quasar | hxxps://anonfiles[.]com/P2d6m03dof/PCPS_exe

Analysis

max time kernel
838s
max time network
1802s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
02-04-2023 18:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://anonfiles.com/P2d6m03dof/PCPS_exe

Score

10^/10

quasar bootkit persistence spyware trojan

Malware Config

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\VIRUS.exe.crdownload	family_quasar
behavioral1/memory/8012-2477-0x00000000008A0000-0x00000000008E8000-memory.dmp	family_quasar

Downloads MZ/PE file
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

MEMZ.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Control Panel\International\Geo\Nation MEMZ.exe
Executes dropped EXE 8 IoCs

Processes:

VIRUS.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exe

pid process

8012 VIRUS.exe
4596 MEMZ.exe
3632 MEMZ.exe
5196 MEMZ.exe
7356 MEMZ.exe
1720 MEMZ.exe
6664 MEMZ.exe
5232 MEMZ.exe
Loads dropped DLL 4 IoCs

Processes:

cscript.exeexplorer.exeexplorer.exe

pid process

3272
6028 cscript.exe
2608 explorer.exe
4652 explorer.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Control Panel\International\Geo\Nation	MEMZ.exe

pid	process
8012	VIRUS.exe
4596	MEMZ.exe
3632	MEMZ.exe
5196	MEMZ.exe
7356	MEMZ.exe
1720	MEMZ.exe
6664	MEMZ.exe
5232	MEMZ.exe

pid	process
3272
6028	cscript.exe
2608	explorer.exe
4652	explorer.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

msiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	msiexec.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

chrome.exechrome.exechrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Windows\CurrentVersion\Run	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Windows\CurrentVersion\Run	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Windows\CurrentVersion\Run	chrome.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

244 whatismyipaddress.com
245 whatismyipaddress.com
246 whatismyipaddress.com
282 whatismyipaddress.com
1056 api.ipify.org
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

MEMZ.exeMEMZ.exe

description ioc process

File opened for modification \??\PhysicalDrive0 MEMZ.exe
File opened for modification \??\PhysicalDrive0 MEMZ.exe

flow	ioc
244	whatismyipaddress.com
245	whatismyipaddress.com
246	whatismyipaddress.com
282	whatismyipaddress.com
1056	api.ipify.org

description	ioc	process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Drops file in System32 directory 5 IoCs

Processes:

cmd.execscript.exe

description	ioc	process
File opened for modification	C:\Windows\System32\x.js	cmd.exe
File created	C:\Windows\System32\z.zip	cscript.exe
File created	C:\Windows\System32\x	cmd.exe
File opened for modification	C:\Windows\System32\x	cmd.exe
File created	C:\Windows\System32\x.js	cmd.exe

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\zh-cn.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	msiexec.exe
File created	C:\Program Files\7-Zip\7zFM.exe	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	msiexec.exe
File created	C:\Program Files\7-Zip\7z.sfx	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\sv.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\en.ttt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	msiexec.exe
File created	C:\Program Files\7-Zip\History.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\tk.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	msiexec.exe
File created	C:\Program Files\7-Zip\7zCon.sfx	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\ko.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\si.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\sl.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	msiexec.exe
File created	C:\Program Files\7-Zip\7z.dll	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	msiexec.exe

Drops file in Windows directory 30 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exemsiexec.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exetaskmgr.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Installer\MSIFC80.tmp	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\Installer\e57f84a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Installer\e57f84a.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{23170F69-40C1-2702-2201-000001000000}	msiexec.exe
File created	C:\Windows\rescache\_merged\4183903823\810424605.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\3877292338.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e57f872.msi	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Mfg	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Mfg	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009	svchost.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exechrome.exechrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exebrowser_broker.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe

Modifies data under HKEY_USERS 9 IoCs

Processes:

msiexec.exechrome.exechrome.exesvchost.exechrome.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133249392937753776"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exemsiexec.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\softonic.com\Total = "679"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 56b5e47a9f65d901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\en.softonic.com	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 9398cf8d9f65d901	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 1b18de569f65d901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\en.softonic.com	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\softonic.com\Total = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 67b6a1659f65d901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "5"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\en.softonic.com\ = "20"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\softonic.com\NumberOfSubdoma = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\RulesFileNextUpdateDate = "386628286"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\NextUpdateDate = "387231336"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 9aef6ed79f65d901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = adca55c89f65d901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe

Runs regedit.exe 6 IoCs

Processes:

regedit.exeregedit.exeregedit.exeregedit.exeregedit.exeregedit.exe

pid process

2928 regedit.exe
5972 regedit.exe
1176 regedit.exe
11556 regedit.exe
15128 regedit.exe
16148 regedit.exe

pid	process
2928	regedit.exe
5972	regedit.exe
1176	regedit.exe
11556	regedit.exe
15128	regedit.exe
16148	regedit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exemsiexec.exechrome.exetaskmgr.exefirefox.exechrome.exechrome.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exe

pid	process
3096	chrome.exe
3096	chrome.exe
4200	msiexec.exe
4200	msiexec.exe
2128	chrome.exe
2128	chrome.exe
7016	taskmgr.exe
7016	taskmgr.exe
7016	taskmgr.exe
7016	taskmgr.exe
7016	taskmgr.exe
7016	taskmgr.exe
7016	taskmgr.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
7016	taskmgr.exe
7016	taskmgr.exe
7016	taskmgr.exe
7016	taskmgr.exe
7016	taskmgr.exe
7016	taskmgr.exe
7016	taskmgr.exe
7016	taskmgr.exe
7016	taskmgr.exe
7016	taskmgr.exe
7016	taskmgr.exe
7016	taskmgr.exe
7016	taskmgr.exe
7016	taskmgr.exe
7016	taskmgr.exe
7016	taskmgr.exe
7016	taskmgr.exe
7016	taskmgr.exe
7016	taskmgr.exe
7016	taskmgr.exe
7016	taskmgr.exe
7016	taskmgr.exe
7016	taskmgr.exe
7016	taskmgr.exe
7016	taskmgr.exe
7016	taskmgr.exe
7016	taskmgr.exe
7016	taskmgr.exe
7548	chrome.exe
7548	chrome.exe
3412	chrome.exe
3412	chrome.exe
5196	MEMZ.exe
5196	MEMZ.exe
7356	MEMZ.exe
7356	MEMZ.exe
3632	MEMZ.exe
3632	MEMZ.exe
1720	MEMZ.exe
1720	MEMZ.exe
6664	MEMZ.exe
6664	MEMZ.exe
5196	MEMZ.exe
5196	MEMZ.exe
7356	MEMZ.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

VIRUS.exeregedit.exe

pid process

8012 VIRUS.exe
5972 regedit.exe

pid	process
8012	VIRUS.exe
5972	regedit.exe

Suspicious behavior: MapViewOfSection 36 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

pid	process
5784	MicrosoftEdgeCP.exe
5784	MicrosoftEdgeCP.exe
5784	MicrosoftEdgeCP.exe
5784	MicrosoftEdgeCP.exe
5784	MicrosoftEdgeCP.exe
5784	MicrosoftEdgeCP.exe
5784	MicrosoftEdgeCP.exe
5784	MicrosoftEdgeCP.exe
5784	MicrosoftEdgeCP.exe
5784	MicrosoftEdgeCP.exe
5784	MicrosoftEdgeCP.exe
5784	MicrosoftEdgeCP.exe
5288	MicrosoftEdgeCP.exe
5288	MicrosoftEdgeCP.exe
5288	MicrosoftEdgeCP.exe
5288	MicrosoftEdgeCP.exe
5288	MicrosoftEdgeCP.exe
5288	MicrosoftEdgeCP.exe
5288	MicrosoftEdgeCP.exe
5288	MicrosoftEdgeCP.exe
5288	MicrosoftEdgeCP.exe
5288	MicrosoftEdgeCP.exe
5288	MicrosoftEdgeCP.exe
5288	MicrosoftEdgeCP.exe
5288	MicrosoftEdgeCP.exe
5288	MicrosoftEdgeCP.exe
5288	MicrosoftEdgeCP.exe
5288	MicrosoftEdgeCP.exe
5288	MicrosoftEdgeCP.exe
5288	MicrosoftEdgeCP.exe
5288	MicrosoftEdgeCP.exe
5288	MicrosoftEdgeCP.exe
5288	MicrosoftEdgeCP.exe
5288	MicrosoftEdgeCP.exe
5288	MicrosoftEdgeCP.exe
5288	MicrosoftEdgeCP.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

Processes:

chrome.exechrome.exe

pid	process
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	3096	chrome.exe
Token: SeCreatePagefilePrivilege	3096	chrome.exe
Token: SeShutdownPrivilege	3096	chrome.exe
Token: SeCreatePagefilePrivilege	3096	chrome.exe
Token: SeShutdownPrivilege	3096	chrome.exe
Token: SeCreatePagefilePrivilege	3096	chrome.exe
Token: SeShutdownPrivilege	3096	chrome.exe
Token: SeCreatePagefilePrivilege	3096	chrome.exe
Token: SeShutdownPrivilege	3096	chrome.exe
Token: SeCreatePagefilePrivilege	3096	chrome.exe
Token: SeShutdownPrivilege	3096	chrome.exe
Token: SeCreatePagefilePrivilege	3096	chrome.exe
Token: SeShutdownPrivilege	3096	chrome.exe
Token: SeCreatePagefilePrivilege	3096	chrome.exe
Token: SeShutdownPrivilege	3096	chrome.exe
Token: SeCreatePagefilePrivilege	3096	chrome.exe
Token: SeShutdownPrivilege	3096	chrome.exe
Token: SeCreatePagefilePrivilege	3096	chrome.exe
Token: SeShutdownPrivilege	3096	chrome.exe
Token: SeCreatePagefilePrivilege	3096	chrome.exe
Token: SeShutdownPrivilege	3096	chrome.exe
Token: SeCreatePagefilePrivilege	3096	chrome.exe
Token: SeShutdownPrivilege	3096	chrome.exe
Token: SeCreatePagefilePrivilege	3096	chrome.exe
Token: SeShutdownPrivilege	3096	chrome.exe
Token: SeCreatePagefilePrivilege	3096	chrome.exe
Token: SeShutdownPrivilege	3096	chrome.exe
Token: SeCreatePagefilePrivilege	3096	chrome.exe
Token: SeShutdownPrivilege	3096	chrome.exe
Token: SeCreatePagefilePrivilege	3096	chrome.exe
Token: SeShutdownPrivilege	3096	chrome.exe
Token: SeCreatePagefilePrivilege	3096	chrome.exe
Token: SeShutdownPrivilege	3096	chrome.exe
Token: SeCreatePagefilePrivilege	3096	chrome.exe
Token: SeShutdownPrivilege	3096	chrome.exe
Token: SeCreatePagefilePrivilege	3096	chrome.exe
Token: SeShutdownPrivilege	3096	chrome.exe
Token: SeCreatePagefilePrivilege	3096	chrome.exe
Token: SeShutdownPrivilege	3096	chrome.exe
Token: SeCreatePagefilePrivilege	3096	chrome.exe
Token: SeShutdownPrivilege	3096	chrome.exe
Token: SeCreatePagefilePrivilege	3096	chrome.exe
Token: SeShutdownPrivilege	3096	chrome.exe
Token: SeCreatePagefilePrivilege	3096	chrome.exe
Token: SeShutdownPrivilege	3096	chrome.exe
Token: SeCreatePagefilePrivilege	3096	chrome.exe
Token: SeShutdownPrivilege	3096	chrome.exe
Token: SeCreatePagefilePrivilege	3096	chrome.exe
Token: SeShutdownPrivilege	3096	chrome.exe
Token: SeCreatePagefilePrivilege	3096	chrome.exe
Token: SeShutdownPrivilege	3096	chrome.exe
Token: SeCreatePagefilePrivilege	3096	chrome.exe
Token: SeShutdownPrivilege	3096	chrome.exe
Token: SeCreatePagefilePrivilege	3096	chrome.exe
Token: SeShutdownPrivilege	3096	chrome.exe
Token: SeCreatePagefilePrivilege	3096	chrome.exe
Token: SeShutdownPrivilege	3096	chrome.exe
Token: SeCreatePagefilePrivilege	3096	chrome.exe
Token: SeShutdownPrivilege	3096	chrome.exe
Token: SeCreatePagefilePrivilege	3096	chrome.exe
Token: SeShutdownPrivilege	3096	chrome.exe
Token: SeCreatePagefilePrivilege	3096	chrome.exe
Token: SeShutdownPrivilege	3096	chrome.exe
Token: SeCreatePagefilePrivilege	3096	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exemsiexec.exefirefox.exechrome.exe

pid	process
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
992	msiexec.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
992	msiexec.exe
2244	firefox.exe
2244	firefox.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

chrome.exefirefox.exechrome.exetaskmgr.exe

pid	process
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
3096	chrome.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2244	firefox.exe
2244	firefox.exe
2128	chrome.exe
2128	chrome.exe
7016	taskmgr.exe
7016	taskmgr.exe
7016	taskmgr.exe
7016	taskmgr.exe
7016	taskmgr.exe
7016	taskmgr.exe
7016	taskmgr.exe

Suspicious use of SetWindowsHookEx 35 IoCs

Processes:

firefox.exeVIRUS.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exewordpad.exe

pid	process
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
8012	VIRUS.exe
5232	MEMZ.exe
3480	MEMZ.exe
7276	MEMZ.exe
4892	MEMZ.exe
660	MEMZ.exe
796	MEMZ.exe
6192	MEMZ.exe
7876	MEMZ.exe
5796	MicrosoftEdge.exe
5784	MicrosoftEdgeCP.exe
5784	MicrosoftEdgeCP.exe
7552	MicrosoftEdge.exe
5288	MicrosoftEdgeCP.exe
5288	MicrosoftEdgeCP.exe
5232	MEMZ.exe
7876	MEMZ.exe
5056	wordpad.exe
5056	wordpad.exe
5056	wordpad.exe
5056	wordpad.exe
5056	wordpad.exe
5056	wordpad.exe
5232	MEMZ.exe
7876	MEMZ.exe
5232	MEMZ.exe
7876	MEMZ.exe
5232	MEMZ.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 3096 wrote to memory of 3676	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 3676	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 432	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 432	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 432	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 432	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 432	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 432	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 432	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 432	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 432	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 432	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 432	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 432	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 432	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 432	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 432	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 432	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 432	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 432	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 432	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 432	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 432	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 432	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 432	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 432	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 432	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 432	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 432	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 432	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 432	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 432	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 432	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 432	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 432	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 432	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 432	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 432	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 432	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 432	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 616	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 616	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 4704	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 4704	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 4704	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 4704	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 4704	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 4704	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 4704	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 4704	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 4704	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 4704	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 4704	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 4704	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 4704	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 4704	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 4704	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 4704	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 4704	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 4704	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 4704	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 4704	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 4704	3096	chrome.exe	chrome.exe
PID 3096 wrote to memory of 4704	3096	chrome.exe	chrome.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://anonfiles.com/P2d6m03dof/PCPS_exe
1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3096

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe8d7e9758,0x7ffe8d7e9768,0x7ffe8d7e9778
2⤵
PID:3676

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1884 --field-trial-handle=1732,i,1874278887001591329,3926146088113750848,131072 /prefetch:8
2⤵
PID:616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1592 --field-trial-handle=1732,i,1874278887001591329,3926146088113750848,131072 /prefetch:2
2⤵
PID:432

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1988 --field-trial-handle=1732,i,1874278887001591329,3926146088113750848,131072 /prefetch:8
2⤵
PID:4704

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2972 --field-trial-handle=1732,i,1874278887001591329,3926146088113750848,131072 /prefetch:1
2⤵
PID:1392

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2992 --field-trial-handle=1732,i,1874278887001591329,3926146088113750848,131072 /prefetch:1
2⤵
PID:1244

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4724 --field-trial-handle=1732,i,1874278887001591329,3926146088113750848,131072 /prefetch:1
2⤵
PID:3820

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4996 --field-trial-handle=1732,i,1874278887001591329,3926146088113750848,131072 /prefetch:8
2⤵
PID:5076

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5212 --field-trial-handle=1732,i,1874278887001591329,3926146088113750848,131072 /prefetch:8
2⤵
PID:5084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 --field-trial-handle=1732,i,1874278887001591329,3926146088113750848,131072 /prefetch:8
2⤵
PID:4060

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3148 --field-trial-handle=1732,i,1874278887001591329,3926146088113750848,131072 /prefetch:1
2⤵
PID:596

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5060 --field-trial-handle=1732,i,1874278887001591329,3926146088113750848,131072 /prefetch:1
2⤵
PID:1524

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5452 --field-trial-handle=1732,i,1874278887001591329,3926146088113750848,131072 /prefetch:8
2⤵
PID:992

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5580 --field-trial-handle=1732,i,1874278887001591329,3926146088113750848,131072 /prefetch:8
2⤵
PID:1536

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5508 --field-trial-handle=1732,i,1874278887001591329,3926146088113750848,131072 /prefetch:1
2⤵
PID:204

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 --field-trial-handle=1732,i,1874278887001591329,3926146088113750848,131072 /prefetch:8
2⤵
PID:1176

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5460 --field-trial-handle=1732,i,1874278887001591329,3926146088113750848,131072 /prefetch:1
2⤵
PID:3964

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5584 --field-trial-handle=1732,i,1874278887001591329,3926146088113750848,131072 /prefetch:1
2⤵
PID:4224

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=2648 --field-trial-handle=1732,i,1874278887001591329,3926146088113750848,131072 /prefetch:1
2⤵
PID:5108

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5420 --field-trial-handle=1732,i,1874278887001591329,3926146088113750848,131072 /prefetch:1
2⤵
PID:4984

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4600 --field-trial-handle=1732,i,1874278887001591329,3926146088113750848,131072 /prefetch:8
2⤵
PID:824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4824 --field-trial-handle=1732,i,1874278887001591329,3926146088113750848,131072 /prefetch:8
2⤵
PID:1200

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=2332 --field-trial-handle=1732,i,1874278887001591329,3926146088113750848,131072 /prefetch:1
2⤵
PID:712

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=5248 --field-trial-handle=1732,i,1874278887001591329,3926146088113750848,131072 /prefetch:1
2⤵
PID:840

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4740 --field-trial-handle=1732,i,1874278887001591329,3926146088113750848,131072 /prefetch:8
2⤵
PID:1972

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5188 --field-trial-handle=1732,i,1874278887001591329,3926146088113750848,131072 /prefetch:8
2⤵
PID:2600

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4592

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5076

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\7z2201-x64.msi"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
PID:992

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4200

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
PID:1748

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:700

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:3024

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2244

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.0.493516212\572090304" -parentBuildID 20221007134813 -prefsHandle 1656 -prefMapHandle 1644 -prefsLen 20810 -prefMapSize 232645 -appDir "C:\Program Files\Mozilla Firefox\browser" - {60936c23-b60b-4b65-9a3d-379588f03014} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 1748 2276e42db58 gpu
3⤵
PID:3576

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.1.1986008243\1157804853" -parentBuildID 20221007134813 -prefsHandle 2080 -prefMapHandle 2076 -prefsLen 20891 -prefMapSize 232645 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {80576feb-ec1e-4ae4-b1ec-71138b2e81f3} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 2104 22761d72b58 socket
3⤵
PID:1760

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.2.144268356\632528875" -childID 1 -isForBrowser -prefsHandle 3012 -prefMapHandle 3008 -prefsLen 20974 -prefMapSize 232645 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f3f616e8-8206-4c06-8d42-50ba258b8d01} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 3024 22771449858 tab
3⤵
PID:4592

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.3.351373740\2139861308" -childID 2 -isForBrowser -prefsHandle 3572 -prefMapHandle 3568 -prefsLen 26484 -prefMapSize 232645 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {60d8a352-07eb-4072-8e7a-ae0b0c6b59b3} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 3580 227719bb058 tab
3⤵
PID:4484

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.4.268542179\834181188" -childID 3 -isForBrowser -prefsHandle 4484 -prefMapHandle 4480 -prefsLen 26543 -prefMapSize 232645 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c8c692d-be47-40cd-b2c3-686eec5d7224} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 4336 22773031a58 tab
3⤵
PID:5056

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.7.1865688352\1482052660" -childID 6 -isForBrowser -prefsHandle 5168 -prefMapHandle 5172 -prefsLen 26622 -prefMapSize 232645 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8eb99963-57af-4a3a-9563-d4b2dd1be2c6} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 5160 227737b7e58 tab
3⤵
PID:1488

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.6.173964395\1415724748" -childID 5 -isForBrowser -prefsHandle 4968 -prefMapHandle 4972 -prefsLen 26622 -prefMapSize 232645 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bb453611-28f3-4509-856d-bf2a6f07c6f5} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 4960 227737b6358 tab
3⤵
PID:5012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.5.1080473229\976465566" -childID 4 -isForBrowser -prefsHandle 3000 -prefMapHandle 4924 -prefsLen 26622 -prefMapSize 232645 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e8ba63f-ff95-4ef3-93f1-cfd089ff2cc4} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 2480 227737b4e58 tab
3⤵
PID:672

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.8.2007721438\881680810" -childID 7 -isForBrowser -prefsHandle 1588 -prefMapHandle 2624 -prefsLen 26622 -prefMapSize 232645 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {62e2330c-0669-4a42-941c-513affdb9f2e} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 2600 227744d0b58 tab
3⤵
PID:3252

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.9.642842597\2082115002" -childID 8 -isForBrowser -prefsHandle 3280 -prefMapHandle 4660 -prefsLen 27079 -prefMapSize 232645 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {838d3bb3-5613-4643-ab63-ad7cb5f1ef6d} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 5728 2277153ea58 tab
3⤵
PID:2132

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.10.1526561428\880389641" -childID 9 -isForBrowser -prefsHandle 4312 -prefMapHandle 4336 -prefsLen 27215 -prefMapSize 232645 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {aae293e2-d61d-4e8b-8c70-f6d95457be87} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 4552 22773778b58 tab
3⤵
PID:2608

C:\Program Files\Mozilla Firefox\crashreporter.exe
"C:\Program Files\Mozilla Firefox\crashreporter.exe" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\minidumps\4d29927e-175c-4542-9483-02e178103e97.dmp"
3⤵
PID:5820

C:\Program Files\Mozilla Firefox\minidump-analyzer.exe
"C:\Program Files\Mozilla Firefox\minidump-analyzer.exe" "--full" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\minidumps\4d29927e-175c-4542-9483-02e178103e97.dmp"
4⤵
PID:6252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2608

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2128

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe8d7e9758,0x7ffe8d7e9768,0x7ffe8d7e9778
2⤵
PID:4584

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1820 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:8
2⤵
PID:3236

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2100 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:8
2⤵
PID:368

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3108 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:5196

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3064 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:5188

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1608 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:2
2⤵
PID:1524

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4364 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:5380

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4556 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:8
2⤵
PID:5464

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4688 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:8
2⤵
PID:5480

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5004 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:6104

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3524 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:5236

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3092 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:8
2⤵
PID:5208

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5288 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:8
2⤵
PID:5700

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:8
2⤵
PID:5788

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5628 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:8
2⤵
PID:5292

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3092 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:8
2⤵
PID:5284

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:8
2⤵
PID:4412

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5388 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:8
2⤵
PID:4268

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4972 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:8
2⤵
PID:2888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=1492 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:5196

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=2504 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:5740

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=3256 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:5864

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=4512 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:5160

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=5892 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:4696

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=5912 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:2144

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5204 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:5328

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=5808 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:5724

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=4716 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:5732

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=3744 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:252

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=6440 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:5392

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=6584 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:5216

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=6840 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:896

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=4720 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:6036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=4300 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:4248

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=7096 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:892

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=36 --mojo-platform-channel-handle=7444 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:1604

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=7612 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:4000

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=7740 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:3632

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7916 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:8
2⤵
PID:5192

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=7928 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:1700

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=43 --mojo-platform-channel-handle=8316 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:4232

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=42 --mojo-platform-channel-handle=8168 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:3532

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=46 --mojo-platform-channel-handle=8656 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:940

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=47 --mojo-platform-channel-handle=8628 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:3836

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=45 --mojo-platform-channel-handle=8472 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:2472

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=48 --mojo-platform-channel-handle=9068 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:6252

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=44 --mojo-platform-channel-handle=8460 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:3520

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=8036 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:4548

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=49 --mojo-platform-channel-handle=9452 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:6824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=50 --mojo-platform-channel-handle=9436 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:6888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=51 --mojo-platform-channel-handle=7832 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:6608

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=52 --mojo-platform-channel-handle=8552 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:6628

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=53 --mojo-platform-channel-handle=8580 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:6716

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=54 --mojo-platform-channel-handle=7644 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:6772

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=55 --mojo-platform-channel-handle=7656 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:7032

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=56 --mojo-platform-channel-handle=6376 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:7012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=57 --mojo-platform-channel-handle=3744 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:1980

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=58 --mojo-platform-channel-handle=8604 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:5020

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=59 --mojo-platform-channel-handle=7244 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:5448

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=60 --mojo-platform-channel-handle=7196 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:4092

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=61 --mojo-platform-channel-handle=10260 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:1936

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=62 --mojo-platform-channel-handle=10440 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:6384

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=63 --mojo-platform-channel-handle=10624 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:6168

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=64 --mojo-platform-channel-handle=10752 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:6404

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=65 --mojo-platform-channel-handle=10980 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:6328

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=66 --mojo-platform-channel-handle=11100 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:6436

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=67 --mojo-platform-channel-handle=7664 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:6768

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=68 --mojo-platform-channel-handle=8576 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:6572

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=69 --mojo-platform-channel-handle=11148 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:5784

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=70 --mojo-platform-channel-handle=6412 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:5436

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=71 --mojo-platform-channel-handle=11380 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:3940

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=72 --mojo-platform-channel-handle=11544 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:7268

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=73 --mojo-platform-channel-handle=11568 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:7320

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=74 --mojo-platform-channel-handle=11824 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:7428

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=75 --mojo-platform-channel-handle=12000 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:7508

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=76 --mojo-platform-channel-handle=11760 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:7572

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=77 --mojo-platform-channel-handle=11572 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:7580

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=78 --mojo-platform-channel-handle=3620 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:7708

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=79 --mojo-platform-channel-handle=7916 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:7720

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=80 --mojo-platform-channel-handle=8592 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:7804

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=81 --mojo-platform-channel-handle=12744 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:7816

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=82 --mojo-platform-channel-handle=6800 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:7892

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=83 --mojo-platform-channel-handle=7940 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:6664

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=84 --mojo-platform-channel-handle=6844 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:1
2⤵
PID:3632

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=816 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:8
2⤵
PID:6704

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6956 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:8
2⤵
PID:6276

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6452 --field-trial-handle=1916,i,17225756565375268366,9842445085121363702,131072 /prefetch:8
2⤵
PID:7364

C:\Users\Admin\Downloads\VIRUS.exe
"C:\Users\Admin\Downloads\VIRUS.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:8012

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:5328

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
PID:7016

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:5420

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:7548

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe8d7e9758,0x7ffe8d7e9768,0x7ffe8d7e9778
2⤵
PID:7556

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1928 --field-trial-handle=1744,i,2850005214497081476,4259119209238290223,131072 /prefetch:8
2⤵
PID:7152

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2044 --field-trial-handle=1744,i,2850005214497081476,4259119209238290223,131072 /prefetch:8
2⤵
PID:5452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3104 --field-trial-handle=1744,i,2850005214497081476,4259119209238290223,131072 /prefetch:1
2⤵
PID:6852

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3092 --field-trial-handle=1744,i,2850005214497081476,4259119209238290223,131072 /prefetch:1
2⤵
PID:7012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1604 --field-trial-handle=1744,i,2850005214497081476,4259119209238290223,131072 /prefetch:2
2⤵
PID:6496

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4380 --field-trial-handle=1744,i,2850005214497081476,4259119209238290223,131072 /prefetch:1
2⤵
PID:6604

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4556 --field-trial-handle=1744,i,2850005214497081476,4259119209238290223,131072 /prefetch:8
2⤵
PID:6412

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4720 --field-trial-handle=1744,i,2850005214497081476,4259119209238290223,131072 /prefetch:8
2⤵
PID:6288

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5012 --field-trial-handle=1744,i,2850005214497081476,4259119209238290223,131072 /prefetch:8
2⤵
PID:5200

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5104 --field-trial-handle=1744,i,2850005214497081476,4259119209238290223,131072 /prefetch:8
2⤵
PID:7172

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5096 --field-trial-handle=1744,i,2850005214497081476,4259119209238290223,131072 /prefetch:1
2⤵
PID:2988

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3328 --field-trial-handle=1744,i,2850005214497081476,4259119209238290223,131072 /prefetch:1
2⤵
PID:2604

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2240 --field-trial-handle=1744,i,2850005214497081476,4259119209238290223,131072 /prefetch:1
2⤵
PID:6964

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4692 --field-trial-handle=1744,i,2850005214497081476,4259119209238290223,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3412

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3108 --field-trial-handle=1744,i,2850005214497081476,4259119209238290223,131072 /prefetch:1
2⤵
PID:5788

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5004 --field-trial-handle=1744,i,2850005214497081476,4259119209238290223,131072 /prefetch:1
2⤵
PID:2596

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3188 --field-trial-handle=1744,i,2850005214497081476,4259119209238290223,131072 /prefetch:1
2⤵
PID:6800

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5504 --field-trial-handle=1744,i,2850005214497081476,4259119209238290223,131072 /prefetch:1
2⤵
PID:5648

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 --field-trial-handle=1744,i,2850005214497081476,4259119209238290223,131072 /prefetch:8
2⤵
PID:6032

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=3904 --field-trial-handle=1744,i,2850005214497081476,4259119209238290223,131072 /prefetch:1
2⤵
PID:3452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=3172 --field-trial-handle=1744,i,2850005214497081476,4259119209238290223,131072 /prefetch:1
2⤵
PID:7864

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5804 --field-trial-handle=1744,i,2850005214497081476,4259119209238290223,131072 /prefetch:8
2⤵
PID:5280

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 --field-trial-handle=1744,i,2850005214497081476,4259119209238290223,131072 /prefetch:8
2⤵
PID:5276

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=5960 --field-trial-handle=1744,i,2850005214497081476,4259119209238290223,131072 /prefetch:1
2⤵
PID:5540

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=6116 --field-trial-handle=1744,i,2850005214497081476,4259119209238290223,131072 /prefetch:1
2⤵
PID:4064

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=5768 --field-trial-handle=1744,i,2850005214497081476,4259119209238290223,131072 /prefetch:1
2⤵
PID:6488

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 --field-trial-handle=1744,i,2850005214497081476,4259119209238290223,131072 /prefetch:8
2⤵
PID:5564

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=4556 --field-trial-handle=1744,i,2850005214497081476,4259119209238290223,131072 /prefetch:1
2⤵
PID:6436

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=5588 --field-trial-handle=1744,i,2850005214497081476,4259119209238290223,131072 /prefetch:1
2⤵
PID:4200

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 --field-trial-handle=1744,i,2850005214497081476,4259119209238290223,131072 /prefetch:8
2⤵
PID:5512

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=5660 --field-trial-handle=1744,i,2850005214497081476,4259119209238290223,131072 /prefetch:1
2⤵
PID:4148

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=3692 --field-trial-handle=1744,i,2850005214497081476,4259119209238290223,131072 /prefetch:1
2⤵
PID:4636

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:6976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.bat" "
1⤵
- Drops file in System32 directory
PID:7512

C:\Windows\system32\cscript.exe
cscript x.js
2⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:6028

C:\Users\Admin\AppData\Roaming\MEMZ.exe
"C:\Users\Admin\AppData\Roaming\MEMZ.exe"
2⤵
- Executes dropped EXE
PID:4596

C:\Users\Admin\AppData\Roaming\MEMZ.exe
"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3632

C:\Users\Admin\AppData\Roaming\MEMZ.exe
"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5196

C:\Users\Admin\AppData\Roaming\MEMZ.exe
"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:7356

C:\Users\Admin\AppData\Roaming\MEMZ.exe
"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1720

C:\Users\Admin\AppData\Roaming\MEMZ.exe
"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:6664

C:\Users\Admin\AppData\Roaming\MEMZ.exe
"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /main
3⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:5232

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\System32\notepad.exe" \note.txt
4⤵
PID:5948

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\System32\notepad.exe"
4⤵
PID:2184

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\System32\notepad.exe"
4⤵
PID:7976

C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
"C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
4⤵
- Suspicious use of SetWindowsHookEx
PID:5056

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
5⤵
PID:4384

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\System32\explorer.exe"
4⤵
- Loads dropped DLL
PID:4652

C:\Windows\SysWOW64\mmc.exe
"C:\Windows\System32\mmc.exe"
4⤵
PID:7632

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe"
5⤵
PID:716

C:\Windows\SysWOW64\control.exe
"C:\Windows\System32\control.exe"
4⤵
PID:308

C:\Windows\SysWOW64\regedit.exe
"C:\Windows\System32\regedit.exe"
4⤵
- Runs regedit.exe
PID:1176

C:\Windows\SysWOW64\mspaint.exe
"C:\Windows\System32\mspaint.exe"
4⤵
PID:6808

C:\Windows\SysWOW64\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
4⤵
PID:5436

C:\Windows\system32\mmc.exe
"C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
5⤵
PID:6112

C:\Windows\SysWOW64\mspaint.exe
"C:\Windows\System32\mspaint.exe"
4⤵
PID:8004

C:\Windows\SysWOW64\Taskmgr.exe
"C:\Windows\System32\Taskmgr.exe"
4⤵
PID:432

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\System32\notepad.exe"
4⤵
PID:5148

C:\Windows\SysWOW64\control.exe
"C:\Windows\System32\control.exe"
4⤵
PID:8648

C:\Windows\SysWOW64\Taskmgr.exe
"C:\Windows\System32\Taskmgr.exe"
4⤵
PID:8668

C:\Windows\SysWOW64\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
4⤵
PID:9628

C:\Windows\system32\mmc.exe
"C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
5⤵
PID:9648

C:\Windows\SysWOW64\mmc.exe
"C:\Windows\System32\mmc.exe"
4⤵
PID:7672

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe"
5⤵
PID:9908

C:\Windows\SysWOW64\Taskmgr.exe
"C:\Windows\System32\Taskmgr.exe"
4⤵
PID:5788

C:\Windows\SysWOW64\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
4⤵
PID:11616

C:\Windows\system32\mmc.exe
"C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
5⤵
PID:11820

C:\Windows\SysWOW64\control.exe
"C:\Windows\System32\control.exe"
4⤵
PID:7756

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
4⤵
PID:12412

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\System32\explorer.exe"
4⤵
PID:12392

C:\Windows\SysWOW64\regedit.exe
"C:\Windows\System32\regedit.exe"
4⤵
- Runs regedit.exe
PID:15128

C:\Windows\SysWOW64\control.exe
"C:\Windows\System32\control.exe"
4⤵
PID:16372

C:\Windows\SysWOW64\mmc.exe
"C:\Windows\System32\mmc.exe"
4⤵
PID:16004

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe"
5⤵
PID:16044

C:\Windows\SysWOW64\calc.exe
"C:\Windows\System32\calc.exe"
4⤵
PID:15892

C:\Windows\SysWOW64\regedit.exe
"C:\Windows\System32\regedit.exe"
4⤵
- Runs regedit.exe
PID:16148

C:\Windows\SysWOW64\Taskmgr.exe
"C:\Windows\System32\Taskmgr.exe"
4⤵
PID:6328

C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3480

C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe" /watchdog
2⤵
- Suspicious use of SetWindowsHookEx
PID:7276

C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe" /watchdog
2⤵
- Suspicious use of SetWindowsHookEx
PID:660

C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe" /watchdog
2⤵
- Suspicious use of SetWindowsHookEx
PID:4892

C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe" /watchdog
2⤵
- Suspicious use of SetWindowsHookEx
PID:796

C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe" /watchdog
2⤵
- Suspicious use of SetWindowsHookEx
PID:6192

C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe" /main
2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:7876

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\System32\notepad.exe" \note.txt
3⤵
PID:2888

C:\Windows\SysWOW64\regedit.exe
"C:\Windows\System32\regedit.exe"
3⤵
- Runs regedit.exe
- Suspicious behavior: GetForegroundWindowSpam
PID:5972

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\System32\explorer.exe"
3⤵
- Loads dropped DLL
PID:2608

C:\Windows\SysWOW64\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
3⤵
PID:6600

C:\Windows\system32\mmc.exe
"C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
4⤵
PID:5472

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\System32\notepad.exe"
3⤵
PID:5976

C:\Windows\SysWOW64\control.exe
"C:\Windows\System32\control.exe"
3⤵
PID:9660

C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
"C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
3⤵
PID:8732

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
4⤵
PID:5820

C:\Windows\SysWOW64\Taskmgr.exe
"C:\Windows\System32\Taskmgr.exe"
3⤵
PID:9956

C:\Windows\SysWOW64\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
3⤵
PID:11432

C:\Windows\system32\mmc.exe
"C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
4⤵
PID:11544

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\System32\explorer.exe"
3⤵
PID:10568

C:\Windows\SysWOW64\regedit.exe
"C:\Windows\System32\regedit.exe"
3⤵
- Runs regedit.exe
PID:11556

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\System32\notepad.exe"
3⤵
PID:15540

C:\Windows\SysWOW64\calc.exe
"C:\Windows\System32\calc.exe"
3⤵
PID:16224

C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
"C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
3⤵
PID:7620

C:\Windows\SysWOW64\mmc.exe
"C:\Windows\System32\mmc.exe"
3⤵
PID:15692

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe"
4⤵
PID:15552

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\System32\notepad.exe"
3⤵
PID:12732

C:\Windows\SysWOW64\regedit.exe
"C:\Windows\System32\regedit.exe"
3⤵
- Runs regedit.exe
PID:2928

C:\Windows\SysWOW64\calc.exe
"C:\Windows\System32\calc.exe"
3⤵
PID:1256

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5796

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:1052

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5784

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5080

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
PID:6808

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7380

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:8160

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:6956

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5900

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4576

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:6636

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:7552

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:940

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5288

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4792

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:6224

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3fc
1⤵
PID:1632

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:1052

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:7160

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:6936

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:6128

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:7608

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:388

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:7236

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:7272

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3956

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:5804

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:628

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:3564

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7892

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:3964

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:3016

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5892

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7792

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:2692

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:7008

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7360

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5320

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:2468

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:308

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4152

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5636

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:8076

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:1496

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4364

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
1⤵
PID:1048

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:2092

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5420

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6964

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5416

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7692

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5900

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5172

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5612

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6560

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4792

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:8956

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:8444

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:9204

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:8428

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4932

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:8848

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:9200

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:10080

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:9460

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:9272

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:9444

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:9268

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:9684

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:324

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:10632

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:11148

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:11144

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:10952

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4572

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:10940

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:10792

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:11404

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:12148

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:12072

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:11896

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:12048

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:11092

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:11720

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:12584

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:13056

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:13180

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:13020

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:12480

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:12464

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:13008

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:13016

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:13436

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:14332

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:13556

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:13148

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:13948

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:14088

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:14636

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:14776

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:13444

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:14620

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:14428

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:15320

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:13752

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:15372

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:16272

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:15452

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:15700

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:15960

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:15660

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:16248

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:16488

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\b9399f3b33494458a696d2e5a45e4e0e /t 16572 /p 16488
1⤵
PID:17260

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:15400

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:11056

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\5c956529ecea430eae27c41db1142c83 /t 10628 /p 11056
1⤵
PID:12872

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:11432

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5748

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:388

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5580

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\fabe2e6c294d47c9a90540de8e9b7e4a /t 14368 /p 5580
1⤵
PID:14956

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:16092

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\62ddd864cad041ddbdcb8609b009e400 /t 14208 /p 16092
1⤵
PID:10332

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:10948

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5980

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\7e724d6c16044002bad880bbf1ba4820 /t 4996 /p 10948
1⤵
PID:8524

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Bootkit

T1067

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57f84b.rbs
Filesize
20KB

MD5
6e9f350abd4f8cc0e14915b638e69dcc

SHA1
6c77e790614d8e8a678f01be07448d7281eafe91

SHA256
ec90e8d8a6f23687fac0a9cea7c42f7b4c37a40b1d19387d436c3f862ff79906

SHA512
9c9e83c51c273bec1b9d5c280282913d2bac7d140bccbaa85190607cd6da9b105b5ecc8f2fd64dfb93e3979eddbfcbe2b0553fc0e4eb0e6ad2e199f799eced66

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5658c12f-f1c1-449b-8645-dd95d13a9526.tmp
Filesize
105KB

MD5
308405b0e04b343be9b98c2f9c82d965

SHA1
c755a3454765d9e732e92560a6c9b8180b860faa

SHA256
0d6db7c7f8449435950ad6cd95e99249fff1cb2123387a0c50c0c56480ee2efa

SHA512
214b06febf71f96858ac1a00f92afec3f973bfc08854ca1a33fedac3a2cb61beae067e0bc4935f48edcb5ac0fce8d590f79cbf47c967a4a471f32c8a5a5391fc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Filesize
40B

MD5
7c48dd2f4e33b67ffa3236b9ea4aaff2

SHA1
f66927a44e7de0c0038ce744d1d1d7251742702a

SHA256
b496c6028f1d5fe18f50705c8108ae84820748a3a2286cc9b56d2bb5a38aab02

SHA512
6ccba975ea123b1f59ddda5ec486be685df0ca1def0d34ccd160047a3fc9b126ec58092ed3f98b0cd6cf9df53a95083ddd979ed311d06fcc70eda216501dfa50

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Filesize
40B

MD5
7c48dd2f4e33b67ffa3236b9ea4aaff2

SHA1
f66927a44e7de0c0038ce744d1d1d7251742702a

SHA256
b496c6028f1d5fe18f50705c8108ae84820748a3a2286cc9b56d2bb5a38aab02

SHA512
6ccba975ea123b1f59ddda5ec486be685df0ca1def0d34ccd160047a3fc9b126ec58092ed3f98b0cd6cf9df53a95083ddd979ed311d06fcc70eda216501dfa50

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8b97d1a2-9785-4ca8-b953-16bce60dd23c.tmp
Filesize
7KB

MD5
849340bd30f280a5f4ee3caa312baa8c

SHA1
5b471b997f7ee02eb2cd60719a8c0f35209b4c68

SHA256
7dbb516e686bf0e42b2f74f68fceb1a778bcc1adcf034335669e09ddf4f11dce

SHA512
c235a74123a9f07daff4ca6fed8de27ea064399781504d85537fe412a159a625ae8d755245c48792b11d1d9c104ea1094340b0e2a26e2bc933ca3970bc655e21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000021
Filesize
37KB

MD5
8986f8f0f61ae78fb334ff37b7f52764

SHA1
4cf391933abeab305506a2ed13fb7a2dd862562b

SHA256
ca79aeec5f367d1868968893c2b44805938ead12ccea674335f6a5b86c1ae3ec

SHA512
73cf5d2401ab8da231dfcc02f0242b048f39d919e35c852ef069e3878ed70bd98a73ca1c0fe41b225a0b0ad7f379f2b1d350b431cb85e92cf4ce2a61d3a1d680

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000022
Filesize
37KB

MD5
47ae9b25af86702d77c7895ac6f6b57c

SHA1
f56f78729b99247a975620a1103cac3ee9f313a5

SHA256
9bde79a1b0866f68d6baa43f920e971b5feb35a8e0af7ffadc114366f8538224

SHA512
72b5296e3dd1c5b4c42d8c3e4a56693819779167b9f02bc2d5f5a626b519a9cf10bee59846d614c929c42094b65d13039f6024f6cb1c023e740969aaefd060c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004e
Filesize
48KB

MD5
1e7768364a8db1e88535d1ca1ee9cd6b

SHA1
90d26fec8305c95cc5f6fa4b2398456d88627570

SHA256
eb24872de47889683879df871844b6468d59bb8126f106189b44bbe305853a0a

SHA512
a47fa27c6b7fe18bb7e82ce09f30d3cebc32a8cd63da4ca822ceeb1ac90569bf64e66632367673c1da9e3983c330f26a6edd7696e5e6e1814cfedef017d0fa19

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000067
Filesize
162KB

MD5
b81d6636c3ad72c63e532e5180eaf7f9

SHA1
ddcd059999fff6218e98af62dbe3fa9c885a0de8

SHA256
2fb4351c49b47b7cdaa9516237a8b1e690e4448339d09d70a84c658729e461ef

SHA512
4f0b87bbf60061a8efca4906554f958b7c28cf582452e01a8316d8c5ea8c98beda6c3230afff207f0b92d316c4c2e0ca1b4631e7d7364344b4a76394115af06b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000084
Filesize
31KB

MD5
a0c7fdef71282671fd5d7720cf3ba971

SHA1
107ad0c5d495278f21cdc2ca16f1c00b88b9779b

SHA256
de1f5c89b956957828bd9a11c028be545b34330e82469edde7e200c29df10cf1

SHA512
2b1dafb47b47519a9ac91fa34ac799330bbb589587450b5eb61af57e6512d3c50d27a526735c08b9959f3a6e8fa4eaf0c1b978c6b0b0ee3cabafdad19812e229

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000085
Filesize
36KB

MD5
4f584941643227707fda008dec37c6c1

SHA1
10cf8b1d3f7ba0483f80a8acc0d0dcef93123fa2

SHA256
4b799fd2818bf5342bfe0866f444973ecfbb9e3fef5c74bb5100d5d05610d0a6

SHA512
c8bdddad550f86444e676aeb50b0db80872a0cb36631b90ddb771258b15ac9b4aea0c42026d5d3c90d4394f8c088c9c086b40be80b49ff2228c576ef7bbeda57

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000086
Filesize
44KB

MD5
4fbbf22f7c282962ddf375053c5cc23e

SHA1
940ff57a8da4b32e8383236dd49b0298a3226b37

SHA256
f8e68bb37b25f8e41bfa51d72050ae6f4a9ebb9664da7f150fa1ba81c94d8c4b

SHA512
f6603de2b7796268ae334d47fcad63cbb10e9528c4e41d9522a8a9129ec72838f58efe21808aa09dead2a949d34edd98423dc86b6e975f1b8d4a59277ac7b7f4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000087
Filesize
16KB

MD5
23607149ede688319bed9d4b4a519ec2

SHA1
d5760abf4b46395b9aabef6b316467770169ef69

SHA256
359bc28f70f359efd5f3358800d379ad74ca8d59a334a11fb35408178544d356

SHA512
52d096e2e75256de6335e18b448cca7f4dcedb568daea70dec57df9c7ebe7049578c3dde5553265d9f962bd5a79cbb8ba55631f9f8367381bc92aa3af9ae7f7e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000088
Filesize
19KB

MD5
39b3153aec1389748d7aea7b1ecbffd4

SHA1
f9840264c67a5d7db64b4beb7f3adab18bf4171f

SHA256
dcfe833b312be0b1af66e043b3e165f399a70c435200d0bca4f7cd95d7999531

SHA512
72aa2325b03f7f0ceab345cb300b672382cfeb6b10d1cacaf98d8c9704ce4993d14538fef5d0691e10e95562246d6de6d82c73781a120f7d19e9a1ff201c867e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000089
Filesize
62KB

MD5
6ca9f3cf76c7d15e0007f5f088b2a7cc

SHA1
6c0992d34b8ce73d482ac0965b8799b6751700dc

SHA256
b5d5b5cb7439bde407fc03db845275e118f54494c56874a92e58e1d821a0c8e9

SHA512
9d48abba080744c63e604a72629f1daa399fb90f5216ba708ca992c705e607bbdbd510a698bd7b8982718e40d17f3fd49b1c26570506022b9120fb8c269520c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00008c
Filesize
17KB

MD5
ea7400c1a953a4f5fc7b56ea1121bc8d

SHA1
75ec8f4bfcedbf27b87eb468181ac784cd4b7973

SHA256
6d3163967a8d73de7a090695fa96dc5854098982b0a9499c5132b0dc0f25d65b

SHA512
9813ec1eba0634316d1d47392ae60dbd2575952ed9879631045417dd96f38e52a9f63a2ee4d3753938cfa5287c8c95f75432e2ed8f074cb1c49b57017106614b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00008f
Filesize
94KB

MD5
2b7c9e7b5ad99ead28120b1c06989e79

SHA1
1a9835ac9fe3a6f99ee9216da1f89cdc001ef618

SHA256
7aea6eea456190a95348ff0423a5d6ec744a9da5b507d1be06201c1daff38ee0

SHA512
7d455ab8d2d3411817ed3789b0e4ae143698c97bff9f0c59cfcbd891643d0dac090a7693db7e8e83602b0c3e7ca47c0a42be3fa7566cfb01f326ab1961b5b80b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000090
Filesize
61KB

MD5
374476f0bdde69f76e1cc469ac711785

SHA1
50bec0d3dabb382ddac5907adb1f6b2f31ec2286

SHA256
19c25fb4a54eb635da279302b8edd702880e4a52ee826742f067ac006637c56c

SHA512
8cda848498385664cfe05b1e7c4d377e9b7f3c9aaa8f8e2d0d3618916e3ba18726e1cd87fe73948548323fca8de7d04b63e122f9cd3b291b516b1711191d598a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000093
Filesize
151KB

MD5
07179cf76599145c9b04d3186e15deab

SHA1
0e70fcc67f49fd74000c456a8cb0c9d3ae3b1abb

SHA256
4074c0cf35f9455c16465e32a1687ff3495cbfec5f005eb73450ea26cb349f99

SHA512
a3be0bd7325418f905358531f1ddfc1b6e917d64e5a1f7ccebd7a61440e8bcfaa1521833ee680b0e6dac72a26cdbf2e540e3417b9e471abda198ebac7d98d9ce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000094
Filesize
199KB

MD5
7a6054fedeb5933ae2087a8044d6ce95

SHA1
57d45e0e0f326836ace87b608d741db1666ae0c1

SHA256
c54ebcaeb275e9e467d3afd93ba4868663074f4dd0e1a7b456895d84bd920dc0

SHA512
e74808b15b8ced54309da5680ae955852503598364e73b65e14800ea08ae36bf5b25e3161ff9d90023b466ef9b38f1b0257baa8e3b5bd6afb15e64dcba17d05f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000095
Filesize
24KB

MD5
023f8251466922dd04a9001286956dd3

SHA1
49e30879d1d4e5d49e283c287b1ef2c8d22d49e2

SHA256
02ed197b56be9ce4e6c856e4cdbc0d3c25e6ed292e35293cae28ad208c5f262a

SHA512
6f4a9993bc75c60c95be47b679c0c156fc5f867947dc79851282cee7feada16f84384b4952f91e16a6e9d1103613d964f498a6c37e907279802d05957ec36528

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000097
Filesize
61KB

MD5
a0efa5ed4d2876e063ebceda6a5ee1a2

SHA1
06c14bce0a9dad23ab9a94cb976c1acaea052743

SHA256
ada73543baaa7b64d16deb817b39b984d7cff5cd624948c5106f9cb1c8af21a7

SHA512
f6898665ac8b7e20b6d613d7409d5e819c5a6af123ac512f9fc72ba135666b4fad18eeb8369c7ea6ab4a7e1a8671c67337c30e90166a2219867a4d6cceb8a9de

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000098
Filesize
50KB

MD5
40333c9d07daab8ba8a53f73ee3f974e

SHA1
36c2b17a7c48fc28036534f445b79fca9658f0a4

SHA256
998313664fbeab2403238a77e6c50a4541d20805b30533f67de1a12c624fee54

SHA512
4a893bf97a02f88a3ea7830b5f72eb56295566a2c6ceafa33fd80f74f81edadbb4172f71c0e12e4a06b1e927f9d7b0cc62c5ba070cd50f3f25c8b670a1270de4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000099
Filesize
107KB

MD5
f7d0caf37d196733802d70ffde7306b0

SHA1
29c3b2044acbe4ecd75557563fa647ca5ca953db

SHA256
108dfb988d1c7838a44fafca3abc98945e7fc45a8c471d382b4450093b0d6045

SHA512
84dd29afcf0d540af969de55639b4329f57eac29ce6a541fae5dcc1090f4fc6403e574fc1182dbfc3063c4b6bc3147c26ec623026e56b970d301009fcbc738cc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00009a
Filesize
612KB

MD5
a583b39f19252d5e929044138520b689

SHA1
51fc5bbd8694b72756de25fc60f13151d132ef01

SHA256
0123ffed642c61e4754dc6b590a20af667dc7d0b4262335c8b4c46e562ad3823

SHA512
434f70f7361014f9d2f87de0c29a2c2d1cd240333e99a4a61722404534783210575594c4ab996ec60d682157ffd5b2b87278cfdc9a2fbaf08213c42f1f1e1a8b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00009b
Filesize
35KB

MD5
fbf149f3cc52c0e994c22360da1fdc3c

SHA1
71c4a5d6a47d01dcb40c659951b5ce38faf1fef0

SHA256
53e46cc83cf44a5dce1b018be9011952eb7714f2949757cfa2e3efde44112dd0

SHA512
9046410e4bc370c68e98c5c00875469bf667cec7bfb14046df5a8547be292153d3621da4f1bc4ed583b044f739a3e56dd9f0fc70bd79196568aca2949501d1e8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00009c
Filesize
19KB

MD5
ca7fbbfd120e3e329633044190bbf134

SHA1
d17f81e03dd827554ddd207ea081fb46b3415445

SHA256
847004cefb32f85a9cc16b0b1eb77529ff5753680c145bfcb23f651d214737db

SHA512
ab85f774403008f9f493e5988a66c4f325cbcfcb9205cc3ca23b87d8a99c0e68b9aaa1bf7625b4f191dd557b78ef26bb51fe1c75e95debf236f39d9ed1b4a59f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000a0
Filesize
47KB

MD5
c31e52bf196d6936910fa3dff6b6031e

SHA1
405a89972d416d292b247fd70bbc080c3003b5e6

SHA256
8b47e773a782361209f8adacc8d6aeefb595e1c13ae6813df7de01c20a15c91e

SHA512
a5335c7d3beafdefa6cb1a459736615ca0151fa2e64dafb78de65aa4b924068ad0dc55c70a5317be19edeb899f94ea02e2e54279933b87828ebe86ef95f13291

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000a3
Filesize
16KB

MD5
103fbf0c1c832fb7893471f0fb8afe26

SHA1
cfdc1a5ce3864e0049ca8b1cbe14f221aee5f9b4

SHA256
7a80a9cbb48c81b3bcf3a4482acb3af6f5cd2318bfbaddf9d9581d55b0540bf2

SHA512
48316225933b9fc92eee25013da06d4ddda454a0ec00e2d1dfc0af3fd31df26e6bebe49119b040449c970862794ebb9b4df460343b863a986858c957d97dd771

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
240B

MD5
fcd07ba8949476a209b780bd14d0c776

SHA1
582e24b6e4c54e2448c0fd6d07077de0f4ac8435

SHA256
430fdbb63fc7115536fc9c1dc181d4fc3be1d547df18b92d862edb21f5a2d3c7

SHA512
1dd337215245ba19224f6d7ac4c150b50182011ff69b80b08dd3e580caa34b8d7ec9a4a75ccc1ed7c3a3f6d5d138599504a9ad558630d323a840cfcacba73ff0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
240B

MD5
fcd07ba8949476a209b780bd14d0c776

SHA1
582e24b6e4c54e2448c0fd6d07077de0f4ac8435

SHA256
430fdbb63fc7115536fc9c1dc181d4fc3be1d547df18b92d862edb21f5a2d3c7

SHA512
1dd337215245ba19224f6d7ac4c150b50182011ff69b80b08dd3e580caa34b8d7ec9a4a75ccc1ed7c3a3f6d5d138599504a9ad558630d323a840cfcacba73ff0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
216B

MD5
f2b66d14cb7363693255a9b96e18906b

SHA1
a91779606a3ea34a9d1905527aea849b620610b0

SHA256
40a88e3b6ebe7b6bcd445df2a87e457923307392712f3260b31bfdd39c96dceb

SHA512
273bd93cc0304b366b120ae7e33011ba6ff32812410ae7a5b2b023c4c6c7a8b64f59cc7afc6e2efab33d3aeab0d92f42342590bb00dcb795f647c2464f767217

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
3KB

MD5
5caa4f7a0b9699cc384a25427f178fa5

SHA1
9913a07c416cd8d1a3a846180fd902f976ea472e

SHA256
4db38c051ff489c2a49141a2e22e0b7f3b5dbcc1bad42cc2b9293cfa4ad6caf5

SHA512
bf7ee16083a0f1992eeeaec6646cd0970d808e3922635c5e2ba7934fc9d56b77396ee0344b4c0ec2319de40c0864c443ff4409e665525c362b3ffadb38706cf5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
6KB

MD5
7641e16273564d517b1b6b711f0a63da

SHA1
1a7550632474e544b7a8e176ced850237b5e6025

SHA256
ceff1ef74b24e79fcd5a7c0e5af09143a84c3049890e3e020ee1979de35fa4e9

SHA512
93cb69e21c77625de3f033d58c9a50738e5bde465d08f86559a05c0341d42def6c47e2329c1a9b02640de90eb07b53b04ddd17d74687b207ce8a0577367fbf07

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
7KB

MD5
25a0871cc099f331c81ed5db86619c9d

SHA1
fe2b34e8cd66c75d61a89c504b32c773b5d1e919

SHA256
3f66cbb4c81663b77e7338ca1c01d4a039d175b47c99efe1044601f5a6dc2bba

SHA512
a8c5a9992e8da6d9438ffbb47e90208a0cf69db4468b07d24647791ce01360311ec75f9421e6fb4d4fb94ab08bee01ade886be13d8cfd05d5251c19f8d20f741

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
3KB

MD5
ce0afb10d387843979ac556d835b164b

SHA1
536e9f207bd071c84d218754dff111df5979e0a5

SHA256
cc3edc2eed897951b31aa563b08709ab930b71f15550e31c879755bdee2aaa2c

SHA512
3e2f93f1577712e5352882c5326ced094608958508be4dc450099626bee97bb939945421047959bdf8b7f8856b587e9a90bf2ece762f815771159c3b9f6e30ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
3KB

MD5
dff70f62b6584634e635e32b6c320ef7

SHA1
f6dc8b856a2fb3a679e4f9b216077d1a9889f3ce

SHA256
3d84955b780fa869954b396c401bc040fd9fc96205ca45a0f3a273c7326a08c7

SHA512
cd71b87e8ca9f871314386883fce91190858a5b4035eaec9a3d0121405987a85f775834b71980604ef184e53ffec6c1f07965399aceeaec7b85ee43294b26b8e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
5KB

MD5
ba16235002534516cc931ab1bba2fa87

SHA1
5d17e98225233cc00047712b5af695ceeccc9402

SHA256
b3cf3091216de68d37ef5a05ea424abe367a6134879d77a23ab0a8d73ddc3620

SHA512
609f80425f270e7ac00bc86ad25efd311cb6526937e323ece0fc9d2faf73bd5eddc84909cd1aa4d74adc3d034b9afe121f2ad4947d3862981fc084da86fb28bf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1
Filesize
264KB

MD5
56281aaf571f25266f466c01c6d45ef2

SHA1
78fa44bda7a50603dda5bb6a4567c40764191c82

SHA256
444dd67a143f83ffbc9366bb286be2a1a17bde9e487ba4d401d6bdcc257ea6e8

SHA512
4f2d9d61b168593e265c9bf82078d3e5b8fa456dc90329ac9d56ab44de63bfba43234493fa6417cf3cfbcad2fdc6c1956233bddb6af67fc94f6ff51f25528942

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1
Filesize
264KB

MD5
56281aaf571f25266f466c01c6d45ef2

SHA1
78fa44bda7a50603dda5bb6a4567c40764191c82

SHA256
444dd67a143f83ffbc9366bb286be2a1a17bde9e487ba4d401d6bdcc257ea6e8

SHA512
4f2d9d61b168593e265c9bf82078d3e5b8fa456dc90329ac9d56ab44de63bfba43234493fa6417cf3cfbcad2fdc6c1956233bddb6af67fc94f6ff51f25528942

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons
Filesize
28KB

MD5
3eb2a052c50a064f619a3dd7ed02d477

SHA1
a38bff614937e9ea8ac0f6dbb6cca69de0e6f1db

SHA256
a4c401ac41b664c3fdb31f1c7944d1af91ccdfb2b905ebe2833aad9bf051a19f

SHA512
7017872633b7c56ba463c29b4c93908bab87409cc87be04e8fa22d7ed0d397f23975e94f43cc25c94a5bfee4de07c0425cdba1f0bb4bc6d12d11286fb05f67c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
Filesize
264KB

MD5
303c2077f1a829e253123867ca63f2c5

SHA1
2f92c2d3d12f880153519060bff550964a75ba9a

SHA256
ca838d5a809b6edaa0ed7bdf744ef542aaceaddae4f0bd364e6b37485bacd118

SHA512
1728643865e7024a9626684adb4569ebb6ee496390be4fcb3d6e98e4a7ed6b255433ee17b96ff81f8e00aebee406e6e8ff184f1de92cad63e02294c287701174

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Filesize
148KB

MD5
431ac699d827b6cc79d7b7b73084996d

SHA1
ba1a6be5889674c0e97b526e1dc506a13fa44e97

SHA256
65d6981831e20b3629b8106421b7a2cbcf1bc39b6520b27cdfcbac9627ed1fa0

SHA512
ba200a3a4f8c80612600f9f511d0f0bb477df299dc66541cef6370b344fd749292c1a0ba652f9931c23ecd2e2611c90a4b55056e21ee50f00ff0af47ac959e52

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_whatismyipaddress.com_0.indexeddb.leveldb\MANIFEST-000001
Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG.old
Filesize
392B

MD5
09b0096c2acf5b978360a9f20f8236f6

SHA1
0a1c5c24e5f7d8a37f0d07dad6f42e252dab4f07

SHA256
7a4205fe5b239c2ef626efe6e73f4ca1836fe4aa479be0d598d8b69e7bb705c1

SHA512
89fa00238673e21ed94e199c999f92ce3ba168f1f984ad94c421257288662911d7af4a4e4833fe5b98de7525c07d11fd218b801a43e456075dae853a0057f284

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG.old~RFe5e70e8.TMP
Filesize
351B

MD5
791331ec32c4d71bfe4cfe62287499cd

SHA1
23d30cbfb2834b47767600b0f66bf8ff16bfd376

SHA256
6c693f4000c58e813851fdc72b7b70c611ea4df68526634ef2a5ab8c56f39f00

SHA512
91c850434e0e9c2cf5a240e249e1952bbaf13aaa468e842b40b11a1f6c73aa8402866321884ff09dbc2023aaeca20fa0abb223ae9149fc6cc5d7576aff492612

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log
Filesize
758B

MD5
bd89c3927dc5624ef378482a74220e5a

SHA1
c5914885335185079cd465c7ab209924bd522f0f

SHA256
fc923959b128e9671d657a49de7ae72ac975d723704037d105ef876de0a0b963

SHA512
8e0c8b17a30f14167dae9f1c4ffd41f7b45a3ac36ed135b5f3c9841cc5c9c04429ecdabb3d8d46cd2b56a283869878afddb27b05964b887fd10f1bb2dbfa517f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Filesize
329B

MD5
461575842acb56f5a4e89df792a0297a

SHA1
80d135d012a612915816a6ec0b1c490215d98970

SHA256
781e5652a486cd489902b19ede96144e97d7ca910e3a61cdc4c28e38b1f59f8f

SHA512
0bebf99ba84496e36b09244cff12460b7e59aa5b7805339eab0d0d46c5b4e3a67df7ed69f42a57b24d06ebb9a851dcece27d9863fff71bbf3861098b1546c92d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\22ce143c-c40a-4f12-9d7d-182d84b49e8c.tmp
Filesize
3KB

MD5
e4e81b81cd3cbe59fbbec09ae753c69d

SHA1
ada4c4eb3203a33420b63e50a8316fce1b7848e8

SHA256
d9b2c3e6f9ddcaec4227d2da1203c840f53e83b7d61677b0b86b0a89f6de82d6

SHA512
d7a1f20508f7bc16987175d06bc54f7dd24aefcad920584d2d5cb23d80457495f4c42b0828c64fadc8ce5d8f39402c96fa4706a87f964bf5aee3566b9869455c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
23KB

MD5
198f8a8c15f0721caa01f7f6dae1e624

SHA1
ce409bb3efbcad3091c77282b196f87f4bc8898e

SHA256
14d09861e5b7a5acadf0128dcfe5a1afc3c53011b19a7f7d5c656ecb4ed8d035

SHA512
90d78523b49f967c643e9b757fbfdabb4e3fe418fd5c90c22f3f466f359cdf07e4cc1cc6c31d55bc4ba6ad60639ba93c4a4d124e798c0fc395e1e0b6c0a966dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
26KB

MD5
f1aae1a68c4ae3487382ff1174f2585e

SHA1
e95c06c7596ce01723ca73e37a13dd611de1caed

SHA256
fec05338162fd88f1b9c7bfbe20b36d4dadeaf83722a12416e3244a038c362f9

SHA512
8829bcbf5fd280d9f3b864a6b71b9aef50fcf0827c76d85b4b474fc57f89c3f39c6f29b5c79202449e006e7ec717515ccc83aa5b2da0e80cd88a781884b7d7f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
24KB

MD5
dd944773c89df835f9a10af20daa4f3c

SHA1
17a9091bb130c3d1a6bda7eadecbacf339764dbd

SHA256
9a209528d232bf7e6deb4abfb0511ea96182bd0ca50f49ec8340010eb634030e

SHA512
22ec7215f1fb9e2fdadf6b6678c7bb8b2e4f2feb9c6604673a0415ca1bc0312d3bae7a02168a2afc24bf210e3cc0c398f4b375fd20ffb6d48f72b481e53c5a34

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
26KB

MD5
b51d4bfe5c29617e0a1f1b1e89c91e92

SHA1
57c868bcb90709814098421160ee4832e0f92a75

SHA256
c246da4555f3a0a9bbba0a90f766c764bcd87a5d595724f9e6da28cb17f58486

SHA512
9e47130bddb80f1cc353fad6913a7caa6c9a23c3385fbd54378f054f9bfddd3f6d5493c4a88f2746110c6574460c93e4e12fc3a7d9f5f73532f90c069b2ae657

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
24KB

MD5
3f1824cd4b4ec029cdea168c22511d03

SHA1
f41ed5b63f2c1ae1ce6ed8a8d3a52fafbdff1b2e

SHA256
7b64368ff9f7d30b6edc02d51bb66d82fcd7601f71871fe1c42d4fb3f9d9baef

SHA512
c2644262b6ef9e5911104c3dbf24665463e747ca8d64c2a1ffcbd7fc041b6e63ef3742bd2f170cf7e92ebf7fba71dbddfa722f77f50e8aab1a4c3b4abbeb9156

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
27KB

MD5
9f5d8078eb283387a297637ff3fc708d

SHA1
cacf4a8c2dd396d8840eb4c3fb124f8f641f6f29

SHA256
14baab7ce010bce8ffa66845e28b851e75c1e6bc96b2e9bbfa6be8c34dfeb732

SHA512
dd6ce5f60d741f6398633e95863b516505861ec3f5d03703fb5bca4485ae24b98a8f9f5c04a377689facd101fb1bd86cab80a4bf69dba581f63e83f184b1b6a5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
874B

MD5
a87a03ba8de33dc61bbf06d7d7d8cff0

SHA1
3cb05bd8e6efe16a8df396b3a78faca990a3b755

SHA256
25ce443cc4e7e5eabcbd7ee541fdb15780c61b0415117d9e5a6b5674b11f96fc

SHA512
2606f51df6b27934b25dfb153cd75fcb500461f36fffa4a92062b78509cf6b0dd824aadc922ef8940bb84e013190496762d3865b9d3d418f151f653424f3a82b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
539B

MD5
6042397af5c6ddf87a111c1ec9a1b392

SHA1
c7d6a53742c0658cc89d8343f23c2b031104eb90

SHA256
d54cc0f5518cfa6e8c6985a3fd0fb13b32f94ee15c7a6d7b4555bde65f51dae6

SHA512
cb572252fc15a44839727ca8dbe6db967e3b7134ed39f47b21b63ac61b55b0cdf2aa1e1e91689bd3cc84c0db520edc959cea80cc161d04ec2dc8788a222b5b0d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
7696c0eb80bf6d6c26d3267387d63381

SHA1
eca194d9f86c3e824d68e44219cf4a508e1aac4b

SHA256
da360372f4af757b167577bfbcf11fc1392c1f4fa47d503c02e1a0715fe7756a

SHA512
1b890b941a1b7c91780a9d0abd6041424beaf70e8134e90fb10ad3c57cb9e06afdd9cb7bddedf7324d6199d295a17e86cf9a85d0cfa45235beaef085b9d6bc8e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
7KB

MD5
0ddb9d3a024b4a0a7b035c4d0582e8da

SHA1
2a5166178b9a054ff792d1a6b2c2e782d188b2c3

SHA256
e3b1c23b2b6817f553e9e12d9ec8bdee51f05a13828e0970c41df1027f608316

SHA512
a16c9c707dda681f91712dbc6880b676f9635ba6f28f0e844d24424eebcc158c77fd6a0bae88da4298abb20b5c8cce55fb3700f231eb806d5a86eebe664e411b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
8KB

MD5
02035a02e6121d01c8cf69bb3de1859c

SHA1
184c886959c7106963ab94d337edee4fd6b1925f

SHA256
bbd3bf64f952eca06828e60c6c3115e9a349d8a54945ec1e47eb6567cb8944d5

SHA512
3c828b46607157df67cbfcfeb51db15952149d3b8c951796f621d4710d9478a27865a661e709bc6161387c9c0b156f34ed0990415273ee41f913e6454cb96c7c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
8KB

MD5
56dbb68af449deef169c63edb3df48d4

SHA1
860eda1d388a2df21a0e656734818ce60c8d9e7a

SHA256
3501a5e897ac69b7d8ac509438db3a7a3d2f80f6fb5faccde225efcf3c450844

SHA512
fe937b805a374a1e3b25228586697edba60b7c9f90647ee08ee637c0f127c0935831bc0dd0b106375ded54e9a8328ed1ab2fcd36eb9f640e97e2e12e81cbfab7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
8KB

MD5
e2ae29e8a77c811fc9c5f16536ed5a5d

SHA1
c40fb88f08c748051f813a03db0f74c44abe1ee0

SHA256
67a364a380ce44514cea0c8e5a2e2d0c2a20cec5b0cfdbde358ba6903d565008

SHA512
f80138e3e3726e318f67c861e368345fc46284e2c58a69927997ec2250695aa023cfe4681d6b15a260e6205eb02a99a37f9bb863d8744d97ddcc65ebdbdd144e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
9KB

MD5
4affd1ca5f35931e416753231bcce364

SHA1
15cf4918be1169ab50ed2d2e8bd4af9ce5ce358d

SHA256
d2c01782d68be77a8406df6828551f0e8bb47e2f413f67d449ecc15d1e13ea00

SHA512
4b47102752d0c648c31d5144d9cf359d306c07d261ce089311ead42f1a372ea7e809900d24b39bdbf99494494376147e1e9f37aad1f3e88f44bf7832c14a732f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
9KB

MD5
5900d0346334c0d550b38933531cbf80

SHA1
05015b7d5146949ce4ce3afd8416d600fdec6c3f

SHA256
de2559b087d5bbe58bbea4fbb61249898ab9557876a313051696557f5121fe8f

SHA512
c9a73b5fa7971706a1a98f2a16a27f0f69eba0498db836137129e2f1a8a9277d4754e92d507e3def64930eccc5da64bf7929ff124d7b0ab05349c217b0073f0c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
d2ea2ed09f723b114196b7e2e2a0884c

SHA1
17132e2936d0f547ef60f6247c473ae188673713

SHA256
7a45ce93928d1203295ea88afacd080b8db9852857f6a6f824990f394d580048

SHA512
a01b7f6f07538e50312289f3e584897f64d5db8235473f94e56ba111293196786d158df4966dc2d1fa3f41d66881b551f90e66e87e81272763a40703ee684bb4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
0a3adbd5c595e9c8dc94150a4f7205e6

SHA1
7f1923cdfb21d8271a96e3851553ed3a868c2228

SHA256
f0604926fb241882515795ba20d65cfd6b44eab778670b9e2ab703cbcaf32d73

SHA512
7660e178b1ab96dd9f34b618cd6563dcbb48c5eb3e8d36477609db6aa8e600921bdd41e8a3a6150407b065c2291f717e3cbb16b7811f0d75a7a0d7e10776a42e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
7KB

MD5
e38c0e6e29820a603931dc767843e50b

SHA1
36aacdf924280bde0eecbcbe03e60e0f275d5228

SHA256
cc669c6bfb1674f6c4264be952a7338ccb916eaee5a2f78636797e6471cce66a

SHA512
8e884a882446581976d89b18e4b0e9b73a64d443835667049bdc5993a936e20165f3ea40d03f53b8f42286a21a813972ef1b2667854227850ec5ed0a5f8a1385

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
8KB

MD5
fba2e643e05f66163e66aa8674a04321

SHA1
18d410b84d6e12413a7a65bf7321c3bdbcc3301e

SHA256
eaee256d90f81cc0240b715aed2fbfe186ef2fbcc5dd51cc8f3ea9a5a24764cb

SHA512
91ec73f80fd240bac080059681889d2a31735f1deec588b04394fcd96ff612bef862d92fa19ff6017d0dcce094b1373182adfd2b3a9c9db9a2a6935eb762174c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
8KB

MD5
7a5887bbb0c75ad52a3b86182cb18000

SHA1
b5bbbf81a5f39d8135ebc347718b7dc2ed1b4094

SHA256
9da4f72a695c026ce83210bd2013c40f8b9a812f83ad73ca9e4b2a4e360eada2

SHA512
bba379a2295ac90519e7411a3b934a9c7c816c0af45c4cf5ac5e2cd6ddf7756f55ddb02399456b2374354b5f9613317cc51e6777f52d9e15af3c2b5732786c6e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
8KB

MD5
5d8a584ec2dca05f6d054abea4c62d3f

SHA1
bcaa9c4f4f3e8e93405c2dcd166564ce30a3cb26

SHA256
1d25bf61326f5e901cf47177fa6d968da25704f314adc98901de1f6d2e524fe0

SHA512
c6b26154def84047e68f1c29e186502a485efac8c6a52e8e2c30c41c86cef940cdf2bf999e3391a76907d5e94a9fed0d8c4debeae68997fff5036784c9d2cd34

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
c26c510e3f616fbf34ec8670f2fb5fa8

SHA1
79f526c1e842bd9e4683319333559c3aacdc30e1

SHA256
995f4bd231caf6767d9a3c13a9c7eb47fcfa562f35dd3265d5c41563fd80d05a

SHA512
d83a7d30ed0d376ae0a38d40aee3126d5036575b923ebdf9bb24f6082348ea62a2412d6266477664895de739bb94d4cc77f247a96965271d19a1b8fec3962dd4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d6ec4b43-7d2a-4f87-acab-af27aeed2005.tmp
Filesize
5KB

MD5
1845020905264e01e67fcfdd3cf41f89

SHA1
51a398b0c0ff350debec82b7f8b8f4efda33847b

SHA256
6f4c803c23fb5877b803f9c7cfe6ce002a63e9131dcece9ee9efd81e36223181

SHA512
392d66c9e1779f6064e7dd090b82ef8598568a02683df6b99a4d6f780ce7795fd9411e983cc9a7992434a03e6e30cdb8cc4060a6f78280a3d4929ffd97805bb4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\LOG
Filesize
291B

MD5
7d9919d3457fe24e4912116be5575eab

SHA1
fb665212d6258e37ebdb8b224c3aedafc264f259

SHA256
7eb86d4a2a12287318142627f5f8d3e88cd7c5aff732019cfecd4f6f32bdff0f

SHA512
2a62e7e2ca50831726c4e352b2ce406e393a4182437e797458e5842bc2afdf8a20b2512f3a3b01bacaa3eae79f7c478207e7235739e283562d43c434fd59e046

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
019a0b59d7a5c764cfc357a0d1bb7d23

SHA1
b89332988cd3701f4e8f8e360151d5d47a28a5a0

SHA256
24444f9ebe13b45630bb76640742fc20bc89d216564121d6b649e8b4a019eeef

SHA512
7cc1f763172d7f4e4c476824d5c02fe5fc837116e5cd9fa1f896f541944298930c1609ef152e77320004c914c55450e51f73d908256141e2aec4959268388ced

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
97a731d8f8e33c16de669eaa179aaa36

SHA1
b7b2b9cb7b0de7e3341b817d3250645b0c9a0d20

SHA256
34f8f400d5d092ec41f8e29012ca7a40b5dbeb3a00dc6bb86513dd1d4f226831

SHA512
4057462f1b9230f88ed46a8207bbb3a6216d1ae7daa13babdd75c4f80070d6cf65c4a664a4150876d62e0c37f87930614a41c00f96110542d0d7f8f4f5f2c936

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
db7a7f606d79736552807196dc6bfc1e

SHA1
5391a17c1928d31f970eafb12dcc15bd492a63e9

SHA256
6df19fd40fa4755c7d87501ff6e05310c8c54bdaee97ab674ff5b3aebc346712

SHA512
3385c092da65f91a9910eb2259c014f33795d32601238361f53db941c9f9e5aae9300584e329d1d604f7a9f9654b16275945a510c5ef01f325497f91b404e6a8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
db7a7f606d79736552807196dc6bfc1e

SHA1
5391a17c1928d31f970eafb12dcc15bd492a63e9

SHA256
6df19fd40fa4755c7d87501ff6e05310c8c54bdaee97ab674ff5b3aebc346712

SHA512
3385c092da65f91a9910eb2259c014f33795d32601238361f53db941c9f9e5aae9300584e329d1d604f7a9f9654b16275945a510c5ef01f325497f91b404e6a8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
cd74e8b315eddcb3f07a01852f64054c

SHA1
07d2c22eaa52ed8bcb894f302cc9466df5ebecac

SHA256
38c7ad84094c47478fd38db611f992275651525e90d19ebfaf6f6caa1d18d330

SHA512
e151d2c0a5b09d6d31f5b3860b60ab824b078bc6c5bef3adea0f78543fac713a26218b9f9079c5d990247c88e7e9d2448ce168ab76e38b7be94f794221c72f93

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
57430321a9d533ba68aac55f813a20ea

SHA1
bf75f61869d0a4a5c6b7e4349e01fa23884d7e49

SHA256
1457108fe8bae92f77875bc8e19f159c2a6eacbb1d4ee757a487cc80e5f42b4e

SHA512
5db437c47cb202e80b91b64c9f86ade46f55d284386bf1be6908d497137e61779742aaf151e69671c996cba0c17876b5e661a1e03e7af2397c34f31b695dc97e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
853c30591fa1e693843ecf043deb2f70

SHA1
4e23a9df0ec40ebc30e041866bd2c90ddd2d57fc

SHA256
a7a42f239053e86e3bca577108fed59de659adc46662c8fd5ebc98874005c172

SHA512
c9c5edc8bb3f1a58f37e52f1ca717869e5b39df6a5bc9f769b6b8e7549b2cf3a6056ada58500eec9ebf17d223d25acfe39be22b44246a8ca4ad8f804016a63c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
8KB

MD5
515f5f9d2912f414ae7b41d4a5b30673

SHA1
b8179f5ad5aba1f2bded6df290fbc24aa20dd6ea

SHA256
afc2613df672ded3aa2b9a44fa31a8b8f57f782075d74c9213ff2f64579eaaf6

SHA512
82e33fdc9b92c171a418552d271eae66b358bdebec90641091f3da6ca30b16de436b960130b37b4abd697351bd0561179002ed28e4f92b07eb466b18484eb0f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
8KB

MD5
df6d21055bd0792accbcf4a2721d2ef4

SHA1
4e771e38098c31dba4e9af245c171c833669d906

SHA256
e04d29f330deef99bdf04e33fe59a4a57dc7bad476cd879b954c2180561fd2f5

SHA512
c3d8fd1140e79ea643ee28d7961e0a2499b4c9b6ea1e3a6619d282b97d227013ce9072c137590cb8d960214e6c46d9a146cbaa3fd6a5605e24de624e58ef1a22

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
224b28180b585d971a0acd7125bab491

SHA1
4978132f773e63bdd763032a0430f967f9c4ba28

SHA256
99b41feaf3c1201b29cab7bb20ba60f83a1785858978c9b687ebd7f28a736a49

SHA512
a3930910b4c7ea386e298df0d2dd152de52141b31a13b9020054d78dc96211c965fbbda63d20b3c5a57a41b1679949b933253d623488e85c8163a4e1103e89c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
7b6e8ea377ac6140f46f11a45089c585

SHA1
229e3fc6dc18c9699ae3eaefabe2e24dd119304a

SHA256
3096cadb058d35730f3e0cb8e79ee7a20e4067b64fd1e4b217d5cc1786863d59

SHA512
b0678dc1f59884551a4bbd91d2ac498b6a1c456b4265ecca62773d3895b28f6ff13b6fed698c4a7ffcba9159f11eb87ae01c047e6cf1fa3248bdc5204b1d1794

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
b3c6d62c59e10a2885121e18729a4f40

SHA1
b17beaaa70bfb9897ea300b540e2daf572c95902

SHA256
a6e64b744cef44b65af651b56caabaa157d498eb4b9d4c40b8f5de8dd1e18b19

SHA512
2aeea78efcbd23124381a3cb7b2afe9e47fe010da15ca13e2fec100c610a55a2d6dbb9197cb9d2681e6350297d0f8dce4ede682a1a380d408234442ad1747788

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
bb3649cee2ef6af9ce752ecb55707d34

SHA1
dd635d8768d7a4ada4303ad3593922b36f2525cf

SHA256
231701edd84960b6ef7af95c6d33f772130bdf12b7a31676d9d1937f5a8c24c6

SHA512
8c359f29f32688deb981d333bd4c424c147e0291d935b96a3a796d1f20136b294e57faa221e9a7cad0b9b80c9365005ca4ba780793ae21783923eb964a43ca00

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
1018fad4b54cd1d7f18f1d2b495f9262

SHA1
e5ef61c1518ff3abf3059568c05f5d98805850be

SHA256
7c9ad79f4b644e5643e292c60579206a90a59d66ffed5693f2a3a3202cdc3fce

SHA512
29a765b984563c5e34b3d7749734e50676884505df75f41c59d56afe633cd2ac9bb311a693a4eca4f7a234c627f2b2110cd3137d55fb847a8cfe3318e00a6f75

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
4d662f4006c9ca4ff711f677ecde20f7

SHA1
a5836e0b969e99dbb1fd2a672e0805d69d0a980e

SHA256
f1cb7b3ad7c36ebb53b3d585a18c99aa9fede9b7f4969703e0289545760f65d5

SHA512
bd2cde1e0a508839c3f6985a7c5e542cc1282de2ceee3ec057e2652d1b7d9b15e5191fa9d86d3df6d03a962c3043d00c2131f3609144a64a0be4b3258da63661

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
8KB

MD5
ac97a3c43216643d4e3b5e7793310bfa

SHA1
5323ef5e257376c2fcbd40541e9ed8fffceb35b5

SHA256
316f8106650734f7db4a782e906f54a9fc2cc7f3c534527f95118e6e35541766

SHA512
2e758e9397fe8acdcc4a16c953586ac25c24ed179307d6a1c9c8f31c1ba906bff6cd30734ad242183342cf009d69545649472bdacef304903662a78ee7c8e9d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
12KB

MD5
cb1a972eaa612dccc03bb38c12fa828e

SHA1
353140904f58e1c20fc46b0c65431ecd86a94b9f

SHA256
f44143786394fd9818de0ca25f636cb46ff11926debbec7f0d4f31f8f0f124f0

SHA512
4696412022616b4d11e730abcec367c7048d8fbcaa1b64892c7fd52fd54557ecae82ded525e882775c52e6aa7df662abd01ef096fc4ee6a9064bc7e209b72b0c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
12KB

MD5
cb1a972eaa612dccc03bb38c12fa828e

SHA1
353140904f58e1c20fc46b0c65431ecd86a94b9f

SHA256
f44143786394fd9818de0ca25f636cb46ff11926debbec7f0d4f31f8f0f124f0

SHA512
4696412022616b4d11e730abcec367c7048d8fbcaa1b64892c7fd52fd54557ecae82ded525e882775c52e6aa7df662abd01ef096fc4ee6a9064bc7e209b72b0c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
56B

MD5
00cbbfa9d49322d9fb4cb99497649a0e

SHA1
85e089f175670d7e9370ef79337d68ace2a4e944

SHA256
45f6cd2e00b82e51a921662a8af4560ce75c8aa8369052d1bddb068e3b6c8ab4

SHA512
f27e95cddd1241cb8130165cc1ecc536de3de9f45371243f858fcc410fe9e7cc2c0a993ed49dde2a3ce2081397384a62a6acb162a0f57c1be1348f0303c85881

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
120B

MD5
226da81f85b83240bbddc8d1384f043d

SHA1
832b8bca3dbe5bcfdcce38ab73d81101037d4482

SHA256
596136ee0136328ec5bc86a817487ec3031c9efa12d742371d6f5fa689b5a71b

SHA512
afeae05d40c85b628ce2b8faccfa172ea01c0ff8d99189e7757cda272c6ba2929a5fe82478d97c362b7d1bc145935faa5670620bcb1879ecf8e10f92e817c140

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
120B

MD5
283ed8a60282b44c4268796824d7214e

SHA1
731f9f888f31894492cb6a39d7b911e290020267

SHA256
44acf23a4c2d803e50349895c288cc0866bc7f207a002a455dfa3e93eaf8ebb7

SHA512
cc06d50ade500d53c61c6cdad7fa415ff0a210566c83edd301890402cf688f3751803d6f5cfedeb3463e2e376aed82128f1d4dec363837df80a3a25b22d0fa2c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5df928.TMP
Filesize
120B

MD5
01cff51618c9bb6a5a8eaac950f48919

SHA1
e0e5fb86003004adbb7b219ff2d07aa766b2644b

SHA256
c18409a7381aa939b3d9dabef519101f2e64b88fe6df8525a2f97712332535cc

SHA512
42e511ce5b580b507a7a04200c010822c9412ea2567973e2c9a180811470b0e25b95c171ee926e7c1481be9593541de98c4d1ff5c245d347966f806e31b3073c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Filesize
293B

MD5
e54d0906cbf27e129cf50f30d0f90e70

SHA1
0202be30185c7606b235da671a8adfee659d4163

SHA256
9a436cf9beb87fbc40bf2351942f3037e94ae033d1220f7eb6aaec7e12af7693

SHA512
d4b5fbab01154ed4e6cd3a283430e0b28e32c6aa24abd8f38562b922f71488b2e7a57af321470fccd5d4db40360035e466da165941c6a834672272d6b3906f72

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
48B

MD5
ca3496090936ebcfa8990b717742abf8

SHA1
fd642705470129d3bc08e36e9e79249c30b72a8a

SHA256
07d12ae815d847001d1bfee3250db5ab3fd037e2e189a2c7669416835722e07b

SHA512
d5bf297651087e8336808aff5f210181d9eeb14105f439e6dce99fe7213041bec0eb390bf44ab4796a1712efc57a190c2c66c2e8e318173b4725165b22563735

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
96B

MD5
be64b69ffe4ebed69c1498b80425ce54

SHA1
e61ebbc6d71b3c7b726437d168413129618317e4

SHA256
994e2a430d0939075904dc26681d342f9aab0012532c3208ae99c8fb4f9bb214

SHA512
19fd2e0dec76bfca12e127ca62f21fcb25a3435862979be22358e105010ba32fd767cacde33553951eae6b49c0a8a5d23692b95af9b71b0f7208f0bbe7f0561f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
96B

MD5
47d23ec121bca9c95352f23161c08901

SHA1
ea6b6d2cfc9f1aa278823b8b3e0cd5c93d543ace

SHA256
451259edafefa5b78bcbe73bd27d60e1509d2a69d5583c1c8d55481310fac8f4

SHA512
894a3e9cec94a55048c361ab9defe08ab83d9bac367dc9eb3b3771f44d179fffe975919ecd61a301feb92039a831082de45636b93e447ea6a805152a4fd5cc0e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
120B

MD5
6bd504eb5e0f2f6d30882ab73fa9d9ba

SHA1
3efce7941a8eee7062d28b3a37c64bcc8c45b30f

SHA256
cf861dc5fe498171a65fc684534a5f207780f2521677ce7d883b6ba6b3861c3b

SHA512
6ed13955f213609f705925b8348ebba85f0be15b0a63bf59e9c057bc9ffdd6a8ddb63321e277f06268803b7d249b5a2fddf62ad5fd62ce8a021db8229b25552d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe56b645.TMP
Filesize
48B

MD5
b2715c88370ca9d49c30c6c1bb966c56

SHA1
243faddde78912b3c4067bf1fce7245babe43148

SHA256
f2a7946bafb923c070dc1305f3bcac7cf69ca9a38a12e49e7353b7e00354b42d

SHA512
603712221d8762dc7aec5157a6e458407cfa8c79d79fb6f5c60a90a7edc72b3a7cfa028e0eb6da8c874eff355e18da2f63d61ab36417e96dc162219d61e0768d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Tabs_13324939315455762
Filesize
8KB

MD5
b1bd89a5f1d2435235c1fe8aa9670f21

SHA1
4d97c2101953c0d34a199f8f9d6bae223697f2d4

SHA256
9db496b5e51ee78a99c66bc3c1d4cace78536cbb08957b4206ac9c71e1b64090

SHA512
7500a48fa27ea220aa6c6fad4818f8e2caa6869b7e97de6080569a406fe57fcdd9acb5900c0453d18862738df5b790410c3c106e23f83c4d86da29c5db33841d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log
Filesize
184B

MD5
2665819c499d50b19dd8949e5a68714a

SHA1
2f635f814d45ac6018371030d4145335284ed438

SHA256
0b3f865e989209804c80a598a8d4d40adfb2876c8aae1709893f8c4eda847ee4

SHA512
1bf6a3664da7560a0d4e53bc1065954128b1303e7e3dcff31fe7d8c1c407da3aa09a3a13adb65bebc1b7974075ea4e747567fb9f3e09f64b94ed8bdfd228a1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Filesize
345B

MD5
86a8f1107ee5d0440b1b97d8373fc734

SHA1
075d6394aef724b2903fbfefdf3715330ec968f5

SHA256
f35d4e8fe3981cff1730acb0d28ac5bdd966892923e62102d3e3d0378ad392e5

SHA512
ab48ef18651f815626e44962480c6c025663b9c70f4fc3366d31d7a004c5e67871ddcb1bcddc811ba835c0bd43c6fc42b141559c575112b39cefe506574c32b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000003.log
Filesize
6KB

MD5
7470b8e02105aec32da04baa73d64b0d

SHA1
11b4e400095c81f4ad2d37cfad6d530c90649e3d

SHA256
3d519562d3af6661b3a5cbba55888068b84c758b74713572357b4f210a783ad7

SHA512
f066c395146b294bb851f7340cc4a63901c413b913d40334bb5a7baccb569c298c821f9e5bdacbd06bad2070ce5979f4a69973c560f51e127800f16273723507

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Filesize
321B

MD5
e36c353af4d944964c4198e9d53cd91f

SHA1
c052cae25c374d8633a217903f83861149fa122d

SHA256
a4ef47add4e4159468d415d20cc7804bcac3ed6cebf3717eb0ebee76a8b36553

SHA512
3fa93d4bbb92ff9a7691f95bad3826678a608077ce413799607f4d7b985fda5c9e80dc4a10ec9125061f0d2658f70ab149ad24166de4baaaf12aefd08491dedd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Top Sites
Filesize
20KB

MD5
d85d5297b0b1e08c9d357df2047131eb

SHA1
8bdba4d822ff39db0d6e0bb2cac2a9d74a45eb88

SHA256
b850acd51ed1054aeb18ca4d9a7b34c7f5deb92e88fa50beae77d1a30099fde6

SHA512
79bd0277250a0021a911f7e46d0d21958b43de0eb3a1c845ed8c3342587020cbb88f3f87626423ad88d0f7d572865ce83f2473b73463a347b9adca8416674b27

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Visited Links
Filesize
128KB

MD5
370b48b64ff6a9bf4ccc6df473a1ba34

SHA1
bd0931b54985c0cb8d44707332240b90ec5911f8

SHA256
ddfdb159468292911c0e5f94a4f36d7e47a7149ff0d104ea5873309507e68986

SHA512
3840ca85e4f3390ef52c678bcf5b07085101ee78435eba1597a04e9997310c8911296f0faa36defdaee0250708983f7c42ca5b69a12be0017661c0b0174b72ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\aabf5f34-c119-4682-9dfd-9b61d8bd0435.tmp
Filesize
7KB

MD5
6f1463ac769ef5e9e677c8c8c62ebb1b

SHA1
7a69f8d6b02391ce4f592fb25d3cf5c1e87d05ed

SHA256
977423764f3bacbfe27f66550812c8ffc4a375cf450a04e58ed4a60902041591

SHA512
c5b7a98c13e77be427b5320da72a5feae3ee7f2fc6ebcdc85c291ff7301ec750c3b69aabfd973eedb74a20168bbfab813f153e7045b34ea900b7c103926f3f5e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ad7bad49-d3e2-43e9-ab87-12a74a22a655.tmp
Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\blob_storage\1300eb10-7350-433c-ba33-5ea66330bedb\3
Filesize
13.8MB

MD5
13d915ddd6693c0d31c13c3604599c52

SHA1
2efbcd604618f4d86fb22e62dfde10941884f4a5

SHA256
ae19bfec233cd6ca499b6d2dd5be7749af025eb863de81a2ac7ddb746609e292

SHA512
fd4b9675685bac5676d8478ed34a7b1c7c0bbca070259b4932bd9de8448dd5bfa5148a5022b4a44858c4a6a7b63c0d32368b6ebf118521446e932b7cbeb66dbb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Filesize
14B

MD5
9eae63c7a967fc314dd311d9f46a45b7

SHA1
caba9c2c93acfe0b9ceb9ab19b992b0fc19c71cf

SHA256
4288925b0cf871c7458c22c46936efb0e903802feb991a0e1803be94ca6c251d

SHA512
bed924bff236bf5b6ce1df1db82e86c935e5830a20d9d24697efd82ca331e30604db8d04b0d692ec8541ec6deb2225bcc7d805b79f2db5726642198ecf6348b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
173KB

MD5
f77ce0bcce0b950ee81343a97066d66e

SHA1
aeb59a28f018346a1d12ee33d8dc0c6656350e22

SHA256
a44caf1e60988bbd588e3c196be43d5dd185f6e657498e556e88b025d21cb48a

SHA512
4caf22bdbd5428a1ae2f467068dfe71575fd7da1838f59d516245a93aa08f0ee07b89df3610d4b4a795d6849399a2c2e526ae7536ac73f955f67df8cd56f811f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
173KB

MD5
736217c4df928847b2e9d834852d72e8

SHA1
a4158872f5501f97288b985fbfce894c3f51bd75

SHA256
94c5e2fa4236154eba565fd74f3613a81d9822c78dbdd8baf8c3b8bf612350f5

SHA512
c25e1e50b91c1d0321a17379fe5d132fc44028b22a1135be4ceacb7817ae1fc1c4dc979bc3194dbd76ef5e664efac847a2a12438e49a5d52acff728c6a124e48

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
105KB

MD5
57d587bc97d406d652a0e3fa05a5b4d9

SHA1
9ebbc3a40280461aeb9e94d3cb85a18865a9e9ac

SHA256
5f99b9df6f64b5379ce1594ef763cf14e55d021bffae384f11a463b9c189ea92

SHA512
14f29f95e870b2a6a347ab11932ef0f03d27e4e94bad80e63fb901c1b28fc860ed54f50fc60611c8ea936eee59091d400cd57743eaf9d21210ef766367231a86

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
105KB

MD5
9e8a741eee634e6e7df282550e0a3d75

SHA1
a72cae15612c19255c68f88db47886b9163c50d9

SHA256
4e341266642a17dfc8d51b8ad3682d21a67b4dd3543b4da2ac15097232434abf

SHA512
a306c36d3f391e6d2de82b896558e67a1d461f0358906fbc67f8f138dbe39fbd3032fd53f4716ef782f10ad7a87b200cac2d7ed252a4210e9dd08ee02e1c5fdf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
105KB

MD5
4a06d7d6eaa30fc65f0504f428451862

SHA1
52520b640de1aab07acd0f786f95adf98a1b600a

SHA256
ec5ed9a77f2e444434078e85cbf558aa0d55ced6ccbd5373007405ad25882168

SHA512
2642ecb1950f7b480e3f94b76a8d414eeef72e44fa43de081c8ff821ee88d5a0ba42124589f86f1bf502f8ef1b245d95e7d493c5c8475baf6323d8061d342dc9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
105KB

MD5
c8981321461e3109a2a6498f79c3d133

SHA1
4b1406f735bd01f908d9537fe2173bfb8d5f7e6b

SHA256
f6ab4cba3c030a6627f1e1aa455fc9ed4c9ac558ed3535f067a5fec0566bbe1c

SHA512
dbf92a30e387180547d9d32792e25ad2e3d917b5055492312d5c59f44f20f0f81e317a8008cf3f7acb4901f687514a5675ccb3d40e91910b6af6c690a496f573

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
105KB

MD5
3d062e4367efd7a50dbbcb9977a693ed

SHA1
29f8c8c4155a6716fc7fb52b6c1fc20a92426d7f

SHA256
d34b5718cfe1b306d8502fb49ad04157b1a76f899e0120c943970bf31e900dc9

SHA512
e4f7295c1af76bb7b5a6f4753c5729ff27cff395c71a2e9eb73fa2a6ca7ecc72335eef2c19a0374d33575ebc7778e6622a0b6eaf3d348550756b49538c62bd6d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
173KB

MD5
ed876051f1756f47af5a9b0d87eb59f1

SHA1
70efe1d30c7194d128eed20075ff294b92e07ffe

SHA256
cbb037616009dc07a541bff089a8ad99b955e11aa32efedf335ec9a58e501a37

SHA512
907edf6b57ee965cbbe4818a41975cf474093e41cf1a6c143f34fa3f0425b840e984ae20e99a5425d7a4bee1d822adb312c2b359a97047f61c08c84565279094

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
173KB

MD5
fbec26cc648a38cea78cd1cb5e48c93e

SHA1
d3867190910ff8fd11d69897a80150a4f676c6da

SHA256
345cdd0b334740f8cf62686bb0efa365fd81461a67b62000a326b23a2ed25700

SHA512
d7572da9a7aacc824090b5e9026be468a55d067a7b6fc018e0864e17252afa13653a18943b1ee6beb99c41bfb1ff2775d97d361f44963e49bdf7f1d716a716d1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
173KB

MD5
69a38f6ec4a0480a0f95ca78c48f9401

SHA1
dd6b0ad23d6460a8c79c08d91cd581bded4e0500

SHA256
30ccf70724938be529b6278cb01cafea154d660a120acd08d5a930672629eea7

SHA512
abf2ec9e7d31acc6b2764b6ed5b75141a60a7a26178ba2032d906a9b11db5d0e441ec85d0c36716920706b6d52f57986b839e52c51c0133ce87f68b9e5f3731c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
105KB

MD5
574c421e74538cef8ca6c5e39f154322

SHA1
31c637134b7e001ef3ecd40bcd6e00ba92020ba7

SHA256
9e6363d68830907c93156eedb57f6905c483b46b9511229820ad64afaea1a55d

SHA512
c0010d544682b389f6336d4f9b55fbe8d54a75574e3e5d340dba59ac59ce28715a23e55288ba1899b9c568d1a00b6a8899988f73ca5d32c505acfa32034c9091

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
105KB

MD5
fa382ebd6f16c4336e6a848f4d6a7baa

SHA1
e690d196387106ea9e03ca626aeb9286702adf97

SHA256
45c84e4015bf6e849c5924f3c3cbb7b7465ec20acd2fd692cf33dae9a9220d4b

SHA512
21fff6f3901fad12a2c518e093902d3dd3a5a4951729ce8741ecdba0b27f9d13e49093199e840d232b61a15ee48e6ab3026e86ec6e113a0016b97bc5dcda8c3d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
105KB

MD5
2047c08e8b44a8d239577caaed7e273b

SHA1
cd1752dbf7e352d75e719e9dacbb2143e7aa6f92

SHA256
245996fa5179dbb51672de2009f93033d31e69c0c7f0a29f40c2eea888efb76b

SHA512
8dc92c4f4c75948a0573919f5b041e718ebbeff8457061ad6802abf7f988a386ab019db17ce86478ddac37a8f3c3fb6b3530124a22f129a3ff4f11a6efd08a77

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
105KB

MD5
41dfa44ce1f129e23d38758fd186e834

SHA1
624a1ff4886d8b24865b89b804ed9d8f8be36d4d

SHA256
4025e2ce41494379d448344d7c3a56b0eedc9f43558e75f9057ff5db5e18aa9f

SHA512
8a8f653b44b0251cef23cddfc1c2bf13adea82914ebdba6df3c115967a16b3b063b85698b9f8e4f44d5aa22ed98f337bd950c5b7f5df3ea7ce4ebe8ce3583f86

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
173KB

MD5
69a38f6ec4a0480a0f95ca78c48f9401

SHA1
dd6b0ad23d6460a8c79c08d91cd581bded4e0500

SHA256
30ccf70724938be529b6278cb01cafea154d660a120acd08d5a930672629eea7

SHA512
abf2ec9e7d31acc6b2764b6ed5b75141a60a7a26178ba2032d906a9b11db5d0e441ec85d0c36716920706b6d52f57986b839e52c51c0133ce87f68b9e5f3731c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
112KB

MD5
8092d2e7e419774ba2162dcfe21c6997

SHA1
303a4601169a8bd2bd9bf6d8ec87c9afa8eb1115

SHA256
b04b7beb3e966e49f1cce8ec7a994fbffae51e31e21dc0c225d62e9f611e2e5a

SHA512
9e63d3a25aacf2d62bdfee675b8cdc72223f46d04892521041a1b68b32436f9f7aad80ce918de4691d799e9f3fe31801f84143f52e53469810360f27758ccf6f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
105KB

MD5
b75533d5373201aaa4fda6ceddb4ab8e

SHA1
abd6279cd03e53b93928d4726327ec6f8c8f342d

SHA256
571f5ac0e62abb0806ee3bee68c275407769826c87197d111d5e523691befbcf

SHA512
91cd0c6dbb22427f4697c1df74e2e57e7910f4350cc106b6c08ae235d9ebfbb41f67e1ad3331c84a7c1bbcdcca78895cfd016dbf5e17390df103207a1d000087

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
106KB

MD5
7f0f9e21deef77320f0e67a821d5f1ec

SHA1
101102a2a8566036404a3a16c81e763bad0b8bfd

SHA256
7ab87e17111c3773e6f91ee12b0013a519ec96d3b9422520f05757ad53ba1db2

SHA512
0a4026e313b3a1c7ed22440e333e1236607cffd7a0f75c6fc22f91823e75dce9131afd9c2ccc4cb5891623fdd3ebd81f316a1b8b53b17e9d6999fc53accd8b17

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
108KB

MD5
11fa5d9084b8d0c61d012b202344e47e

SHA1
de4af4d6049198a47044436eb2170bdf734052a3

SHA256
588ea3f834b0bf14731aa8e0c48bc01b3850dcf3596a4638522e48c6a63c6d41

SHA512
f1c8421c2735f1d19d6c82c37a105f236fc4c6aa10fa5a117dcd18c3c02f427cb854d3b8e8cfc7049019043b28ecbca5a846c94dc944df92caf74514aa5ceef6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57062a.TMP
Filesize
98KB

MD5
9270cfc5544fc392ad6c4de40da67070

SHA1
7bcd179c7dd2e32fdd240406985a86f1f0bce62f

SHA256
e11936700bb8b4b3cabe46ba03235079f47328a8493b30f1d61d2826f02061b1

SHA512
c655cada7fcd6103c154540c70f0a202fd3372c25bf76a95ddae28845beeafcc0780716022244e797a4df303a72db32131bb9e29d4bb412b9e418373676f73f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Filesize
264KB

MD5
047ffd379bdc994a7dc248cb4d971ff8

SHA1
010be4edc414b554513891a8a516d93712f4cefc

SHA256
461f727fde32695c2f28b08ed9689b0c55b427eeedd974cdb719b837121b75c9

SHA512
f9b89692ecaafd498233dabc4490dc7c61aabc61340a7d77a17097915f5f784a8ace4c9403938e1800f8bb01b8c0abb3ef2cd1f038a18f2c85453f5a98ca0f02

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6FGHNCOX\edgecompatviewlist[1].xml
Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\oqpbz544.default-release\activity-stream.discovery_stream.json.tmp
Filesize
158KB

MD5
24dd1f6efc0baadab9428dbe780d33d6

SHA1
519a1b0cfa3ad051ca4a50d1a904e2efad3726d3

SHA256
7d6e1e7c7ec30d66558f4002c4ffaa4b68a7a93737252827fc3740802cb8b187

SHA512
efba4f7e0c63ba40b11d379ae869deb9576dddef55f3a48dd4db6460fd5224078450984976c955af5678f94ae69f9579fe221714ea92e73da8ea6ad9c5375f20

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\AEQLFWPN\H59AXO6B.htm
Filesize
20KB

MD5
b459541a3e2b43fa01cdd3f9a8ad70d6

SHA1
96578513d37624f3be88bfc9302b5ac67ba3f30a

SHA256
3e5acc28454007aa82915039083e38878f22f98b5ae2b782b12d3c30c0b239b6

SHA512
f8eb4f6ab8af7d147cae9df52b46c61ee096d30b2bee9b832ab16242f87d0f7fbc88d058ec3724ae2a9d6164b99d5d64d99a69e5ebe2e850a271a121a660dd80

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\AEQLFWPN\rum[2].gif
Filesize
43B

MD5
325472601571f31e1bf00674c368d335

SHA1
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a

SHA256
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

SHA512
717ea0ff7f3f624c268eccb244e24ec1305ab21557abb3d6f1a7e183ff68a2d28f13d1d2af926c9ef6d1fb16dd8cbe34cd98cacf79091dddc7874dcee21ecfdc

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\AEQLFWPN\sync[2].gif
Filesize
43B

MD5
df3e567d6f16d040326c7a0ea29a4f41

SHA1
ea7df583983133b62712b5e73bffbcd45cc53736

SHA256
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

SHA512
b2ca25a3311dc42942e046eb1a27038b71d689925b7d6b3ebb4d7cd2c7b9a0c7de3d10175790ac060dc3f8acf3c1708c336626be06879097f4d0ecaa7f567041

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\AEQLFWPN\syncframe[2].htm
Filesize
13KB

MD5
81f6b4769f6bbf98d2a30d8385ed1523

SHA1
8c3453e25dd7980541019d3f894f148357d49009

SHA256
3e42a425624695547df62ba848da2b2362c8aa034e9034c0c24ec05a4cbdb450

SHA512
35d737c15cc31271a9a778421f6bd682aa696a22ecd8b578f598395dc464507e26ddc87aa5227c3daada42060fd761da8430321f4cf25f3386d7282f0f2f3587

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\DMCGBH5J\Pug[1].gif
Filesize
42B

MD5
d89746888da2d9510b64a9f031eaecd5

SHA1
d5fceb6532643d0d84ffe09c40c481ecdf59e15a

SHA256
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

SHA512
d5da26b5d496edb0221df1a4057a8b0285d15592a8f8dc7016a294df37ed335f3fde6a2252962e0df38b62847f8b771463a0124ef3f84299f262ed9d9d3cee4c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\DMCGBH5J\gpt[1].js
Filesize
76KB

MD5
573de8e828cc32f01b573c4a30072033

SHA1
d6ce0fc2ea4a930b293f91e2d38145fee6b2257e

SHA256
e2b44285d852593eb8f5a9b275c39ab1f03dc11ec901e0a23c802b861a6c11d4

SHA512
d8a77e7e00ab050ed2ecf124fd41b521bf0740ace3f8accba3092390792a098721ba278b4e4f686c985cd6e9902c757d2245a3075f8801bc3ffd6b54799c4e1f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\DMCGBH5J\gtm[1].js
Filesize
390KB

MD5
5de01eb940a8eabbd86e1f53719d48d0

SHA1
3bc9e9b6a624b460e7ef5013a8c3ac6fe22ff5f4

SHA256
ef75571417abb0a24d6e780fbba4c572fd8db730d1abecf8cd70f1c9e0bcae38

SHA512
75af0d47df1186bfeaf7b29e1db6144030bfe0f11e398610fdc561249ec4aa929d1d60dc01fa83a955f36adb84f9fed6de7c3b099d0cda8fb0f7686a28a26fb5

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\LQIHSIK5\cookiematch[3].gif
Filesize
43B

MD5
b4491705564909da7f9eaf749dbbfbb1

SHA1
279315d507855c6a4351e1e2c2f39dd9cd2fccd8

SHA256
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

SHA512
b8d82d64ec656c63570b82215564929adad167e61643fd72283b94f3e448ef8ab0ad42202f3537a0da89960bbdc69498608fc6ec89502c6c338b6226c8bf5e14

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\LQIHSIK5\js[1].js
Filesize
131KB

MD5
f89f57b5126d27b90702002ac63fe40c

SHA1
770277a440bb0dc2daeea0f23622bef5e04ed44d

SHA256
4289a1720ce174a8dbf9033e41829923fe75e569f6476a6eb9ad475964c90ae6

SHA512
2e28b9b74fa79203e1e4fef9626bb4e2589f1aafb7b7ae18d677db1c71347787372dffdcace7f5f2b63760c5b833916ac53ae0dfa5130c3f8f7eb0a96769db34

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\LQIHSIK5\sync[4].gif
Filesize
43B

MD5
6d22e4f2d2057c6e8d6fab098e76e80f

SHA1
b80b11203d97fe01c5597ca3be70406ea48f5709

SHA256
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

SHA512
95dd0e4944b1541a9be48a60a1a105fcfa0d69dd215abaa9c1771adecc5ee0c0fe91d0eb367b6d46a4f8b2e06e6fb962d56dfc1c53f1f62cc8b314710628cb1e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\1IK0GKEC\en.softonic[1].xml
Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\1IK0GKEC\en.softonic[1].xml
Filesize
17B

MD5
3ff4d575d1d04c3b54f67a6310f2fc95

SHA1
1308937c1a46e6c331d5456bcd4b2182dc444040

SHA256
021a5868b6c9e8beba07848ba30586c693f87ac02ee2ccaa0f26b7163c0c6b44

SHA512
2b26501c4bf86ed66e941735c49ac445d683ad49ed94c5d87cc96228081ae2c8f4a8f44a2a5276b9f4b0962decfce6b9eeee38e42262ce8d865d5df0df7ec3d6

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\1IK0GKEC\en.softonic[1].xml
Filesize
764B

MD5
cdda1aec9f440f3b4c232d208f26e8b1

SHA1
058b6e590e69833385ff83063da54c23deb12a3d

SHA256
facca7ddc38480bbd0f3dabe37286754d91c53e320df4ddb3bee3f5d4ae68bfc

SHA512
f252e9591697398648f73b8b208d49a01901bfe25ee09de130f87d3993e5019ddb96893ecf743c878bf397b45502a1aa419ba6ac2020f94b6e45876b8ed381b3

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\1IK0GKEC\en.softonic[1].xml
Filesize
761B

MD5
0e29e2bb074226940847c82ac16a560e

SHA1
0a6cb30f8b0b0f6f48355c57bfe6dbcec6d2710a

SHA256
2e6ecc6da7e6696458ee7443880c173bf6efce13f030d0d068ba1339928ad02d

SHA512
16574ab9b0b69c218012a26768dfdd4e76522c6c437b37bdc8f3c33c552e344c84572590d3196736bbc51a2b31bd46701a4a969aca66ea25cd0393fdff55e4b1

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\2XOJNVPG\suggestions[1].en-US
Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\GFE78Z1H\PCOP[1].ico
Filesize
6KB

MD5
6303f12d8874cff180eecf8f113f75e9

SHA1
f68c3b96b039a05a77657a76f4330482877dc047

SHA256
cd2756b9a2e47b55a7e8e6b6ab2ca63392ed8b6ff400b8d2c99d061b9a4a615e

SHA512
6c0c234b9249ed2d755faf2d568c88e6f3db3665df59f4817684b78aaa03edaf1adc72a589d7168e0d706ddf4db2d6e69c6b25a317648bdedf5b1b4ab2ab92c5

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\GFE78Z1H\c6a73-91dde[1].png
Filesize
1KB

MD5
91dde5a34a64a36d8de82112d86249b7

SHA1
a62281335242dee49863f3d2ab7bdce82453dd32

SHA256
673b00e2d93145a1a38ba186d0d5035f3539c0a91b83518624501acb5d41d229

SHA512
3efd740b9c2d05c3ebbd51c000c3271a2f634d39e1bca60871fc31fd49b702e57395d8dd32792786813c9c254152524c692a026d5dc82c8a17a896aa69f12751

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\ROVN5TO6\favicon[1].ico
Filesize
5KB

MD5
f3418a443e7d841097c714d69ec4bcb8

SHA1
49263695f6b0cdd72f45cf1b775e660fdc36c606

SHA256
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

SHA512
82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\ROVN5TO6\favicon[2].ico
Filesize
361KB

MD5
dd93641f8ed77493e86a01fca33558cd

SHA1
a4aa666eae95568bc0c894b2bc6bdbd6a107e5fb

SHA256
3f3798785c0eba47ca077ba4a8d3fe6f2d6f586c7314278e318b345cc5866abf

SHA512
24566e9dfcae2b4988d4edf5857ebcb9853a5b89a67e3a7be525446563cd8b182979b435d596e4c8b4074a04b0aca0b868d6d2e7c55353a986ac6688988c62c0

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\LogFiles\edb.log
Filesize
512KB

MD5
f005e64c1e4946e7aa7222ab12f1d136

SHA1
b6b7fd3900076c6cc2591e5cfe968b91634eecf4

SHA256
9fb4669bb9ef7e86d1a3a9643743b1b376043e50320982e543abe00b24b78718

SHA512
b4283090d9db32b4014d96ee78da1f6d6eb9e5d0e75e6f00cd330085e04e5f05073c2259da08186329456a0d448c34a9b40d3e405c592247c21442ded9a59ecb

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\ImageStore\nxbitie\imagestore.dat
Filesize
108KB

MD5
295cfd63d0d39476aa288c662b9e0c1d

SHA1
60b7ceb9822b1c3b2c9010c996ad767cb6074d8a

SHA256
597462c36084d24e2df3de829d3c39cb1fca39879c84fedd01a3dadec8a65d81

SHA512
b4ac556b758b21767c1f2efa11301a1cb79324bef2d9b036c13457a0f0b04322e4ccfbc16066216d95910aefef7bccba818b22e28eb3e68fa99f682a65c97905

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Microsoft\Windows\3720402701\2219095117.pri
Filesize
207KB

MD5
e2b88765ee31470114e866d939a8f2c6

SHA1
e0a53b8511186ff308a0507b6304fb16cabd4e1f

SHA256
523e419d2fa2e780239812d36caa37e92f8c3e6a5cd9f18f0d807c593effa45e

SHA512
462e8e6b4e63fc6781b6a9935b332a1dc77bfb88e1de49134f86fd46bd1598d2e842902dd9415a328e325bd7cdee766bd9473f2695acdfa769ffe7ba9ae1953d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF5EC80EE49616AD19.TMP
Filesize
40KB

MD5
4362b954a54beef8a469598c35ae40c9

SHA1
aa277c8f988b2bf9f8ae967055e5b4cb2b24d7a3

SHA256
e3a5382b3b5d8791d67634915ed5bf346ee538b607aedd6af9362cc642ab3b25

SHA512
c55bac0f12a9680f7b9948395d01e017692fec87d6d5ab611870afcba9e811a44ef358543a58c384fcd349aeddb66d37fef9771031db381108f267a25e6e3b3a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Filesize
9KB

MD5
17cf901b57687412c96ad8073e1ba563

SHA1
38fe0780397f789751eb875411d22764e463bc7a

SHA256
f6e69b01bf8a226dc980a2b725929ff3680b4bc6189670b5c3a00bc252f351d9

SHA512
133a885dbb71e48fc5f0a535050fbe826dfc4be1256d942e52e0e8cd44d7ea466308fb3014db24eee9ced9e03dc92b8bf334d841cf5ebd2b6055169aba77acfc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Filesize
10KB

MD5
a876dd94a8b415c9af450b6e5eed2f81

SHA1
7b682b10a23d5d057784dbabb6d8f975d6b217a8

SHA256
68204ce05e60b9afdc2751e7466c3e4e0a40cd3dac8ff7753a0752967569c9e4

SHA512
25fb6f486261e885404fd7e134c5d9ecfe4486206a6973ffb0e3b97ec0f38b7179f37790bbf2b902cf94ccdacf9166091033c091915c860acc697b6b9c3ebce0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\prefs.js
Filesize
6KB

MD5
cdb5a91b7898f75f98e448e80b41dba6

SHA1
c749651f98e32a2320d2e52fd467fd6217660535

SHA256
ed56bd19352777293cf7195af0fe1412d52e25af6a9a8e2bb04e3e32056556dc

SHA512
b99bca03a398f7e068691852106fe03a90489d1e8230720749c25703e59874765ef706e9e27c9215251372efee84d9c9d0eb636a54e45035d5d2095304fee97b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\sessionCheckpoints.json.tmp
Filesize
193B

MD5
2ad4fe43dc84c6adbdfd90aaba12703f

SHA1
28a6c7eff625a2da72b932aa00a63c31234f0e7f

SHA256
ecb4133a183cb6c533a1c4ded26b663e2232af77db1a379f9bd68840127c7933

SHA512
2ee947dcf3eb05258c7a8c45cb60082a697dbe6d683152fe7117d20f7d3eb2beaaf5656154b379193cdc763d7f2f3b114cf61b4dd0f8a65326e662165ccf89cc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
1KB

MD5
a2c1d903cfafb45b9b20a9e387576898

SHA1
7f0f3f47da4767ba540c2edf221b1a0b5ea958e1

SHA256
062a26713a7d2ed5e7a575b67bdc49f7343a07c2b3fb5ba7dfa2ad4d45d50ea2

SHA512
112f31b6be7dd35a61c882d1fb8c3f485f28f18e36faad7212d4472dce68b60437576d561cd34c9ca0f3bedd5feeaf5118c8ad4aa9092ad946b064c2c5569b21

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
1KB

MD5
3628bb497ee8ecc8e3dbf7d9b3b71e5d

SHA1
d3eee7ee318b628468f057420be8d00f301170dd

SHA256
62f812eff5e19a331c465c9af9eae3eb4b96a8dba30216f6904cfb75700c9f6e

SHA512
0d64758f52e64d722478a888a00d3450abc71cb31340659e1c3d9c7d00ff9fd0328743c5e7eedd04ff8dfb8a0f8de71fe787188a6b12de371f1a248007a83d8a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\sessionstore.jsonlz4
Filesize
4KB

MD5
f7e0c1cc8532e0106d308091f92dacae

SHA1
bd90338f9d28f16c02c8ef8e596ae6ce0bafb939

SHA256
0d2e1455bd559608b0edaaa0a5cd345b86b2b448a345b3618dce3c91d84299fc

SHA512
ae2c30a5723fb0ec8623a4db7b0fbbdc8782a393afc11483a5b063eea790a96a7eaa3f2017d2f059155a4745f413fda86eaf4ff253446624b19f1b92ee0ec6f0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize
184KB

MD5
16c8db3f0a558fffc770789a5cd70075

SHA1
5a6f439823dfeeea1c1554e1cce6098ddfd312af

SHA256
4a428bcdd752689338bdf7d13054a7645f614c76f79b032031d33c9a3028ddcb

SHA512
da23637189a6d1f01387bd9b7ee618f501a16b467ee8bc627d529b6de6782c2007b8fc83f7fae4f8a20430bfb9ead9c40c7adafb50d6c3febb39e455869c3017

Download Submit
C:\Users\Admin\Downloads\7z2201-x64.msi
Filesize
1.8MB

MD5
50515f156ae516461e28dd453230d448

SHA1
3209574e09ec235b2613570e6d7d8d5058a64971

SHA256
f4afba646166999d6090b5beddde546450262dc595dddeb62132da70f70d14ca

SHA512
14593ca96d416a2fbb6bbbf8adec51978e6c0fb513882d5442ab5876e28dd79be14ca9dd77acff2d3d329cb7733f7e969e784c57e1f414d00f3c7b9d581638e5

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 816039.crdownload
Filesize
1.8MB

MD5
50515f156ae516461e28dd453230d448

SHA1
3209574e09ec235b2613570e6d7d8d5058a64971

SHA256
f4afba646166999d6090b5beddde546450262dc595dddeb62132da70f70d14ca

SHA512
14593ca96d416a2fbb6bbbf8adec51978e6c0fb513882d5442ab5876e28dd79be14ca9dd77acff2d3d329cb7733f7e969e784c57e1f414d00f3c7b9d581638e5

Download Submit
C:\Users\Admin\Downloads\VIRUS.exe.crdownload
Filesize
267KB

MD5
9b0cc9edfda0b6aa61cf42ee2edcda2c

SHA1
5b54c993d2e89deb1e11c6d04256e6f18514919c

SHA256
159ae873db96ed848b88d5ff0288832ecaee3e33b29029cf02f38b2804727952

SHA512
d1a0bce4606acc109c17c7c39eeda5733e19d5b5c490b0d6d0c46031d29646519c9d97805837a7a664ad54754b8ffae4b8e88252657d1e4502d81c43bdee8afa

Download Submit
C:\Windows\System32\x
Filesize
4KB

MD5
b6873c6cbfc8482c7f0e2dcb77fb7f12

SHA1
844b14037e1f90973a04593785dc88dfca517673

SHA256
0a0cad82d9284ccc3c07de323b76ee2d1c0b328bd2ce59073ed5ac4eb7609bd1

SHA512
f3aa3d46d970db574113f40f489ff8a5f041606e79c4ab02301b283c66ff05732be4c5edc1cf4a851da9fbaaa2f296b97fc1135210966a0e2dfc3763398dfcaf

Download Submit
C:\Windows\System32\z.zip
Filesize
7KB

MD5
cf0c19ef6909e5c1f10c8460ba9299d8

SHA1
875b575c124acfc1a4a21c1e05acb9690e50b880

SHA256
abb834ebd4b7d7f8ddf545976818f41b3cb51d2b895038a56457616d3a2c6776

SHA512
d930a022a373c283f35d103e277487c2034a0b0814913b8f6ec695b45e20528667aa830eeab58e4483d523bd6a755a16a5379095cb137db6c91909a545a19a2f

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Filesize
25.0MB

MD5
957b184dc96dc1fa67b5f2d244e8b2dc

SHA1
58ee60b9d4378a6cabaa632f5b584eac3948d11a

SHA256
2db12254f7d0d31be0b5dc9b805a1fe89ca0a845eddb492215622ddc06a1fb45

SHA512
b405a7074ee6a37ebd67d2d8825ce5e52d72a470ff7b4c4c4b8abc4ff0fb34a4d9a9f175610e5c36fa92dd110b2f5ad9eee153d77bfea0756857f0755de69f1a

Download Submit
\??\Volume{ce598122-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{a8f75b8f-360e-4ab9-83fc-a94001aea750}_OnDiskSnapshotProp
Filesize
5KB

MD5
94fac934e17c7f75309dd5d1fd1c3470

SHA1
37319403fe342abccf3d1383f151c6a0bb1b600f

SHA256
88916967da119e0d691a6138a77617b4e622550aeda0b6c4c65475a265f9789c

SHA512
6d587b3572e9012a6d947655b7be7cf78b060e8d885e704285b1a7fc4489a3870b624287586afa53ad37e92c30ca912ff421ba632e3c1d730f779a20862e2a7e

Download Submit
\??\pipe\crashpad_2128_DYRCPHVJCJULZRWG
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Program Files\7-Zip\7-zip.dll
Filesize
92KB

MD5
c3af132ea025d289ab4841fc00bb74af

SHA1
0a9973d5234cc55b8b97bbb82c722b910c71cbaf

SHA256
56b1148a7f96f730d7085f90cadda4980d31cad527d776545c5223466f9ffb52

SHA512
707097953d876fa8f25bfefb19bfb3af402b8a6a5d5c35a2d84282818df4466feba63b6401b9b9f11468a2189dcc7f504c51e4590a5e32e635eb4f5710fd80b2

Download Submit
memory/5080-4130-0x0000024EFDE60000-0x0000024EFDE62000-memory.dmp

Filesize
8KB

Download
memory/5080-4136-0x0000024EFDE80000-0x0000024EFDE82000-memory.dmp

Filesize
8KB

Download
memory/5080-4104-0x0000024EFD400000-0x0000024EFD402000-memory.dmp

Filesize
8KB

Download
memory/5080-4110-0x0000024EFD550000-0x0000024EFD552000-memory.dmp

Filesize
8KB

Download
memory/5080-4116-0x0000024EFD690000-0x0000024EFD692000-memory.dmp

Filesize
8KB

Download
memory/5080-4118-0x0000024EFD6F0000-0x0000024EFD6F2000-memory.dmp

Filesize
8KB

Download
memory/5080-4122-0x0000024EFD8B0000-0x0000024EFD8B2000-memory.dmp

Filesize
8KB

Download
memory/5080-4126-0x0000024EFD8D0000-0x0000024EFD8D2000-memory.dmp

Filesize
8KB

Download
memory/5796-4047-0x00000137F3140000-0x00000137F3142000-memory.dmp

Filesize
8KB

Download
memory/5796-4050-0x00000137F32C0000-0x00000137F32C2000-memory.dmp

Filesize
8KB

Download
memory/5796-4156-0x00000137F4DD0000-0x00000137F4DD1000-memory.dmp

Filesize
4KB

Download
memory/5796-4157-0x00000137F4DE0000-0x00000137F4DE1000-memory.dmp

Filesize
4KB

Download
memory/5796-4008-0x00000137EE720000-0x00000137EE730000-memory.dmp

Filesize
64KB

Download
memory/5796-4026-0x00000137EE920000-0x00000137EE930000-memory.dmp

Filesize
64KB

Download
memory/5796-4045-0x00000137F3000000-0x00000137F3001000-memory.dmp

Filesize
4KB

Download
memory/5796-4049-0x00000137F3290000-0x00000137F3292000-memory.dmp

Filesize
8KB

Download
memory/6808-4112-0x0000023FCF030000-0x0000023FCF050000-memory.dmp

Filesize
128KB

Download
memory/6808-4135-0x0000023FCF670000-0x0000023FCF672000-memory.dmp

Filesize
8KB

Download
memory/6808-4143-0x0000023FCF6A0000-0x0000023FCF6A2000-memory.dmp

Filesize
8KB

Download
memory/6808-4145-0x0000023FCF6B0000-0x0000023FCF6B2000-memory.dmp

Filesize
8KB

Download
memory/6808-4139-0x0000023FCF690000-0x0000023FCF692000-memory.dmp

Filesize
8KB

Download
memory/6808-4131-0x0000023FCF660000-0x0000023FCF662000-memory.dmp

Filesize
8KB

Download
memory/8012-2515-0x00000000065C0000-0x00000000065CA000-memory.dmp

Filesize
40KB

Download
memory/8012-2479-0x0000000005320000-0x00000000053B2000-memory.dmp

Filesize
584KB

Download
memory/8012-2478-0x0000000005820000-0x0000000005D1E000-memory.dmp

Filesize
5.0MB

Download
memory/8012-2665-0x0000000005470000-0x0000000005480000-memory.dmp

Filesize
64KB

Download
memory/8012-2477-0x00000000008A0000-0x00000000008E8000-memory.dmp

Filesize
288KB

Download
memory/8012-2492-0x0000000005800000-0x0000000005812000-memory.dmp

Filesize
72KB

Download
memory/8012-2487-0x0000000005470000-0x0000000005480000-memory.dmp

Filesize
64KB

Download
memory/8012-2482-0x0000000005270000-0x00000000052D6000-memory.dmp

Filesize
408KB

Download
memory/8160-4343-0x000001E8B3280000-0x000001E8B32A0000-memory.dmp

Filesize
128KB

Download