- Modifies registry class
PID:2584

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\NRVP986\.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
3⤵
- Suspicious use of FindShellTrayWindow
PID:4728

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2584 -s 1304
3⤵
- Program crash
PID:1476

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2452 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2376

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=1592 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:1
2⤵
PID:2852

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=5880 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:1
2⤵
PID:4876

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4532 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:8
2⤵
PID:2040

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4844 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:8
2⤵
PID:2516

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=42 --mojo-platform-channel-handle=3388 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:1
2⤵
PID:5000

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=43 --mojo-platform-channel-handle=4532 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:1
2⤵
PID:1456

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=44 --mojo-platform-channel-handle=5824 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:1
2⤵
PID:4352

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=45 --mojo-platform-channel-handle=3756 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:1
2⤵
PID:2012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=46 --mojo-platform-channel-handle=3224 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:1
2⤵
PID:4540

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=47 --mojo-platform-channel-handle=2640 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:1
2⤵
PID:3368

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6220 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:8
2⤵
PID:1844

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5384 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:8
2⤵
PID:2704

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=50 --mojo-platform-channel-handle=2336 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:1
2⤵
PID:3168

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=51 --mojo-platform-channel-handle=6268 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:1
2⤵
PID:2504

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=52 --mojo-platform-channel-handle=6556 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:1
2⤵
PID:1660

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=53 --mojo-platform-channel-handle=6240 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:1
2⤵
PID:3912

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 --field-trial-handle=1876,i,4539691736884627093,858645397182036262,131072 /prefetch:8
2⤵
PID:2744

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4596

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4392

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:220

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap21194:84:7zEvent7101
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:2476

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\MrsMajor 3.0\" -ad -an -ai#7zMap23226:84:7zEvent3400
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2628

C:\Users\Admin\Desktop\MrsMajor 3.0\MrsMajor 3.0.exe
"C:\Users\Admin\Desktop\MrsMajor 3.0\MrsMajor 3.0.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4576

C:\Windows\system32\wscript.exe
"C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\F534.tmp\F535.tmp\F536.vbs //Nologo
2⤵
- UAC bypass
- System policy modification
PID:4100

C:\Users\Admin\AppData\Local\Temp\F534.tmp\eulascr.exe
"C:\Users\Admin\AppData\Local\Temp\F534.tmp\eulascr.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:796

C:\Users\Admin\Desktop\MrsMajor 3.0\MrsMajor 3.0.exe
"C:\Users\Admin\Desktop\MrsMajor 3.0\MrsMajor 3.0.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1436

C:\Windows\system32\wscript.exe
"C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\2F20.tmp\2F30.tmp\2F31.vbs //Nologo
2⤵
- UAC bypass
- System policy modification
PID:1208

C:\Users\Admin\AppData\Local\Temp\2F20.tmp\eulascr.exe
"C:\Users\Admin\AppData\Local\Temp\2F20.tmp\eulascr.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1872

C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ-master.zip\MEMZ-master\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ-master.zip\MEMZ-master\MEMZ.exe"
1⤵
PID:3808

C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ-master.zip\MEMZ-master\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ-master.zip\MEMZ-master\MEMZ.exe" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2580

C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ-master.zip\MEMZ-master\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ-master.zip\MEMZ-master\MEMZ.exe" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4728

C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ-master.zip\MEMZ-master\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ-master.zip\MEMZ-master\MEMZ.exe" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4576

C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ-master.zip\MEMZ-master\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ-master.zip\MEMZ-master\MEMZ.exe" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2120

C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ-master.zip\MEMZ-master\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ-master.zip\MEMZ-master\MEMZ.exe" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4140

C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ-master.zip\MEMZ-master\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ-master.zip\MEMZ-master\MEMZ.exe" /main
2⤵
- Writes to the Master Boot Record (MBR)
PID:4120

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\System32\notepad.exe" \note.txt
3⤵
PID:220

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of SendNotifyMessage
PID:4596

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2616

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:2496

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:336

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:4428

C:\Windows\system32\systemreset.exe
"C:\Windows\system32\systemreset.exe" -moset
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1216

C:\$SysReset\Scratch\939A0B47-0652-4B36-845A-013E28B3C447\dismhost.exe
C:\$SysReset\Scratch\939A0B47-0652-4B36-845A-013E28B3C447\dismhost.exe {A0080A78-EC57-4602-9C4A-44EEE99A70E3}
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2636

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2520

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:2180

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5012

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:2364

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:2440

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4276

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4208

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:932

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:3692

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5472

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5608

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3ab9055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2228

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:2712

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:5292

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Bootkit

T1067

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$SysReset\Logs\setupact.log
Filesize
29KB

MD5
2a207d7913677aba103e6cedbdd1dad8

SHA1
ba949ca24eba5ba6a94459e27d240922816743ae

SHA256
db0dbfa3c68a9522c31f9a2489bc1a6aedb3f57de842633ae6ab133e59585daf

SHA512
643fd1e1cdafd4a93f427e23742c35f5780216a2b6f714c3bafa26b6c1b4545541e6ac5c2234ac9f173349ae8cdee8bb1bcccfff6a832c7736d11df8e48b2280

Download Submit
C:\$SysReset\Logs\setuperr.log
Filesize
504B

MD5
8c3a06e29e98ea066a35eaf08eca10b4

SHA1
ff7f76b19aeecc978235af29c4e5332624049057

SHA256
8eb88a8a0c133cc3e35998338b6a57866e2166c9bbc3cd83ff63bd10e1535dc8

SHA512
c3f170dd64fd4d3210f405cc1641a4f899dab8b3850af22925fd148f0456ced3efbe0fe658fbaecf8129512dbdbda7a0281ac7054b1d738b30588b00d26b07eb

Download Submit
C:\Program Files\7-Zip\7z.dll
Filesize
1.7MB

MD5
bbf51226a8670475f283a2d57460d46c

SHA1
6388883ced0ce14ede20c7798338673ff8d6204a

SHA256
73578f14d50f747efa82527a503f1ad542f9db170e2901eddb54d6bce93fc00e

SHA512
f68eb9c4ba0d923082107cff2f0e7f78e80be243b9d92cfab7298f59461fcca2c5c944d4577f161f11a2011c0958a3c32896eba4f0e89cd9f8aed97ab5bc74f9

Download Submit
C:\Program Files\7-Zip\7zG.exe
Filesize
668KB

MD5
5ab26ffd7b3c23a796138640b1737b48

SHA1
6dab8c3822a0cab5b621fd2b7f16aebb159bcb56

SHA256
eb775b0e8cc349032187c2329fefcf64f5feed4d148034c060e227adf6d38500

SHA512
2b40489f46e305f7e3455cac25e375711a6a1733861ee7bf1b800b86eaad2f40871c219924ddceb69b9748ae3cf9de59f0edffd7ed7b5e7f35d1239fe0333a78

Download Submit
C:\Program Files\7-Zip\7zG.exe
Filesize
668KB

MD5
5ab26ffd7b3c23a796138640b1737b48

SHA1
6dab8c3822a0cab5b621fd2b7f16aebb159bcb56

SHA256
eb775b0e8cc349032187c2329fefcf64f5feed4d148034c060e227adf6d38500

SHA512
2b40489f46e305f7e3455cac25e375711a6a1733861ee7bf1b800b86eaad2f40871c219924ddceb69b9748ae3cf9de59f0edffd7ed7b5e7f35d1239fe0333a78

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0301667a-99d7-4404-87e4-30938d62e697.tmp
Filesize
6KB

MD5
9183b19e90fea585caf8ddc2a2bb14ad

SHA1
64aeb21b4f655cdc5dc45f4cab594992df224560

SHA256
d70ede2e1c32d765e58c36d334d33f5923031740830cd1f1b39ab271f5721ef3

SHA512
68b2746cf58bd5b262765074dc6df48ec60aed65b58b89b967dc29ab2a5bdad666446277c48c03dd53cfcdca61c1ae9d070b45e80bfa8f562ec9ae33e3fa3fd2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Filesize
48KB

MD5
10b1102baf964d75a0ce7676ee85dbb7

SHA1
b1e6c78b08ae79f5aa021fdecd5ab04fc04c2995

SHA256
a908f0b83b50291bba322fa1d67afa9c1217c0d544d93b29fd6ecd9c394b4f95

SHA512
cfcfd7da69e1648ca1ccc86365a2977bb21ecb9aeb173a3bb95bb39adab64bc88694d2377e9dec76563cc2277ad8292be9d43b706d4dbdc1a2a23f76cfc1fb3f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Filesize
37KB

MD5
47ae9b25af86702d77c7895ac6f6b57c

SHA1
f56f78729b99247a975620a1103cac3ee9f313a5

SHA256
9bde79a1b0866f68d6baa43f920e971b5feb35a8e0af7ffadc114366f8538224

SHA512
72b5296e3dd1c5b4c42d8c3e4a56693819779167b9f02bc2d5f5a626b519a9cf10bee59846d614c929c42094b65d13039f6024f6cb1c023e740969aaefd060c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
Filesize
20KB

MD5
923a543cc619ea568f91b723d9fb1ef0

SHA1
6f4ade25559645c741d7327c6e16521e43d7e1f9

SHA256
bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd

SHA512
a4153751761cd67465374828b0514d7773b8c4ed37779d1ecfd4f19be4faa171585c8ee0b4db59b556399d5d2b9809ba87e04d4715e9d090e1f488d02219d555

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
Filesize
296KB

MD5
b9eb4294e6f51c202d7043f21f9441ec

SHA1
9d16742d252b467cba5f4b249d3551a16d96bdf5

SHA256
6d617384b9225193028a09faf63c76e42ea36dc536cb0aec235c6a6ab73825d1

SHA512
b3c9aff670082a184a44bea6a04ac84b4f484dcc8d0930ebc61fdd430a2d5c2dc06148f72645e9985852083427db6bf0c0936ba49f2d9772e556ea7e5646a279

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b
Filesize
64KB

MD5
c4f7300442a8f13dddf5c9bd09128727

SHA1
d7c8a30cdfe9027cca42c45f44d569627112ae6c

SHA256
5decc8ac1f3d26152842e44d1aa103c913711168c968c936bb782fb3cac10155

SHA512
3b6ebaff36af22dcc9ae7a7593657b56f99afb242ebeed50d26a33e1e6b0ff31c98ef576b96cf98c277cafc1050fee40b5d4c3fcd730595be756089a980030cf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f
Filesize
68KB

MD5
75d646446e92f953c075982d56a16c40

SHA1
f58c07c5a85ab9fc5f3966de5716099e0eca42c3

SHA256
b849818336676895ae90e416108f8e218db4388fc57adfb45f3af58d202d58c6

SHA512
4af2259eae1660d90b3543a6c86fd8bd2dff0b81dadedcaa3d74b7efe2cc2c4f5e7238416d8cb518247cec9cb53537eae169c1c328d1f59193bfa3e41129bb51

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019
Filesize
61KB

MD5
a0efa5ed4d2876e063ebceda6a5ee1a2

SHA1
06c14bce0a9dad23ab9a94cb976c1acaea052743

SHA256
ada73543baaa7b64d16deb817b39b984d7cff5cd624948c5106f9cb1c8af21a7

SHA512
f6898665ac8b7e20b6d613d7409d5e819c5a6af123ac512f9fc72ba135666b4fad18eeb8369c7ea6ab4a7e1a8671c67337c30e90166a2219867a4d6cceb8a9de

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001a
Filesize
50KB

MD5
40333c9d07daab8ba8a53f73ee3f974e

SHA1
36c2b17a7c48fc28036534f445b79fca9658f0a4

SHA256
998313664fbeab2403238a77e6c50a4541d20805b30533f67de1a12c624fee54

SHA512
4a893bf97a02f88a3ea7830b5f72eb56295566a2c6ceafa33fd80f74f81edadbb4172f71c0e12e4a06b1e927f9d7b0cc62c5ba070cd50f3f25c8b670a1270de4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b
Filesize
107KB

MD5
f7d0caf37d196733802d70ffde7306b0

SHA1
29c3b2044acbe4ecd75557563fa647ca5ca953db

SHA256
108dfb988d1c7838a44fafca3abc98945e7fc45a8c471d382b4450093b0d6045

SHA512
84dd29afcf0d540af969de55639b4329f57eac29ce6a541fae5dcc1090f4fc6403e574fc1182dbfc3063c4b6bc3147c26ec623026e56b970d301009fcbc738cc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001c
Filesize
612KB

MD5
a583b39f19252d5e929044138520b689

SHA1
51fc5bbd8694b72756de25fc60f13151d132ef01

SHA256
0123ffed642c61e4754dc6b590a20af667dc7d0b4262335c8b4c46e562ad3823

SHA512
434f70f7361014f9d2f87de0c29a2c2d1cd240333e99a4a61722404534783210575594c4ab996ec60d682157ffd5b2b87278cfdc9a2fbaf08213c42f1f1e1a8b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001d
Filesize
35KB

MD5
fbf149f3cc52c0e994c22360da1fdc3c

SHA1
71c4a5d6a47d01dcb40c659951b5ce38faf1fef0

SHA256
53e46cc83cf44a5dce1b018be9011952eb7714f2949757cfa2e3efde44112dd0

SHA512
9046410e4bc370c68e98c5c00875469bf667cec7bfb14046df5a8547be292153d3621da4f1bc4ed583b044f739a3e56dd9f0fc70bd79196568aca2949501d1e8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\0647dae7850f92b7_0
Filesize
136KB

MD5
bf477f3ee972557a4f08204e1398fa26

SHA1
b1bc3902c188362125ea78f123fb9a6de1483ec9

SHA256
beed468cb6aad9da730f2ac930dac0ec7184da7c6a915f12b4029959814a1b43

SHA512
5ff8110b47bb324d555a9cce9aee7e509024b2cbd5eb10160df2b184b80528145100a840c50a1306095cf4bcf8e449c9756016f9c4eaf4da3bafd00591b50c34

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\bed326134b7faaec_0
Filesize
386B

MD5
a0292dfe3d5ad7c193894487f17ab0e0

SHA1
37cdf359ab035537e46715dc139a6d27d335ae17

SHA256
7539a7449d1efce94bc3dba55131d76619ccddef22de3fb1a248251f8ee5e1ca

SHA512
58bce3285b86fac1979786af928216c4176b441b22a3eede0622afe582b191cd9dfb8082ea63ca873878d3592e77dee4417cb402ff67377f2d4e017097f9d7a9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
216B

MD5
502895d0476c27d7ebadb73a94ef6642

SHA1
0652c305c7138da1fd8a692601b38472edfc07fd

SHA256
25469557ed5ab8d1208923292f461ef9cae85751d261e50ab5df7942f58fcf7c

SHA512
2a74e8953eea890c50e9bfb334287e7f2b09e65de5c4cda12450918c5f809ced4bda8c5143a6f8fd18dce1b9478d072e83fc7d47e2b6f0559b181771481869b5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
d7ecea4969aa273d7541e87760fed13b

SHA1
23fcb645847916665cb1f4188d4c2069b2c0c3d6

SHA256
c305b63cf76f7e984c5ddbf0a796743908957afa0a6067510930207a36fe58f9

SHA512
568a3d0e2a242f438b5dd4ddbd936a72a978cb3ca34bc6a3fcf51906a7225e4eb5b80806309b02733ca29a6cfa8c49d23129f265a4752f7b2a6a0aafe2f35758

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
b43023d56a3b434fc05d614350a6d85e

SHA1
4cd28f8c63542f209dca901019dc5a5fcefdca8d

SHA256
a789763c6ecccb61ea208fb8a2667c037616e0b3823348d6d3cfd6591ba20284

SHA512
5fde485e8134a7edc2451956dfcb541023c628489ac30754500097c5081857aaab31acfc64e7d49faff2f02538be62b509393e384e5558ea2689f4af15109c63

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
632be3ce91be6478bbb73b10bdd5108d

SHA1
a494fb57040257169462766b1aae72d352cd4f41

SHA256
fa7021f398ac84887486fafbf6b89cf85f7d7bb7424aee23bcae83220dca45f2

SHA512
d9ce5eb1afab093df29ff36965397471a61e2f004f9aeab8a5f379dc572455484214565160f0ab653d110a46ee2727f13178dd466f51ad0f2f16bb4fcec9237f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
7527c8ffefa78050c5f8ecf38923eaa3

SHA1
7be9e2d254e70e0dc19ae6924933a8f2b5289b30

SHA256
c58e37259fae9549246ee4a08ec0849db0f1e4ad894a6efef3375b74304c8ba6

SHA512
73b985d526f9a58af809ddfd049185f831478cdf4812beb20d625fbf73a39cad9d5a01eb96a203e6cafd9ff8956262eb0cc9666b80cf8a68b996fe55ee1bb1eb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1
Filesize
264KB

MD5
8c154c58fd6ed7e828b45b5495fc5b8f

SHA1
fad460d65a3730ab33526329c7ed1ad8ca45e128

SHA256
52338d07c53004a4ebeb19ad7fca65206194e6c9794ab040bbf9d5093e9f31df

SHA512
3565a87cafb36b5b876dd0c0fb78ce42d861f55f6b717ea1da17733ecd875a8737f0ce803ec0608a121f13e92fb9c575366245a342d444710ced2ec17b6d9e98

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\71c43560-d0cd-4e14-a5a2-69e21944195d.tmp
Filesize
1KB

MD5
80c4499ae4c6a675e8d7cff7cae8bb8e

SHA1
e78ed1ed43323b1a0d7456e4201771161553bea4

SHA256
5ceb2cb5839a2d1dd68d0f1879a44d9bd12e3942ba21f919178c69b9451928cf

SHA512
87c8ac3ff6bcb3ab00f74c818ae53b5a236f80769563b465f376b285ed2f692351df21d180826d8f0c0f68c5f3150717ef9bc6e7ae4078b4b9f2189a4e688cc4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
4KB

MD5
09160f1713d233383c43070c860b9d84

SHA1
78b7125da723a05d996002963a330a1ee261a490

SHA256
9b7398f631bf5d6b10bdb52053c1862bf58aed6a97e2e71a03cf7a2e91c6ed7d

SHA512
87a68333dca0c1a668a1c3bca200d263368fbf42e7925cc5c849d7595d7dfdb56e02255f3a136f1bfa94baad3570ba752bd259c0c5fd86fd128ee43e500ba8fa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
995c91d146898f9a62b409ba4d5b9e14

SHA1
a19fd1f0bdf7ac7009a3a0ff673ff8fe05bc105a

SHA256
c4c0b5a98b8653ce29d5677edcb5a595adc496470e8a7f4defd7d713750ec691

SHA512
ad5063cc948114c5ff27b5023d3df333f45dd36f3fa66c2709e6082eea6fe36c0e53cbd5829ffbf6342bbe88a61c972d2178c33971a7ec35e036bf79a391d2c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
5KB

MD5
259866e69e6202049e51a55faf24fe22

SHA1
5a154748a456f6322d9595b00debb92296f782ca

SHA256
86dcd721640257f369120b300effc1d3710dc080bfd7a96a2702d9939d65081e

SHA512
51a9d7a58b78c1c67289b28bb7e37391edc689b53112cfc74fc4412d65d6ff450d0eedd53030abcd216e918f5b0d13bcd7ead8246542ec1464622b1f8baa20b0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
6KB

MD5
6321f4156d0c3a2088d26d2be31aac2d

SHA1
768896238df3859cb646a13dc3dd06ab3cfe7075

SHA256
9e65767927a821a6fe9b9942bc9e6fa163d77ad3e545033a78387eb89b548bfd

SHA512
32c2bee5c3b8731fa6808cc09f14916b7d6afa42e5d5125c78afa8278b5b79b419a0018c843951cbd6498c423d566295d554ed93ad2c3f3e768c8afabcaa4fde

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
6KB

MD5
fbb900198ecd1b47325122acb7ee38fd

SHA1
b82331ff3f3720c2a88c722e2d9015a6990cffeb

SHA256
4e4a8d29ab3c1d9f4191017db564751c59a27852fd877568ecf569d0da34d68d

SHA512
1e7cefee95569bb0048658bccff563ffb24e5261cb65095f98de048c329ef290c2fca2c161166fc134bad7181f55e3fb9b8127ef7864f07dbee0c07acc0e7d8b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
541ab1b03cfcb73b4da16d0505173b5b

SHA1
7d66e16e4fc4de5e2e61e54ea57ac5b43b752cb6

SHA256
b39f1841a46a2fd0b5d3900a2c02a0d369d6c9a925cd1c4975819c13afac335e

SHA512
8dcd24e8fe2e6f6039695c5ab2f1972599d8df8c6e8f457c9952d39787fcf09ad01868c9314a592efd14110ac9ed9f2cd565be89b9387bfbbd78454e7191487f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
539B

MD5
9e984553ff1b82381406eb7160637145

SHA1
cc3f093a827956bbf15379451f822ca5a2641c41

SHA256
ba848a2b8933b449f6bd6d4f0232f14dc1f621e071a74337c5551859ab7ac053

SHA512
e88dcf1683650829298dc79f861e84c75742450574e2fabdfdd81dfa8723f020d4ad350b2bc95b0135f6a02e7fc52628efe0953c8a8f03ef1e57625108df5334

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
539B

MD5
bace5edd52bc6c1f18d618134d9c7617

SHA1
2d44f9cb78ab72f147fe7950e04fcb353677123c

SHA256
0624f798a8564e808dc49db15fd26098bea0b9b2910d38cc9cee842a5ad11fcb

SHA512
4674082306e7500785b5e6d07384f7baf2ea92a1cec5eeb89531df1a3995462262e8a2587df1c44ed81401555b5b2bdcf90e8b0ccc7c278c3902fea1bc666bc9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
705b2f16c50c44ad3ef9fa5056352baf

SHA1
2577ec8951fa8eaf9021fb0102b14b3b96e82a66

SHA256
e6666c26e471d7a961ad4d2d7bdaffe276c3d4c67948cbaf2d53901900c418da

SHA512
d1c84a1e51ffc5978fba9e7ed1cd874eb4d315a1b7ca3b2f30bcb490ba1334aba1e0dfa114e0284acb1f3ccb4b585b2dfee4e4dc2458bc245d2ab7f32d93c303

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
2KB

MD5
48dc42c5970128bd90f235b730b450c8

SHA1
f9da3d6cee63de99a414ee6f4045c9706238afaf

SHA256
a254d9356152bf77959caf12f794d5c275d8bea10ddb1f16d254a339af31209a

SHA512
6a2ddc4b9d0f62b43d475cdf140889fd60d7080289fe2cc0a6d3bd22cd16ebaafadcacf0c3a5a71949d2a914fcd89ea4fe5a6bdd776f7c33da26e4177a09e16d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
2KB

MD5
bf17ff7901882fa92dafa5195d6ac376

SHA1
13429c48dbc8458a5d5208e13f718fa9eec3fb1e

SHA256
3e47cd2c6303b05a6066999b52157841a5de7a148ae1fd7de0c6aac674b71c3b

SHA512
df78621121cb8d2e91f5a4abab31531e4053fa6ac61abf1f7065c3e0bb04916d9f2f218ddbb7743a325c8a7f975705bd1528ab0dfc0fe45241030374d3a13924

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
2KB

MD5
53fc90ce2387af8318fd0130cc787abc

SHA1
9573029b527786617b7fc269767d0afa926d9b54

SHA256
386177614defdb361dc397a2cd6b10feb1b29977bd5836e74376ef786349f6a3

SHA512
d9794d239689c8cfe0793e71a439a6704e5fcfb679c46d0ec0021736af7f2ce418a7efbc519143b8218f5b2a034fe330ed5b1f47a65cfb10a97a774acc566650

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
2KB

MD5
8e68e67c8d5c7d226731f023a15ee152

SHA1
b0a6c2bf8a79efbe02c1a1098382e31df53ca8cf

SHA256
400b5e900ec6abc21d6ccca23a01efa2a155fefd6257e5a0a82fbfffcd189f96

SHA512
13ed2118eda5dab65b2ba2105b3c1f9c1fd2fb7b9dc92bb10239fd3bde2cfa71582b2c4843c63475ec79a3f6742fa8d1ee7e69167b2e6ababcfbbb1185162947

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
2KB

MD5
c419cb180bfd22848c3b29a6e7b4d668

SHA1
e35231ba6b66425f1a2570b2ffe8424d1df9bf1d

SHA256
40166e9322dbcd540f13271205bf1792ab17d86f188becf8e331d067f29cde2c

SHA512
e0b1b39317e50ddef3f4497ad48d561ee8929de5ef0196e7b9ed2b8933e1df877adea15a9d22f2d3b876875eb6899866058514ceed2f28d191f60b1e2f521d5d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
24aefa39a695982bea325e6f15e99a1d

SHA1
85a0cabf579cd483605a3081e84596d70d1c907f

SHA256
bb99d1a990b6467727d3f83feed5baeaf9697f431698179ee649091c5e649c87

SHA512
d79478cf39753209585f85a60908fe6ab4dc148346d762605756b743fa280f1bf6ff1ecbfa28e0d1d0f84665fe0ca7049f5c4a0d8896533e61af035df6f22a08

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
5c81bbe0cfc144f389dcfb29667e48d7

SHA1
9823c89fcd9d6cf25e973203fe31544817d1e5be

SHA256
c5e267208a1b39ef25ae62ef64279651e8aaf44b5164868eed4f329019183b40

SHA512
ef0255eef6d7e9283d029b9fb576005d1a520530a3744489f178e04bfd9382ec232d59a88fb7f2da41b9d546b2320a8dbfcd9899405f6a885fa5d55cb13951c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
5c5001bb32e367cd4951bb3478acc831

SHA1
7c37160117c13ce086c6c7edc03ac683ebd61490

SHA256
123759f51cc588a35319add783b5771b77feb85e3515e8440d0f55caa309577f

SHA512
590a39cccf9cb203abe60b819512c0e708110ee85df75ff2f4b26a3176316522cb637200a947784431bca92df42b47cc8dc8c4549b466d6fbc7d0a8b9c909b3b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
7837caad760730f084ffb04b5311983b

SHA1
39652fe794a5376fb2a80003b34fa6666d5f9c76

SHA256
3be5488d78637c913b861375c20e71af863f5cd17fd98ac60fb484ca7b40d1a9

SHA512
8cbe4d86527982a698e97f8c34bf3add07cf60305d57f5029a4d2ebb10a64e1fd36b443849a18ac5c4724548a6cfd58624222ef0a6a27a60794bfaf20f9dfe5b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
8c632d8947f56bebd524adf2ca04f449

SHA1
c0f2e2d99563771c7e59eaf18cdb107054be4bbb

SHA256
e291e3fc405bfaf319b863cd718abd359b91114a647d929cc43b0027054712ee

SHA512
79496812cd08d3a46b8c2c65ee9adb85d43719efeb0a939a68ac0960382b914a101ec85bddbcbef87a42844d182ef1fd9f2522101594261e2508743aee8150b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
cc2b9c8763c3e7b144ee6ca404d0543c

SHA1
419a89e198d4eb5ec857340217fd054070656c8a

SHA256
1c34ca82982ec26e33f3f603a827a71efdb4349037a4411e9ec2428ca1427c7e

SHA512
d1251ec637af4051acbdca849ce15d8296528426a7cdf774b8cf9b3d714665d69cd920a481852225ab29e08b7210d119d031e4aa917043f4782f14f718635103

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
43fc37fb6e97be11aca4ba26727f578a

SHA1
58ce1153842dbff4371ea53fed036201aadf7176

SHA256
d4feb53f6cdb55cb583b3b81f841d1b65642d1dc53ecaf38d57f4d4c13c1855a

SHA512
97a894cf5fa866f4f75e4bb1428e3adeba0c10657dca3f8d2bb6e96f61e1817949a8440a02259706cb16dbe4104221984198165e2eb0821f8616679fb3294fe5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
0e949bcf80362b4e29e7e11f7271277d

SHA1
396e2c205a95994a54051b34ddb66b1c036ef0fa

SHA256
d2c9d73e4cd4c57dff96116a170b79af2f483f6718dd00088aeac204ff582b0b

SHA512
f51609a30ce28ea2b42f87921b9e6780ed70aec2edac5e373f7854fdb266283c4f657cd6931d24f088bfcc70a2d9dface58fd12cc355ceff61dc7c1b39900a7c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
0ef00f5d22fda5ba208cc8362075c300

SHA1
bbf3bc3e8ba2dd1cfc66cdad6c5c6e9f72560c04

SHA256
3acf9569e36052d6de25bb749c95b1785e39c593384e4bbe60a67efdccd7f1d5

SHA512
0385968c1c21c6588f1d99496ef1db30a65e7c2ba378ed1c0f9fa0ca1d3596cb3820074ab2ce3108e64415ecfe70cb2f556870ab9e18ee4e67de440c4a600b96

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
2e3654b6cf70b0608b765a4c4396b724

SHA1
c3270f8d752141b526f4da373475214885e7b285

SHA256
4c27059c1b0ace7692094bc5dbe474940390dd350b6e5d5e6c0fce3413603c2f

SHA512
5232f05ed47cdd55ef00ddd2d83a4cef114cfafc192200ec06e78606bec15d6c7c5ce730b2dff7814329a7a3270bb0784e425d0ccc295295d32cbeaab489502e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
0d348a133a220f01885e50461a413cc1

SHA1
a8b7efe2474771ffd39347cee549d6b588af5af3

SHA256
484bdcb960a57782aeb018c74fbf191f48f9f8187ba401ef6899e4490ca811b5

SHA512
cd6f6e2d154a4b0822ae44bb385f916f04a0a7e91a5e82f56aa11eb835fe0bf0fd37118b6f3d9bf4e6ef19236d3f42b89845291a89a1167f23ec5b0e5432b29b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
167536326f6c0f47c06dd4b41d073d50

SHA1
745d983addf95a6eb7d8e164e8688ef2243bc93a

SHA256
e08eebecfbe9829fc8a04187570430eed2c98380361cbf08ba20be8097352559

SHA512
215d0621340402b0ec5e8757d21f7d4b56913c93cb4f5b08eb23973665dda840cc2375e212efd80b965354361d8a313bca8f60e17592f94d38a5289a06cac4ac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
612421dbac6d58ce062265ce69a07ada

SHA1
1cd65573f0e5cca6661f8aec6b45931633211e17

SHA256
18b41202f46a7c8d203ba20764304afaee4f3d82e28a9a2c97fa624b6c6f8f39

SHA512
33857a6b56f9920d8b6ebf59fe31a328e6f50f164cc24528b8932ffd3656b8131f6fa63b2f2a34c90129a711bd7f0f964ba50aa1ab520d49cdde4d4e1d80e43f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
56B

MD5
ae1bccd6831ebfe5ad03b482ee266e4f

SHA1
01f4179f48f1af383b275d7ee338dd160b6f558a

SHA256
1b11047e738f76c94c9d15ee981ec46b286a54def1a7852ca1ade7f908988649

SHA512
baf7ff6747f30e542c254f46a9678b9dbf42312933962c391b79eca6fcb615e4ba9283c00f554d6021e594f18c087899bc9b5362c41c0d6f862bba7fb9f83038

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
120B

MD5
d97083b2b60d4e52fcea601cc28795b5

SHA1
80801a3b4ad8f461a232a5581b370e398ce885a9

SHA256
ad57369be82bf55e2dab4cb454a0cd7479e4db32e16a1cc7220aae21f743cb41

SHA512
9ac3260260120364c536b00efc45b58b941e291443d5de39d1acf7fcbc6380e16e17246ab72fe73cd441a65d34b7e013ad23e2f840cc18c4aeb9bc6332234515

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
120B

MD5
cc19a5e950fb9361d922a6da906537e3

SHA1
d95bb93c41d8ddd5bbc8044b9ac3e67f89c799f9

SHA256
68d78558a6bb38c75703b05883753ff6ab41b4bb6e8b65ad6b93d1460528cdea

SHA512
6dc46d193b33277b73b5bcd55e6b1117e11bcbb0aefc101183d01f0a0cae0cec41eb6237410f1922d09daccaf4a89a32558ba3877df7f78fc46a3fd1546c6a30

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe57a690.TMP
Filesize
120B

MD5
8540fba27efa9b299c5ce5f884bfe9cb

SHA1
a0eb480fe50e2f7ced4265508c85aaf683e2eea0

SHA256
d7cdbedc42a70bfa03dfec1fcd36c8ae23c5b0ad3bb09ec7f5755f7e73c654a4

SHA512
c0830822339ecf1584ee2aae97cd0c647575b927651256e20d51d709abd68bb66e8b6f73ac8bd5fd723900af0377b3f784a97070f0e583e3c46367b159ea7f67

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fb5a83df-6b98-4c71-8398-ae6a197832a2.tmp
Filesize
7KB

MD5
94823328d01e301b3a9e01047fd559d8

SHA1
93298ebea82e714f3b1af434c534850c086ea6c2

SHA256
78810cfe224e094af87e1332adc7b90ac5c8a5906672159d38683271f2b41e2b

SHA512
bf1fad3aa3e9cdd9f5938469936e15775f96fc2ad23e5247220b5ab8cd27c2546e1c38c5afd22de88922aae1335eb8dead78d6feee0b335e0986d96badc297eb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
175KB

MD5
0c68c29e71baae6c9956fb5bb24c54d8

SHA1
75f6ca73b9da7317f8f9ad36b72f728bf30aed43

SHA256
a32b0b61d88b07874b243c0c2dd6c194eb2994df63afc82adf9446f8abfe0d6f

SHA512
a515e75067cdca7cc7d947465889dac5949b0714fed564e51a9cb0a55068054797c03240bc4196221cd7462578830729ca799a133f4db4ab3b4bf694037a5677

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
175KB

MD5
1f201dc6847d6b1f5b9b2d514c5ed3d7

SHA1
007a5d72fa98ccbfc59ad9859a7f80727f3127ad

SHA256
1baa266797402bfefb19ad0b8524591b7546b68b79dd1d79b85dfc23efe69a2e

SHA512
1eccea9573bf2274dc6d6a2eebd87d4b3a5f9643ee1d7ff58d2446ff98d456230fa97c1ea0bc1f26223c5a7a7e7190383ea2f380ce645f2062b6dce56798073e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
175KB

MD5
633f6fa696b097abe2c5a40f754d376b

SHA1
90c91be296041c515ecdd4560f0b51e1dbfe67ca

SHA256
f94099b1a4852a48172e4256c3501c243987b153cdf98d8ec15f632fdeaa02d0

SHA512
27252e82b1a6376063077a036d52fadeff6ee3e37e55fe71135f3b58a52f3c0f1514a642091e2754845f7c867524ae43770411951644692d75d9c1d6f9dc741e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
175KB

MD5
f9d4802ca82ae7194c0ed9b76e3e2256

SHA1
397020bc983791592f4c7af9e6ee14416b6c6a62

SHA256
c459580c92960ec863dfcf4470a9c3c445879c0bf9cc253f73b2f3af3ebecb38

SHA512
f343ded9c284606e7e768d67da896dd034447131f35d00cfdcce33fe078ec70b70a7781cc9dfae8fc9d93d14e96238f91fd77c358dea44ce929a66012bf08c79

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
216KB

MD5
c889dc7bd0562ef877b577c5acc5aac8

SHA1
ff7e0af105fe6e433282b09ad27ec6c202f88f04

SHA256
d6aa72b14e087b4a17cc208a4a37230feb7544abba1856992a56fc4564644f45

SHA512
ea5faf84bf3eb79ccf255c7a1869b6de4299ce9de3b8f525528c75fe9196689ca9b971f0c160f7da4d396353bd72db8972767dd54d4b41e27c741428000a22ae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
175KB

MD5
5a7f37af44aed1d67d708ad76c2dd2ba

SHA1
a01c972f69ba5026ebf7a77c88dab51b83c17b34

SHA256
67edcd2a77e4f782ab952cb438d186e0741670d2db2252b6f02135ae73d303d2

SHA512
f7e62166e918562c01674ae843483dcf155bdd035e1884d660ff843749e85a12bfbeff7d38986c35393e7690ae471c11ce378b60ea3790d6db82a4b35e3dd810

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
72KB

MD5
2d9f63ffacf2fed0cbd9a6dd4b0855ee

SHA1
54c9e08013d1f3302bfde475633f48c97001fa9a

SHA256
da786b56ee6b0b903de7fde8cf514f22703207b47f7d63051f76f110b8a1a426

SHA512
c19ae0e76a04554e4fd22be220bbd84b2a0b5f7a13c8724dc0d026cca4f451150f68d61ff8a3326f39974ff94e95420828d0890e8f701c08c5b5abe57d073fc4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
175KB

MD5
23d3a8f0034c5f969ae19de405cdb58b

SHA1
533a395c98c8605c7cfb9e4546c0317dbb4cdd0b

SHA256
33b73b6b6a5247c621e09f05f570343c60d27bf783b63c9eb287d38091b8490b

SHA512
9a26869dcbe494aad197fa6452ce9ce8ee60f8a8405c257be19ba694a64724920a2d9ca738aaebc6b5440941493b593e7af92e047399242144493266c868ab77

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\MicrosoftEdge\SharedCacheContainers\MicrosoftEdge_iecompat\IECompatData.xml
Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\4Z5BQR20\favicon[1].ico
Filesize
5KB

MD5
f3418a443e7d841097c714d69ec4bcb8

SHA1
49263695f6b0cdd72f45cf1b775e660fdc36c606

SHA256
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

SHA512
82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

Download Submit
C:\Users\Admin\AppData\Local\Temp\2F20.tmp\2F30.tmp\2F31.vbs
Filesize
352B

MD5
3b8696ecbb737aad2a763c4eaf62c247

SHA1
4a2d7a2d61d3f4c414b4e5d2933cd404b8f126e5

SHA256
ce95f7eea8b303bc23cfd6e41748ad4e7b5e0f0f1d3bdf390eadb1e354915569

SHA512
713d9697b892b9dd892537e8a01eab8d0265ebf64867c8beecf7a744321257c2a5c11d4de18fcb486bb69f199422ce3cab8b6afdbe880481c47b06ba8f335beb

Download Submit
C:\Users\Admin\AppData\Local\Temp\5a530dfd-bc51-4992-a05d-f09d41a331d4\AgileDotNetRT64.dll
Filesize
75KB

MD5
42b2c266e49a3acd346b91e3b0e638c0

SHA1
2bc52134f03fcc51cb4e0f6c7cf70646b4df7dd1

SHA256
adeed015f06efa363d504a18acb671b1db4b20b23664a55c9bc28aef3283ca29

SHA512
770822fd681a1d98afe03f6fbe5f116321b54c8e2989fb07491811fd29fca5b666f1adf4c6900823af1271e342cacc9293e9db307c4eef852d1a253b00347a81

Download Submit
C:\Users\Admin\AppData\Local\Temp\F534.tmp\F535.tmp\F536.vbs
Filesize
352B

MD5
3b8696ecbb737aad2a763c4eaf62c247

SHA1
4a2d7a2d61d3f4c414b4e5d2933cd404b8f126e5

SHA256
ce95f7eea8b303bc23cfd6e41748ad4e7b5e0f0f1d3bdf390eadb1e354915569

SHA512
713d9697b892b9dd892537e8a01eab8d0265ebf64867c8beecf7a744321257c2a5c11d4de18fcb486bb69f199422ce3cab8b6afdbe880481c47b06ba8f335beb

Download Submit
C:\Users\Admin\AppData\Local\Temp\F534.tmp\eulascr.exe
Filesize
143KB

MD5
8b1c352450e480d9320fce5e6f2c8713

SHA1
d6bd88bf33de7c5d4e68b233c37cc1540c97bd3a

SHA256
2c343174231b55e463ca044d19d47bd5842793c15954583eb340bfd95628516e

SHA512
2d8e43b1021da08ed1bf5aff110159e6bc10478102c024371302ccfce595e77fd76794658617b5b52f9a50190db250c1ba486d247d9cd69e4732a768edbb4cbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\F534.tmp\eulascr.exe
Filesize
143KB

MD5
8b1c352450e480d9320fce5e6f2c8713

SHA1
d6bd88bf33de7c5d4e68b233c37cc1540c97bd3a

SHA256
2c343174231b55e463ca044d19d47bd5842793c15954583eb340bfd95628516e

SHA512
2d8e43b1021da08ed1bf5aff110159e6bc10478102c024371302ccfce595e77fd76794658617b5b52f9a50190db250c1ba486d247d9cd69e4732a768edbb4cbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\NRVP986\.hta
Filesize
3KB

MD5
43e1cb7107abfae94fb28b43ed40d589

SHA1
0fc1d8b4d89b0bd9d6f924892f1df63e191d3d74

SHA256
f18a7f7bee15560e5ed5fad44c2304151d30207a2d33206ad3bc2484662cfcf5

SHA512
ed4e3a007b69c0801da5fcf249d786f7d27fcf8958b388a4a775f48d7578b47f78c947092a2df2cd0f9f406e7b7299fbc7867b4cf4d8c9065359319f69721282

Download Submit
C:\Users\Admin\Desktop\MrsMajor 3.0\MrsMajor 3.0.exe
Filesize
381KB

MD5
35a27d088cd5be278629fae37d464182

SHA1
d5a291fadead1f2a0cf35082012fe6f4bf22a3ab

SHA256
4a75f2db1dbd3c1218bb9994b7e1c690c4edd4e0c1a675de8d2a127611173e69

SHA512
eb0be3026321864bd5bcf53b88dc951711d8c0b4bcbd46800b90ca5116a56dba22452530e29f3ccbbcc43d943bdefc8ed8ca2d31ba2e7e5f0e594f74adba4ab5

Download Submit
C:\Users\Admin\Desktop\MrsMajor 3.0\MrsMajor 3.0.exe
Filesize
381KB

MD5
35a27d088cd5be278629fae37d464182

SHA1
d5a291fadead1f2a0cf35082012fe6f4bf22a3ab

SHA256
4a75f2db1dbd3c1218bb9994b7e1c690c4edd4e0c1a675de8d2a127611173e69

SHA512
eb0be3026321864bd5bcf53b88dc951711d8c0b4bcbd46800b90ca5116a56dba22452530e29f3ccbbcc43d943bdefc8ed8ca2d31ba2e7e5f0e594f74adba4ab5

Download Submit
C:\Users\Admin\Desktop\MrsMajor 3.0\MrsMajor 3.0.exe
Filesize
381KB

MD5
35a27d088cd5be278629fae37d464182

SHA1
d5a291fadead1f2a0cf35082012fe6f4bf22a3ab

SHA256
4a75f2db1dbd3c1218bb9994b7e1c690c4edd4e0c1a675de8d2a127611173e69

SHA512
eb0be3026321864bd5bcf53b88dc951711d8c0b4bcbd46800b90ca5116a56dba22452530e29f3ccbbcc43d943bdefc8ed8ca2d31ba2e7e5f0e594f74adba4ab5

Download Submit
C:\Users\Admin\Downloads\7z2201-x64.exe
Filesize
1.5MB

MD5
a6a0f7c173094f8dafef996157751ecf

SHA1
c0dcae7c4c80be25661d22400466b4ea074fc580

SHA256
b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4

SHA512
965d43f06d104bf6707513c459f18aaf8b049f4a043643d720b184ed9f1bb6c929309c51c3991d5aaff7b9d87031a7248ee3274896521abe955d0e49f901ac94

Download Submit
C:\Users\Admin\Downloads\7z2201-x64.exe
Filesize
1.5MB

MD5
a6a0f7c173094f8dafef996157751ecf

SHA1
c0dcae7c4c80be25661d22400466b4ea074fc580

SHA256
b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4

SHA512
965d43f06d104bf6707513c459f18aaf8b049f4a043643d720b184ed9f1bb6c929309c51c3991d5aaff7b9d87031a7248ee3274896521abe955d0e49f901ac94

Download Submit
C:\Users\Admin\Downloads\7z2201-x64.exe
Filesize
1.5MB

MD5
a6a0f7c173094f8dafef996157751ecf

SHA1
c0dcae7c4c80be25661d22400466b4ea074fc580

SHA256
b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4

SHA512
965d43f06d104bf6707513c459f18aaf8b049f4a043643d720b184ed9f1bb6c929309c51c3991d5aaff7b9d87031a7248ee3274896521abe955d0e49f901ac94

Download Submit
C:\Users\Admin\Downloads\MEMZ-master.zip
Filesize
9KB

MD5
cdc16ed0871d6ef790d94eb87221d778

SHA1
7412475b1214809809aaf71a8c7c96fa71620dec

SHA256
e27df818e614ee02d5f78c909a1f0839ec96644c16284c553f22e1e9c2719b4d

SHA512
f9de6ce5c2b6e7504625f6913fd4bd868b6eecfd1006cadeccc82577bd052831cd4104b4473b2b5d4b0f60a21f230ae85b165d71a313915b92636e52c8f9bbae

Download Submit
C:\Users\Admin\Downloads\MrsMajor 3.0.7z
Filesize
234KB

MD5
fedb45ddbd72fc70a81c789763038d81

SHA1
f1ed20c626d0a7ca2808ed768e7d7b319bc4c84a

SHA256
eacd5ed86a8ddd368a1089c7b97b791258e3eeb89c76c6da829b58d469f654b2

SHA512
813c0367f3aeceea9be02ffad4bfa8092ea44b428e68db8f3f33e45e4e5e53599d985fa79a708679b6957cbd04d9b9d67b288137fa71ac5a59e917b8792c8298

Download Submit
C:\Users\Admin\Downloads\MrsMajor 3.0.7z.crdownload
Filesize
234KB

MD5
fedb45ddbd72fc70a81c789763038d81

SHA1
f1ed20c626d0a7ca2808ed768e7d7b319bc4c84a

SHA256
eacd5ed86a8ddd368a1089c7b97b791258e3eeb89c76c6da829b58d469f654b2

SHA512
813c0367f3aeceea9be02ffad4bfa8092ea44b428e68db8f3f33e45e4e5e53599d985fa79a708679b6957cbd04d9b9d67b288137fa71ac5a59e917b8792c8298

Download Submit
C:\Users\Admin\Downloads\NRVP.exe
Filesize
10KB

MD5
707d5ee2926ad6b66269939998b97bdc

SHA1
7d782e13e7c692b35b67e3a2f819ec3fa7e8de5c

SHA256
9f16bde693d793d6285d03f61639d336d1cc24073350f3ba1a3be9e3579f41be

SHA512
84cc41e8e33237d12de0752257bd59ca1209f17d8c0b6a27a0462ecddf26c988f36d741ab4515029d0b3698eedf453c0eea2e85bb1076703f9f579a41b1f82fd

Download Submit
C:\Users\Admin\Downloads\NRVP.exe
Filesize
10KB

MD5
707d5ee2926ad6b66269939998b97bdc

SHA1
7d782e13e7c692b35b67e3a2f819ec3fa7e8de5c

SHA256
9f16bde693d793d6285d03f61639d336d1cc24073350f3ba1a3be9e3579f41be

SHA512
84cc41e8e33237d12de0752257bd59ca1209f17d8c0b6a27a0462ecddf26c988f36d741ab4515029d0b3698eedf453c0eea2e85bb1076703f9f579a41b1f82fd

Download Submit
C:\Users\Admin\Downloads\NRVP.exe
Filesize
10KB

MD5
707d5ee2926ad6b66269939998b97bdc

SHA1
7d782e13e7c692b35b67e3a2f819ec3fa7e8de5c

SHA256
9f16bde693d793d6285d03f61639d336d1cc24073350f3ba1a3be9e3579f41be

SHA512
84cc41e8e33237d12de0752257bd59ca1209f17d8c0b6a27a0462ecddf26c988f36d741ab4515029d0b3698eedf453c0eea2e85bb1076703f9f579a41b1f82fd

Download Submit
C:\Windows\Logs\PBR\DISM\dism.log
Filesize
188KB

MD5
b3fb968547ef386dcfd4eb55609d7a3c

SHA1
84f07204151816a0918fb49add640f166bff5d2d

SHA256
9a02dbe2336124a688c4ce09e56a972e8bc8a61cbf457332a46f86c6690de20d

SHA512
a974c93891271147d296e768bb45dbf408c7386965513b37cd3c96bc7cc13f5ce55fee95920346cb284717cc88dba043b657094b3aa7480b5d13c724ae79e2e3

Download Submit
C:\Windows\Logs\PBR\ResetSession.xml
Filesize
6KB

MD5
e2b013957e358dfecffb2a91e05c7a85

SHA1
f8b6071808823113204eb9ab31da4877a392bef8

SHA256
c48139de8c78caf25f7104d41826c3e67ecdc482eba766289d2c7e5771249397

SHA512
a9d13bc6df8c2cd9bf584577464d8c48fc5233ef5be89ebf45bb8040d79f940ba93041ba3ebbd7d8fd28182c0423cc1471943c6043f7caf4527da6c89f5a9f22

Download Submit
C:\Windows\Logs\PBR\SessionID.xml
Filesize
106B

MD5
a0aec5c85a1d313555f941ce907f0af7

SHA1
a40081a0e7167d670e7281a6b3bf59c391589710

SHA256
d8f218782f2f2f53ec06e5b5c979a67e0ab549aa2bd15d699e833a4f8cafb02e

SHA512
ec86aeae924e72629a60f2a4f904cb667e6f5e1cafb91e6998a787f80cf78934ef98543f7ac8274158aaac572994d5133ed97962c661987b715eaa67c8d713f9

Download Submit
C:\Windows\Logs\PBR\Timestamp.xml
Filesize
42B

MD5
33a8ea1cd8798d53906aa2845a943677

SHA1
270fbc90a8ada3d559df9bbe4c95659c054a0da3

SHA256
c3807a5e492345bad6396b7a48fec61dad88a89ecf1992a9ef74c471b71294d3

SHA512
c74575b5440f161b1a64a7516171b38bf0fee0af99415aa2a325afbf4c8fff8665f72a6f7d4b3c0010e90a724691189f2da274cbf7e91010608c480aefdbf7b6

Download Submit
C:\Windows\Panther\UnattendGC\diagerr.xml
Filesize
10KB

MD5
9a64596eef28ac827a8987ace8b2dcf6

SHA1
5893a536f90d27c9eceda29c873d90aa8910b620

SHA256
b92bca5d2aa7687a89de90df302798405726c8a3d9af4985f7ca6e382bcad30d

SHA512
6f93a4b43472fa4c4ef80b27e88e2773d8932f788ee9a44bdf8104b86a92edc52ce96b49eaffcf4c47614e617b31aaad3590b399e1a1940a3a4053cb58208046

Download Submit
C:\Windows\Panther\UnattendGC\diagwrn.xml
Filesize
14KB

MD5
e1c50ae41450c973c09b37d6fc6db887

SHA1
8ff8b45091be91c620c196ad55f09ec76d8942b3

SHA256
2405fd0e7d2a6b5c6694922ca7bf2b93fadf52a943f51a68991a6535dc3dbf25

SHA512
ca04e12d1e9e3c315e25609f76fcb482b7aa1e4536e0a4f2a3a9f78d6a2ba646ff7ca1a6ec5ed169055ba9cb11e4d70b3fab273ba6b2fedfd7c109b0a560d7cf

Download Submit
C:\Windows\System32\Recovery\ReAgent.xml
Filesize
1KB

MD5
5110eed41c62285cb6b12fcc0ae52f8e

SHA1
9e1c7da0606b86cf441b697660f9e33095a8cadb

SHA256
5980b7fce1db288d81a96833ecfe0b347c0009f802cdb84e11d4ab7007d27f99

SHA512
1f9b252c162a1677dc36a49a2194fc2d726d89d625ddcee54dbe405733300e095fa8cc73dac41c7c5f7956941d6980c0721495d703cded45a737c9c1c6f8b760

Download Submit
\??\pipe\crashpad_4012_OTBXJKDHQYSBFIFP
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Program Files\7-Zip\7-zip.dll
Filesize
92KB

MD5
c3af132ea025d289ab4841fc00bb74af

SHA1
0a9973d5234cc55b8b97bbb82c722b910c71cbaf

SHA256
56b1148a7f96f730d7085f90cadda4980d31cad527d776545c5223466f9ffb52

SHA512
707097953d876fa8f25bfefb19bfb3af402b8a6a5d5c35a2d84282818df4466feba63b6401b9b9f11468a2189dcc7f504c51e4590a5e32e635eb4f5710fd80b2

Download Submit
\Program Files\7-Zip\7-zip.dll
Filesize
92KB

MD5
c3af132ea025d289ab4841fc00bb74af

SHA1
0a9973d5234cc55b8b97bbb82c722b910c71cbaf

SHA256
56b1148a7f96f730d7085f90cadda4980d31cad527d776545c5223466f9ffb52

SHA512
707097953d876fa8f25bfefb19bfb3af402b8a6a5d5c35a2d84282818df4466feba63b6401b9b9f11468a2189dcc7f504c51e4590a5e32e635eb4f5710fd80b2

Download Submit
\Program Files\7-Zip\7z.dll
Filesize
1.7MB

MD5
bbf51226a8670475f283a2d57460d46c

SHA1
6388883ced0ce14ede20c7798338673ff8d6204a

SHA256
73578f14d50f747efa82527a503f1ad542f9db170e2901eddb54d6bce93fc00e

SHA512
f68eb9c4ba0d923082107cff2f0e7f78e80be243b9d92cfab7298f59461fcca2c5c944d4577f161f11a2011c0958a3c32896eba4f0e89cd9f8aed97ab5bc74f9

Download Submit
\Program Files\7-Zip\7z.dll
Filesize
1.7MB

MD5
bbf51226a8670475f283a2d57460d46c

SHA1
6388883ced0ce14ede20c7798338673ff8d6204a

SHA256
73578f14d50f747efa82527a503f1ad542f9db170e2901eddb54d6bce93fc00e

SHA512
f68eb9c4ba0d923082107cff2f0e7f78e80be243b9d92cfab7298f59461fcca2c5c944d4577f161f11a2011c0958a3c32896eba4f0e89cd9f8aed97ab5bc74f9

Download Submit
\Users\Admin\AppData\Local\Temp\5a530dfd-bc51-4992-a05d-f09d41a331d4\AgileDotNetRT64.dll
Filesize
75KB

MD5
42b2c266e49a3acd346b91e3b0e638c0

SHA1
2bc52134f03fcc51cb4e0f6c7cf70646b4df7dd1

SHA256
adeed015f06efa363d504a18acb671b1db4b20b23664a55c9bc28aef3283ca29

SHA512
770822fd681a1d98afe03f6fbe5f116321b54c8e2989fb07491811fd29fca5b666f1adf4c6900823af1271e342cacc9293e9db307c4eef852d1a253b00347a81

Download Submit
memory/796-1048-0x000000001E040000-0x000000001E566000-memory.dmp

Filesize
5.1MB

Download
memory/796-1060-0x00000000028A0000-0x00000000028B0000-memory.dmp

Filesize
64KB

Download
memory/796-1046-0x00000000028A0000-0x00000000028B0000-memory.dmp

Filesize
64KB

Download
memory/796-1045-0x00007FFC8B920000-0x00007FFC8BA4C000-memory.dmp

Filesize
1.2MB

Download
memory/796-1049-0x00000000028A0000-0x00000000028B0000-memory.dmp

Filesize
64KB

Download
memory/796-1059-0x000000001B960000-0x000000001BAF5000-memory.dmp

Filesize
1.6MB

Download
memory/796-1047-0x000000001D940000-0x000000001DB02000-memory.dmp

Filesize
1.8MB

Download
memory/796-1063-0x000000001B960000-0x000000001BAF5000-memory.dmp

Filesize
1.6MB

Download
memory/796-1038-0x0000000000870000-0x000000000089A000-memory.dmp

Filesize
168KB

Download
memory/796-1061-0x00000000028A0000-0x00000000028B0000-memory.dmp

Filesize
64KB

Download
memory/1872-1071-0x00007FFC72840000-0x00007FFC7296C000-memory.dmp

Filesize
1.2MB

Download
memory/1872-1072-0x000000001B180000-0x000000001B190000-memory.dmp

Filesize
64KB

Download
memory/1872-1073-0x000000001B180000-0x000000001B190000-memory.dmp

Filesize
64KB

Download
memory/1872-1074-0x000000001B5E0000-0x000000001B775000-memory.dmp

Filesize
1.6MB

Download
memory/2584-768-0x0000000000380000-0x0000000000388000-memory.dmp

Filesize
32KB

Download
memory/2616-1655-0x000001DBDFC00000-0x000001DBDFC10000-memory.dmp

Filesize
64KB

Download
memory/2616-1637-0x000001DBDF320000-0x000001DBDF330000-memory.dmp

Filesize
64KB

Download
memory/2616-1765-0x000001DBDF460000-0x000001DBDF461000-memory.dmp

Filesize
4KB

Download
memory/2616-1674-0x000001DBDF610000-0x000001DBDF611000-memory.dmp

Filesize
4KB

Download
memory/2616-1676-0x000001DBDF650000-0x000001DBDF652000-memory.dmp

Filesize
8KB

Download
memory/2616-1678-0x000001DBDFAF0000-0x000001DBDFAF2000-memory.dmp

Filesize
8KB

Download
memory/2616-1736-0x000001DBE5900000-0x000001DBE5901000-memory.dmp

Filesize
4KB

Download
memory/2616-1737-0x000001DBE5910000-0x000001DBE5911000-memory.dmp

Filesize
4KB

Download
memory/2616-1679-0x000001DBE3E20000-0x000001DBE3E22000-memory.dmp

Filesize
8KB

Download
memory/2616-1758-0x000001DBDF670000-0x000001DBDF672000-memory.dmp

Filesize
8KB

Download
memory/2616-1761-0x000001DBDF610000-0x000001DBDF611000-memory.dmp

Filesize
4KB

Download
memory/4428-1718-0x00000263CB6F0000-0x00000263CB6F2000-memory.dmp

Filesize
8KB

Download
memory/4428-1701-0x00000263CAED0000-0x00000263CAED2000-memory.dmp

Filesize
8KB

Download
memory/4428-1725-0x00000263CBF20000-0x00000263CBF22000-memory.dmp

Filesize
8KB

Download
memory/4428-1722-0x00000263CBE70000-0x00000263CBE72000-memory.dmp

Filesize
8KB

Download
memory/4428-1720-0x00000263CBE50000-0x00000263CBE52000-memory.dmp

Filesize
8KB

Download
memory/4428-1703-0x00000263CAEF0000-0x00000263CAEF2000-memory.dmp

Filesize
8KB

Download
memory/4428-1716-0x00000263CB690000-0x00000263CB6B0000-memory.dmp

Filesize
128KB

Download
memory/4428-1713-0x00000263CB500000-0x00000263CB502000-memory.dmp

Filesize
8KB

Download
memory/4428-1710-0x00000263CB440000-0x00000263CB442000-memory.dmp

Filesize
8KB

Download
memory/4428-1707-0x00000263CB1F0000-0x00000263CB1F2000-memory.dmp

Filesize
8KB

Download
memory/4428-1705-0x00000263CB1D0000-0x00000263CB1D2000-memory.dmp

Filesize
8KB

Download