bea34078c360c71fcadc1a86ebd397d081f0d589913ad43970c1a3983231f522

Analysis

max time kernel
1799s
max time network
1803s
platform
windows10-1703_x64
resource
win10-20230831-en
resource tags

arch:x64arch:x86image:win10-20230831-enlocale:en-usos:windows10-1703-x64system
submitted
04-09-2023 17:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NordVPNSetup.exe
Size

1.7MB
MD5

59cb69a08fdd9cb4b0539e3356df1d4d
SHA1

0c773a0a76f821780c002d527bee387b98904569
SHA256

bea34078c360c71fcadc1a86ebd397d081f0d589913ad43970c1a3983231f522
SHA512

51d4f3d396d183bc5dcaaa0a26cf024fade9b5e5c0e73e1d2ee7663ba26bc55e799beb488d5bab8d8252147b33df6ea1209ebd730124a919940e899758842ec2
SSDEEP

24576:u7FUDowAyrTVE3U5Fg23TD2D+Fz3ifFUwo433RfFcdnOtksSm:uBuZrEUWq0t9D7l

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

DVFStyler.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000\Control Panel\International\Geo\Nation	DVFStyler.exe

Executes dropped EXE 4 IoCs

Processes:

NordVPNSetup.tmpis-9L8B4.tmpDVFStyler.exeDVFStyler.exe

pid process

4852 NordVPNSetup.tmp
8 is-9L8B4.tmp
3060 DVFStyler.exe
1520 DVFStyler.exe
Loads dropped DLL 4 IoCs

Processes:

NordVPNSetup.tmpis-9L8B4.tmp

pid process

4852 NordVPNSetup.tmp
4852 NordVPNSetup.tmp
4852 NordVPNSetup.tmp
8 is-9L8B4.tmp
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
4852	NordVPNSetup.tmp
8	is-9L8B4.tmp
3060	DVFStyler.exe
1520	DVFStyler.exe

pid	process
4852	NordVPNSetup.tmp
4852	NordVPNSetup.tmp
4852	NordVPNSetup.tmp
8	is-9L8B4.tmp

Drops file in Program Files directory 64 IoCs

Processes:

is-9L8B4.tmp

description	ioc	process
File created	C:\Program Files (x86)\DVFStyler\objects\is-1I6P4.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\transitions\is-75PVG.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\data\is-2BUCJ.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\unins000.dat	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\buttons\is-G99OG.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\buttons\deprecated\is-3PO8H.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\objects\is-59EM1.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\objects\is-BQF4C.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\objects\is-VM3GQ.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\bin\is-QNRQ7.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\bin\is-0MJ17.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\buttons\is-KV9LU.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\buttons\deprecated\is-LR2O5.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\bin\German\is-E6D2J.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\buttons\is-E636P.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\buttons\is-NF40Q.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\buttons\deprecated\is-HGNPE.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\is-VE8HA.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\bin\is-KI6GG.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\bin\is-FL9KG.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\bin\is-K83KT.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\objects\deprecated\is-47D38.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\objects\deprecated\is-FUVMV.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\objects\deprecated\is-5QH6Q.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\bin\is-04JTG.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\buttons\is-A0AEN.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\buttons\is-Q10TO.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\buttons\is-HGT9U.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\bin\is-6CTB1.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\buttons\is-7STR1.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\buttons\deprecated\is-R8VH6.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\buttons\deprecated\is-SPBBB.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\objects\deprecated\is-VMSRE.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\bin\is-B5SU3.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\buttons\is-E4JFB.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\buttons\deprecated\is-5KI6B.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\buttons\deprecated\is-5OO2J.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\is-QFG1E.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\objects\is-5IRNK.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\data\is-63K0D.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\is-OB4HO.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\bin\is-UHKND.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\bin\is-QRUE5.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\buttons\deprecated\is-62637.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\transitions\is-CCIT6.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\transitions\is-S08CD.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\bin\is-EHP15.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\buttons\is-SE1CN.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\buttons\is-2A4GV.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\buttons\deprecated\is-0109V.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\buttons\is-7RUHG.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\buttons\is-2CHPA.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\transitions\is-S4V76.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\buttons\is-JBQ75.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\objects\is-QLP8B.tmp	is-9L8B4.tmp
File opened for modification	C:\Program Files (x86)\DVFStyler\bin\DVFStyler.exe	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\bin\is-J1NO1.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\buttons\is-LAJJU.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\buttons\is-KESIO.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\buttons\is-BLRGV.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\transitions\is-8QM3S.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\data\is-TK4LP.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\bin\is-1MRCO.tmp	is-9L8B4.tmp
File created	C:\Program Files (x86)\DVFStyler\bin\is-E1BJT.tmp	is-9L8B4.tmp

Drops file in Windows directory 4 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 39 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
196	3060	WerFault.exe	DVFStyler.exe
4512	3060	WerFault.exe	DVFStyler.exe
4472	3060	WerFault.exe	DVFStyler.exe
2904	1520	WerFault.exe	DVFStyler.exe
1020	1520	WerFault.exe	DVFStyler.exe
4592	1520	WerFault.exe	DVFStyler.exe
4316	1520	WerFault.exe	DVFStyler.exe
4964	1520	WerFault.exe	DVFStyler.exe
4440	1520	WerFault.exe	DVFStyler.exe
4164	1520	WerFault.exe	DVFStyler.exe
4784	1520	WerFault.exe	DVFStyler.exe
2636	1520	WerFault.exe	DVFStyler.exe
4116	1520	WerFault.exe	DVFStyler.exe
4152	1520	WerFault.exe	DVFStyler.exe
388	1520	WerFault.exe	DVFStyler.exe
764	1520	WerFault.exe	DVFStyler.exe
2096	1520	WerFault.exe	DVFStyler.exe
1688	1520	WerFault.exe	DVFStyler.exe
1804	1520	WerFault.exe	DVFStyler.exe
2924	1520	WerFault.exe	DVFStyler.exe
4544	1520	WerFault.exe	DVFStyler.exe
1388	1520	WerFault.exe	DVFStyler.exe
1220	1520	WerFault.exe	DVFStyler.exe
4876	1520	WerFault.exe	DVFStyler.exe
5108	1520	WerFault.exe	DVFStyler.exe
4544	1520	WerFault.exe	DVFStyler.exe
2724	1520	WerFault.exe	DVFStyler.exe
4544	1520	WerFault.exe	DVFStyler.exe
5164	1520	WerFault.exe	DVFStyler.exe
5248	1520	WerFault.exe	DVFStyler.exe
5360	1520	WerFault.exe	DVFStyler.exe
5500	1520	WerFault.exe	DVFStyler.exe
5712	1520	WerFault.exe	DVFStyler.exe
5908	1520	WerFault.exe	DVFStyler.exe
6032	1520	WerFault.exe	DVFStyler.exe
6056	1520	WerFault.exe	DVFStyler.exe
6116	1520	WerFault.exe	DVFStyler.exe
5296	1520	WerFault.exe	DVFStyler.exe
5408	1520	WerFault.exe	DVFStyler.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

browser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies data under HKEY_USERS 1 IoCs

Processes:

chrome.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\www.bing.com	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 011f5eadc0dbd901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "423"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "604"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\yandex.ru\NumberOfSubdomains = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\yandex.ru\Total = "33"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "1203"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "12"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\yandex.ru\Total = "12"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\disk.yandex.ru\ = "1945"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 93fd27b3c0dbd901	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\bing.com\ = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\NextUpdateDate = "400268404"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = cae9e8b2c0dbd901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "652"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\disk.yandex.ru\ = "9"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 3	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\Total	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "132"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\Total\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "3495"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 9fb6e7a6c0dbd901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 4	MicrosoftEdge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

chrome.exechrome.exeDVFStyler.exepowershell.exepowershell.exe

pid	process
4768	chrome.exe
4768	chrome.exe
820	chrome.exe
820	chrome.exe
1520	DVFStyler.exe
1520	DVFStyler.exe
1520	DVFStyler.exe
1520	DVFStyler.exe
5140	powershell.exe
5140	powershell.exe
5176	powershell.exe
5176	powershell.exe
5176	powershell.exe
5140	powershell.exe
5176	powershell.exe
5140	powershell.exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

MicrosoftEdgeCP.exe

pid process

1984 MicrosoftEdgeCP.exe
1984 MicrosoftEdgeCP.exe
1984 MicrosoftEdgeCP.exe
1984 MicrosoftEdgeCP.exe
1984 MicrosoftEdgeCP.exe
1984 MicrosoftEdgeCP.exe

pid	process
1984	MicrosoftEdgeCP.exe
1984	MicrosoftEdgeCP.exe
1984	MicrosoftEdgeCP.exe
1984	MicrosoftEdgeCP.exe
1984	MicrosoftEdgeCP.exe
1984	MicrosoftEdgeCP.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

Processes:

chrome.exe

pid	process
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

NordVPNSetup.tmpchrome.exe

description	pid	process
Token: SeDebugPrivilege	4852	NordVPNSetup.tmp
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

Processes:

chrome.exe

pid	process
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe

Suspicious use of SendNotifyMessage 25 IoCs

Processes:

chrome.exe

pid	process
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

pid process

4548 MicrosoftEdge.exe
1984 MicrosoftEdgeCP.exe
3180 MicrosoftEdgeCP.exe
1984 MicrosoftEdgeCP.exe
5136 MicrosoftEdgeCP.exe

pid	process
4548	MicrosoftEdge.exe
1984	MicrosoftEdgeCP.exe
3180	MicrosoftEdgeCP.exe
1984	MicrosoftEdgeCP.exe
5136	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

NordVPNSetup.exechrome.exe

description	pid	process	target process
PID 1544 wrote to memory of 4852	1544	NordVPNSetup.exe	NordVPNSetup.tmp
PID 1544 wrote to memory of 4852	1544	NordVPNSetup.exe	NordVPNSetup.tmp
PID 1544 wrote to memory of 4852	1544	NordVPNSetup.exe	NordVPNSetup.tmp
PID 4768 wrote to memory of 3240	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 3240	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2180	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2180	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2180	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2180	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2180	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2180	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2180	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2180	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2180	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2180	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2180	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2180	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2180	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2180	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2180	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2180	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2180	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2180	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2180	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2180	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2180	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2180	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2180	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2180	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2180	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2180	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2180	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2180	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2180	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2180	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2180	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2180	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2180	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2180	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2180	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2180	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2180	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2180	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2120	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2120	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2720	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2720	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2720	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2720	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2720	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2720	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2720	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2720	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2720	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2720	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2720	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2720	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2720	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2720	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2720	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2720	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2720	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2720	4768	chrome.exe	chrome.exe
PID 4768 wrote to memory of 2720	4768	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe
"C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1544

C:\Users\Admin\AppData\Local\Temp\is-2AB3S.tmp\NordVPNSetup.tmp
"C:\Users\Admin\AppData\Local\Temp\is-2AB3S.tmp\NordVPNSetup.tmp" /SL5="$C01E8,890440,866304,C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4852

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4768

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ffdd2fc9758,0x7ffdd2fc9768,0x7ffdd2fc9778
2⤵
PID:3240

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1928 --field-trial-handle=1744,i,13026709976151028879,12440217400867570879,131072 /prefetch:8
2⤵
PID:2120

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1688 --field-trial-handle=1744,i,13026709976151028879,12440217400867570879,131072 /prefetch:2
2⤵
PID:2180

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2104 --field-trial-handle=1744,i,13026709976151028879,12440217400867570879,131072 /prefetch:8
2⤵
PID:2720

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3004 --field-trial-handle=1744,i,13026709976151028879,12440217400867570879,131072 /prefetch:1
2⤵
PID:4932

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2996 --field-trial-handle=1744,i,13026709976151028879,12440217400867570879,131072 /prefetch:1
2⤵
PID:5044

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4428 --field-trial-handle=1744,i,13026709976151028879,12440217400867570879,131072 /prefetch:8
2⤵
PID:3492

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4588 --field-trial-handle=1744,i,13026709976151028879,12440217400867570879,131072 /prefetch:1
2⤵
PID:4108

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4784 --field-trial-handle=1744,i,13026709976151028879,12440217400867570879,131072 /prefetch:8
2⤵
PID:5068

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4412 --field-trial-handle=1744,i,13026709976151028879,12440217400867570879,131072 /prefetch:8
2⤵
PID:2060

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4540 --field-trial-handle=1744,i,13026709976151028879,12440217400867570879,131072 /prefetch:8
2⤵
PID:3740

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4820 --field-trial-handle=1744,i,13026709976151028879,12440217400867570879,131072 /prefetch:8
2⤵
PID:5004

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 --field-trial-handle=1744,i,13026709976151028879,12440217400867570879,131072 /prefetch:8
2⤵
PID:956

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3812 --field-trial-handle=1744,i,13026709976151028879,12440217400867570879,131072 /prefetch:1
2⤵
PID:4972

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4808 --field-trial-handle=1744,i,13026709976151028879,12440217400867570879,131072 /prefetch:1
2⤵
PID:4396

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5128 --field-trial-handle=1744,i,13026709976151028879,12440217400867570879,131072 /prefetch:1
2⤵
PID:2636

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4776 --field-trial-handle=1744,i,13026709976151028879,12440217400867570879,131072 /prefetch:8
2⤵
PID:2920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=4548 --field-trial-handle=1744,i,13026709976151028879,12440217400867570879,131072 /prefetch:1
2⤵
PID:4220

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5472 --field-trial-handle=1744,i,13026709976151028879,12440217400867570879,131072 /prefetch:1
2⤵
PID:3420

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5712 --field-trial-handle=1744,i,13026709976151028879,12440217400867570879,131072 /prefetch:1
2⤵
PID:1356

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5812 --field-trial-handle=1744,i,13026709976151028879,12440217400867570879,131072 /prefetch:8
2⤵
PID:4316

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6012 --field-trial-handle=1744,i,13026709976151028879,12440217400867570879,131072 /prefetch:8
2⤵
PID:3472

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=6384 --field-trial-handle=1744,i,13026709976151028879,12440217400867570879,131072 /prefetch:1
2⤵
PID:2060

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=5812 --field-trial-handle=1744,i,13026709976151028879,12440217400867570879,131072 /prefetch:1
2⤵
PID:2228

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=3076 --field-trial-handle=1744,i,13026709976151028879,12440217400867570879,131072 /prefetch:1
2⤵
PID:3176

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5888 --field-trial-handle=1744,i,13026709976151028879,12440217400867570879,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:820

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 --field-trial-handle=1744,i,13026709976151028879,12440217400867570879,131072 /prefetch:8
2⤵
PID:204

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6992 --field-trial-handle=1744,i,13026709976151028879,12440217400867570879,131072 /prefetch:8
2⤵
PID:3756

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=6952 --field-trial-handle=1744,i,13026709976151028879,12440217400867570879,131072 /prefetch:1
2⤵
PID:2752

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=4416 --field-trial-handle=1744,i,13026709976151028879,12440217400867570879,131072 /prefetch:1
2⤵
PID:5816

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2628

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4420

C:\Users\Admin\AppData\Local\Temp\Temp1_setup-bffRhVDadOf8.zip\setup-bffRhVDadOf8.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_setup-bffRhVDadOf8.zip\setup-bffRhVDadOf8.exe"
1⤵
PID:1196

C:\Users\Admin\AppData\Local\Temp\is-7HS1H.tmp\is-9L8B4.tmp
"C:\Users\Admin\AppData\Local\Temp\is-7HS1H.tmp\is-9L8B4.tmp" /SL4 $50312 "C:\Users\Admin\AppData\Local\Temp\Temp1_setup-bffRhVDadOf8.zip\setup-bffRhVDadOf8.exe" 7601538 52224
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:8

C:\Windows\SysWOW64\net.exe
"C:\Windows\system32\net.exe" helpmsg 3
3⤵
PID:956

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 helpmsg 3
4⤵
PID:5016

C:\Program Files (x86)\DVFStyler\bin\DVFStyler.exe
"C:\Program Files (x86)\DVFStyler\bin\DVFStyler.exe"
3⤵
- Executes dropped EXE
PID:3060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 900
4⤵
- Program crash
PID:196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 928
4⤵
- Program crash
PID:4512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 232
4⤵
- Program crash
PID:4472

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /F /TN "DVFST-94"
3⤵
PID:2828

C:\Program Files (x86)\DVFStyler\bin\DVFStyler.exe
"C:\Program Files (x86)\DVFStyler\bin\DVFStyler.exe" f73f2bee7f334fb5f766d4efd4478608
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 880
4⤵
- Program crash
PID:2904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 864
4⤵
- Program crash
PID:1020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 920
4⤵
- Program crash
PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 1028
4⤵
- Program crash
PID:4316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 1072
4⤵
- Program crash
PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 988
4⤵
- Program crash
PID:4440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 1092
4⤵
- Program crash
PID:4164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 1248
4⤵
- Program crash
PID:4784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 1216
4⤵
- Program crash
PID:2636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 1208
4⤵
- Program crash
PID:4116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 1224
4⤵
- Program crash
PID:4152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 1636
4⤵
- Program crash
PID:388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 1616
4⤵
- Program crash
PID:764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 1596
4⤵
- Program crash
PID:2096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 1596
4⤵
- Program crash
PID:1688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 1624
4⤵
- Program crash
PID:1804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 1956
4⤵
- Program crash
PID:2924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 2120
4⤵
- Program crash
PID:4544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 1912
4⤵
- Program crash
PID:1388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 1820
4⤵
- Program crash
PID:1220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 2116
4⤵
- Program crash
PID:4876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 1916
4⤵
- Program crash
PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 2096
4⤵
- Program crash
PID:4544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 1612
4⤵
- Program crash
PID:2724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 1676
4⤵
- Program crash
PID:4544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 924
4⤵
- Program crash
PID:5164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 1820
4⤵
- Program crash
PID:5248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 1668
4⤵
- Program crash
PID:5360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 2068
4⤵
- Program crash
PID:5500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 2140
4⤵
- Program crash
PID:5712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 1904
4⤵
- Program crash
PID:5908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 1680
4⤵
- Program crash
PID:6032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 1340
4⤵
- Program crash
PID:6056

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\OY7FLydO\NVfSlv.exe"
4⤵
PID:6092

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\OY7FLydO\NVfSlv.exe"
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:5140

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\fLWUzBAt\7ceLE20ztEglbH1HIJJw.exe"
4⤵
PID:6108

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\fLWUzBAt\7ceLE20ztEglbH1HIJJw.exe"
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:5176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 1340
4⤵
- Program crash
PID:6116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 2328
4⤵
- Program crash
PID:5296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 2160
4⤵
- Program crash
PID:5408

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4548

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4244

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:1984

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3180

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5012

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5688

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5136

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5400

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5560

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5288

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:3472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\DVFStyler\bin\DVFStyler.exe

Filesize
4.3MB

MD5
561e65fd77ef360c6ea8f4b8a33b7f45

SHA1
763d89d774ca837586cb54d2cc97ba10ac787df7

SHA256
5d559eda74651da91f8f3a2035c20c1fb1de0fd30b51793c6bcd932031246562

SHA512
db07ed34ef5e5953d0b507f44737a953b044c31b6038dfca593bdeb9376c2ab74c6cd8b957774083fd7676ff083dd0f0ad2cb056ede99653e10445387bd3003c

Download Submit
C:\Program Files (x86)\DVFStyler\bin\DVFStyler.exe

Filesize
4.3MB

MD5
561e65fd77ef360c6ea8f4b8a33b7f45

SHA1
763d89d774ca837586cb54d2cc97ba10ac787df7

SHA256
5d559eda74651da91f8f3a2035c20c1fb1de0fd30b51793c6bcd932031246562

SHA512
db07ed34ef5e5953d0b507f44737a953b044c31b6038dfca593bdeb9376c2ab74c6cd8b957774083fd7676ff083dd0f0ad2cb056ede99653e10445387bd3003c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008

Filesize
20KB

MD5
c7e77839bcd7aa1833de6bc7c77d4925

SHA1
77309d54b5e10983b24b5f501010943bc0472f52

SHA256
589fc83a55fbb355ad1278fb879244a65b4ee56e39b29b4f0b009c8783cee4ca

SHA512
d01e768e8a004f080053d38958c943ef5728f9c2d41ec881fbf632c99a2b5279b5b3b234817cbc5636ce7a4b616b7cd8640473ad4a873ca985271bdad05bbad9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009

Filesize
94KB

MD5
c3a6ed892fbaee07bad20818739ad44f

SHA1
e556ca2fc860b6cba70e46672972b881e11d7b7c

SHA256
4a620842435f3641e46ef5ebe55aec696a127a42d807624847c0a54f949620cf

SHA512
c71495ad1382b34d7af7fb9cd52bed4e71bc83f39e3fc86e48af97360e1b925f27c36f040e92a29355db86dea51d8b32689b6ea5ad5d87fc058938ce05ef2630

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a

Filesize
73KB

MD5
9a6de9dfcc352c551efc9e2f4cf2796c

SHA1
61f3a45ea6dac605d39335edc1a1332e3cb342a0

SHA256
fc2db666b1d74ee057f091dac4ff1c162ba121e2c9703a9ebe6ba4ec1e0f44d8

SHA512
8c837e6cc297eedd31fec626541673cee3c261da93e5c91023e5bfbf8e6e293577a684749d96ab0fbb129e5ea7c184b40cbd1bb4cde1f08c2f7b177231b9ab61

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b

Filesize
37KB

MD5
e08be6d5d433944f7ad52902e4d24db5

SHA1
e2600c1d60d12d397b3ee44411a021231d71e974

SHA256
450f3ba4e47ee174bd9692b396f264b907d37d2528f53911760f3d0edb785f7e

SHA512
9c8de3a1e131cffd6ac63691e6a514d35d978570b9ce63a6861e1ccdb34d3621bfedcd2337ba3854df0f636e5b3d8c490f126e81641cffd20eaa23a976e39f06

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000012

Filesize
42KB

MD5
515bb19e20f06bcc2cfa88bab5cf3dae

SHA1
6539d10064ebdbdd17a5e82f31a36ff1b0649493

SHA256
0d6b3de0a6a9d82dda755992b81212ac17414bc623d3b81f38b1208a0380231e

SHA512
d5abb0aaa52d87e58d780edc27ffbc3c7f10fb1c9b83590938f04753afe9c4ecdb57234aba0a3a84a231732b5e8bd8ae3276c0e314b0bd6a3b1a3b6e28bf90c7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014

Filesize
58KB

MD5
9d67122d645639fd678312b14e213758

SHA1
83044457ed92e75d21dff22dd6a1b88f1e7c3e52

SHA256
f89e2054c761153b57cdb5925a886b0bf1b3ba88b4db41757f73100a04db8656

SHA512
cc11f7869a45c84ee573f7ec74418d33b2ea1028c1ea835e0b0ff0880119d6808064dff540920bdf7b60aa1898e1b0d555eb7a28697a44fa6e07db5f966991f2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015

Filesize
42KB

MD5
f8883ab9c4a452a0bfe3c5cf9619db86

SHA1
29104a6e1efdd389f07f0f3e1730de95746967da

SHA256
427f528f5d190e0e3275d8a1fc40bad36fede3da064b33f29dc8fe6e614ff2f7

SHA512
f6c2211dd8bc6824ff179eb48e2d1056c5aeb2ed064a13121a69edc8cd256a8c5f4add0e91b28cc72d1db2cec73d64cadb552bf76ac58a4f765b64555e8a4598

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017

Filesize
44KB

MD5
5e725876afc3f9b5eb47fd7577948ed0

SHA1
fce729ab7efa55525d47968322ae1691f585e868

SHA256
e74d491cb6d444a8845ed5da956030c3f9a9ad7ddaa8eea241a350339917eea5

SHA512
c2550ab9fb00c16fa6d87166cd16d88212a081e82646489b69b31c24d8ac69c1024ef30ccef20a9751f949c7cb679e28c3c25a947e8cd338616d193b569c6e81

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019

Filesize
85KB

MD5
81971b73ad3b5ac1da8c314b99a5e44a

SHA1
79cb7971230bea7349066f6fd7cc7c6243faa3df

SHA256
1891ceeb2017a77f5ff3c7991f26af81312ed8c677a7b1a2608a5ff1622e16ce

SHA512
ababdcfa556dc4e2212cfca44afd767bbf9e34b0e0b2cb31784776b5923523bfd3568e9a03e97910d54f113072abd46535f37f34839b913c6141e73194d74495

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001a

Filesize
25KB

MD5
b0b7c8d877d0134e2852cfeddbf317c5

SHA1
8276db56cb7472bc6abb0c09ea9672b69d459556

SHA256
d1bd8e1d34083f0d81a68acc7024028cb6fec0a9c6d4cf311ec1b1dd6ce5598c

SHA512
14df115cc8204e1effdc2869e7d91642324e73a465edbec5ff8697f18cd338b6477148976418892af304a6a2b59bb43a98957d5302671d09b009ea26124471e0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b

Filesize
25KB

MD5
7f0cdaf91230f9789ca4162aedff612e

SHA1
965de571aa794dab64076c3cc64dc8894b843f23

SHA256
033696b7f1ac04d1dcc102be84550e146236ceffc25a6cabc12aa51a6ee410b9

SHA512
444460846fa2bfddd7990c792c6fd8389c564b5c967b5cc10fb3717117c5424fa33f23f8c4cffefad176016a79be5557920908cc82f7942700a0fac71eefde36

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001c

Filesize
118KB

MD5
bc24b5646a260e4e580b4b61c09e9eb8

SHA1
62d809e50eb4f168a81937eb25dc05ef05ae5a42

SHA256
18899cb45318f64c82cad227eb205e9a0d58df39704a74f6194c0b9c68556b4b

SHA512
55508108dcd72f25d086d388463564e3eac725c8fc9b05e9d9adc95f0d97b8f87fe4bf6d97a48a78c74515d2c6ecdd88585128a8443bc793fd9d36fcfa0951a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001e

Filesize
38KB

MD5
2693a4c7b8e116437175dafe875a454f

SHA1
184469c3697195f72da903efcac4d03ff2e93019

SHA256
b98292d04544d0851572898687f10d8c3a5447f38dfc8473f79a3a7764bf4126

SHA512
a540582289b9f0fbdd435353056f148c4b5e648a731a328c42ec99e00385a71ddb43e656bff5dbe2c979e1989223a8c6989ba3f82ad43bc32af65941792e2174

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000024

Filesize
116KB

MD5
addd18d95c8f3bb34cb8a324b07540f5

SHA1
35babd1093d53eed71facfcdfe1cd8916728c636

SHA256
81f2f0f37bd5f00ec9f967ab53d27d14cbbce3b3704e6b69fc1b0fe88ab5217b

SHA512
d2d81a2f30488557116cc4c7a1f33d3da2197fcddcd8fe7c305d2c98e9c1d5343a47ac53cfae503f053e7b5756781f66051249ac6604ba135b0b497aef0dbe38

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000026

Filesize
395KB

MD5
b8fc1663cde26c42bfc82c531e4052af

SHA1
d68d3d437a5bf212d67023d6488b3f6b13cff590

SHA256
2b1de7c423beec1e1582098dcfcf3e38d475f54d064b0ad96906dce92e3b41dd

SHA512
b8e81691204f74fe21e6fda4076492521eb655b5a268dfbac9e39670049bdc6f5f46485ebe0e37339d4a43422ba6b71b13f18a4a7e7f90c83f47f2c6a7da7f7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000039

Filesize
141KB

MD5
59a3eb110fd5d52524ae3976547870ea

SHA1
8d594f14e28bcfb4b3a9cdaa792fdfbf86547d2b

SHA256
c8d4692013ceb276349bfa7a3d5406ab2cd16e09d039e034f1f8627a7e552e70

SHA512
49b6a6f63765321e9fa1d73c350d7ef963c8d25b483ef5eab4dfb973a87b2069b767b3649bfab453d5ae77d6bdf5a4d3066c516b253db6d19af4b407e15736b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000040

Filesize
17KB

MD5
50fe6a52819bcf0d9dfc7940b2abc255

SHA1
eed398a389b79805ab3cc736a2e4d51f9b6760b0

SHA256
1228b5a81b3509894e25d2fb1e6423c1a4697d7b427ab60282468e7cce2339cf

SHA512
6fb5c6da9a610bcd93f75383bbb80851d27916d964be9bc05dc35ad79543d4e3f7360cd88a9ec12f9d4d73ed83425b80ea9307f122818fbbb9d92f1df6048862

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\24c163822538203d_0

Filesize
215KB

MD5
584fa10784c8ad1fe06133cd18009ef9

SHA1
d2d3add6c47c3b3996cb02fa4f7083b1567854b1

SHA256
2d229d0ea53bd3209df64cda18c514750fd03a02e05c4445bf2a8cb8448a8a2d

SHA512
6f89ba2587d5d69ff8e1a7b621fab227feaaa3cf6b06a4ce313fb9da8f23169ae6b74ccb931de5a27f3f9f13b00672ada53e2481898d74ff080eaf11f7fdf4d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\d87681cda2787910_0

Filesize
241B

MD5
6e0c898a2dfa4b0513c19b46b0768208

SHA1
eebc97ec835ab09c2a1acce4b95cd9f55a5fccdc

SHA256
3c77a882189547da1f5324da6e2e9290d4b9d97a853b537fdb34049a512dae37

SHA512
cbfc837217e948af73d21ef0895b5533bf82f63b9a6e092f1ee4a5d35ff169dc52a3e0bb7eb80e460e84adf4f1b1e30a814d0073d945b5924b845677106db7fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
751d8ef411bcc7d0f3c112a0c80224e5

SHA1
098f4d5228b9f6e55b4dab8b23e82c034f6a3c48

SHA256
ed1750a8eddf5ef7a295be54a7f3d1eac3a5ef5ccae342969d2734ee738bfb20

SHA512
8ecf4682d855e22678fc97627f34a9a4704c5a11ce51b34d5fc606497e051e6eb9ac6ad4d20482635ed969f090ee82edc65984317baa3865617588969aeca305

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
c5d487bfdf827fb561d3f6be61038457

SHA1
b4c9171de1dd918dd6efc542f3c1449da7aec653

SHA256
51e4486ff5a82a568b938e84c93111a0e818ee0477380e0a81970187585693b1

SHA512
b2665ec8f32d542eb30f6a8256c39487a36a3543e72f675e665b0e4e8bb7324ac6e20d8c459487356460a9ab59189b8a0d523c20c35587ddea47a4d943703791

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
b06f10ecc4c717f23e64daa3a783bf82

SHA1
6c94df8ebb5783e4dca8735fd1eeef9e259f5adb

SHA256
c0c2bc4c8e4196592561e2461f3b6ffd6d424d3d3928f8bc16d47ad18a47ab92

SHA512
56a4fcdbaee4edef946433f2fab3b1c7313baca7c6236d5abb8ee19d9f6fbcfa56b9d9e6f1236be462d2c9a531c9ca60b8c9e45a45ab9703a5e29d5b3075a367

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
5a7c4515f1dbb2fb48b3dd18c61d7e57

SHA1
f0695b2e5a52d59badd49962050461e315ea8083

SHA256
54a038872584c933ae6d61a2372254f1e8c60ed9b2df195d55b6be5c9bd4aec8

SHA512
ba6be5f246181c8c48d76c702cd8594bf3c4a3feb1e83ffe3264b4d3f287b01ddc1dd5141494b9fb05ddb8014d80f74299572c3cde4d947301436bf8bf08ba3f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
fe85b0f5327780f73971e2bd304bbd3d

SHA1
2e3cb7d86e48593762b7b3857f9540c35be9d30e

SHA256
d538e02ad952cc8b1cf15fdf3b223847a1b48eb22c6660b8e6bbc72b05e62c49

SHA512
1022bc17bfedda86b5c0c66d8c35590f2957710a15cee57d5e2681b74fe808206b7608812eec58e788def1cf5008f7385dfad3234e6d6476d5723afebecfbb1a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
2990df36abe13a288f6215d5e5d37353

SHA1
ff9983400654fa8cc909fa8f6f63724407d12dc0

SHA256
c84f6602499206c759fe2093d0b271203a2d6f0ae2646b4e6f3a687ac2f1564b

SHA512
94c3b32280326f35866ec0a062697527bd147c436646b2cc2ccba6e01c28d953076fba2fa61c39d59643dfc2f6b4c50af17df098ce0338e9a63b0c35b5ae438f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\000001.dbtmp

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\860595e1-f2e1-4dd9-b511-88063c564c8c.tmp

Filesize
2KB

MD5
6533c95f85d74536d5671c3d1f195769

SHA1
ced49cc29ddb3d39f0fc7c473f6847200d3c19f6

SHA256
e1a6a6d5bab6b47ec86d8fc3862590bfc378071a369c75a7965b491a8f1af39a

SHA512
0e3a6a6aaefe01ff1c7e5c2db5446e4ad543721ae8548c7ffa560334b1bbceb6fc07a99604a907c7f276200e4fe34784b87bc738cf9b36be20bb163e4b5e3b78

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
861d90bc68c3c268e224a3d195a6a228

SHA1
290bdd9c75ebc831ba644410da6ff15d5d98c725

SHA256
eaa6b9564b6c2e59c14584b9de008b008f9ea194ba89514e83a5e9a99ca0934e

SHA512
27da92fe72e355d0e214a296c9bb0deedbbc7659d4f2cf9e1ce90bc43f41a08a949b24152d3b5497830f736624e4a16281419230d93e6471c4d64db6115e6af7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
bacac63d9e414d0f3f991b6db46bf70c

SHA1
e09774d2b0d68fc46e806560ee3d6db804d25a93

SHA256
e52f06f5c17063ad38192b718ce9a8019252df442848f68653016060fb666e31

SHA512
55fe9cc41de9a017e80e0eccbcdf2cd2e6d35d7d255cd78cac14465257781077998dafbc07660e7c09016a94ed34f7e108e9c4b8f99440dc4fd51379c1fd1c85

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
e3a346d9ad88d861a3c67182f0b7d276

SHA1
8712a5dee33ba4feb0c40a18656697f432e41a7a

SHA256
c57c79eb35dda11a71a2795c1eb059d97a054392f17c2852b6343a091cc6bdf1

SHA512
d3223ec798a786179e3cb23688c2b414f0429d44b13c3a27d4e8f60a50b730bea601a1890a473a2507dc64673b3a16b3f78bad65cb5c57cd8be45bdde6dd6692

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
9d53ac35cc2dbb5bdd0eaed01412d6fb

SHA1
1ee0737d55641d2f348630906689a6d114010349

SHA256
e6d7c211ab7250baf1bab0bf42b2c6df86fb118a10640e479d40136752353289

SHA512
ceb819853bdd76e6f1978222ca282cad6f71a8e813caeb36eef2af9650c5ab1c1b270da5aa21091de0a5caca6a875d049b1ac0bd4518d6835e2398f7391bc878

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
aab96fddd89d982930e2b39b88f1863b

SHA1
178ed5d8303a4754b56957d68b564b0c92f8442b

SHA256
0cf1dc2e7b64052209c5dad78fb9b1d4fed608ce00165a10f552b49aaddce753

SHA512
378383ceecae0ce435ca254925f3108677c811f5a71388e0a5a1ca8a1916522d3dc2cf3742ed3ee00b8bb943becae56828cac9e62a66a6ab6226bdf445f04bed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
875B

MD5
2ae35e2cd9ebce1668c1071f341b4eb6

SHA1
59ba3592cf48e86886e39e897ead6e1c392b311b

SHA256
0bd38edaeb450f60e49e23e0c5e1f3be3691a91c3e2502f4ee3c9de97a2a6cab

SHA512
35ba497e2bd3b6706cf0c05012cbba3413d802b0bc24572234aa1e0f9179ebcfa26026b73e6ee9ba25fe739d0c77ee146790a8029baadf9e523d88767526901f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
875B

MD5
c0098a19413fda5694c6f2a9d4d23f50

SHA1
d6bbad12db2c7de747fb8e73655cd367e06964c6

SHA256
a27d7f975b014aa101a92655d1173961aba8a074fad3e5a5aae76f95a8bed00e

SHA512
c80515cd20872b63b22b5af58510ebc3633bcff31f57cdd01c3debe6523565308c0f6a2ad9fe59607dfb089cdbd10a801e686da1a4dfc6f8f1d5fe5f5fc3d5a7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
81cc29248828f18e4a0c4fe441720a24

SHA1
0bf97e1c513c5fd88bb100f11de008eadbf5178b

SHA256
50a8efeb95958161cc187aae57d3155762442a8e5410ec5b2a24d310b3effe95

SHA512
357e122b1e6aac9f4fd15a98054d7038f6cd8ca35d17779c935a316080b673cae0445220c9f022c3ae4ef8d18b042eba344102bd820f469683a5264d925ad3b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
8dec02dfcdfec6e6e7c448f9c61d57d5

SHA1
3de76e05b87ea81d48c7a0dcc2d2f71585355b62

SHA256
be50f68c1e55c29babd38040efd04835739aebabf52d7d5ff6719f3bf64698b5

SHA512
a96dabe5d20bca74384555401b3ec763b3f651ac5066062e572b33d2028a42b514fe78d7b3fe20f01aa4fad72127fea89fcc8298b8a463e48837ad2d488dcfdd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
d5e24734260c4a3f18ca16363c609d56

SHA1
19377ac6df06f64497a3e9fa0672bf557ae2285b

SHA256
33172685773715f73e8328d2f1c308c901fc93a6bb156a93ac29776112e30b5a

SHA512
ced553847ea33a72b0284e84e21f189e5bf7495ea788425a83e7087ffa0aab29703c676bdc8ce0b092327f8eec9258c02492ca068a6cd49e6da6613607b5d88d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
1470cc72f24b42711e7cc9e00bd45239

SHA1
a7399dd0dbbb4a0dceaba2d51efcdf848746bace

SHA256
61a19f2fe0641c3bb1fa37b88726bf81232a65a849052bea9cd91be0c0b3a9e0

SHA512
9a343c327ac5a4bf7a8b54bc27267ef4c5b63c3a8e1e2d0e27af6e154295b5f7fccdc16a543ab3a84e8fdb3a1fd4a4eda648e529b0883d6cacc19760f711f2ef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
fa0a117c75b2badeea9a7b75f8dd9a9d

SHA1
03c12ab79a90e889c659898ddfab81b97ffe02ea

SHA256
4053baaf1f8df3c2a7dd11959b1251cb302a047fbe99bafe1ccb951ebec86793

SHA512
0ec7126cfdc9d4dc581c96db36ce5eee4ef950f27eb36f5e128f4d0d4c27d0e20a495a6108125a2e50c98b552d4fdaee4f936519be46867cf50dfda2dc1f8b9f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
66d4637a8102cad5672be3d4cbeb83ba

SHA1
3a4f1fa35af4f398579b210b276c473c05c8bffd

SHA256
3afad856d4439e522bb90007f08104a735d66bed289e3769120bd82adacee641

SHA512
56c133819fb297191556837b169ef4a04c90fc02dee4b878e9f0d7ecb959f5abf1bfe34bdd1f0091b639c8ad3f336edb4ad0e6105e065bf8f3c2fdebf98a9481

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
740cd9540067e3b76f045f9fde2db075

SHA1
949ae9c3ed9e241a6ebca1fd1d8de56777e4d472

SHA256
2e24e49ebe375193823d765322536dfdc2d519f05d9e1c453ba0310875283d19

SHA512
4d837f7040daccc77cfd395ba20eed466219b0f34330d49d158ad70a387c170316ba615bb382335799bb59fa19273cdbf58ee872f4731a434c73af85b51f1230

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
c1715bd6663dbe54ac90c464342466da

SHA1
7a2ab2333abc6c3b19d96a531e2cba6de0d221b2

SHA256
3ba2e0e3b6ef836b2d232cb9aef10cf828339aba393056e346d612213b9c8388

SHA512
c5f268fe3a52ce9889fc0857f41935f3bbf64e672f5b88da2b55f0112631dbecbe2909c3d1b2e877e73270e050dd3a86c99e525903824d3ed3a8893d9c387b18

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
f008af6f5bc9789885aa30cc94c0a780

SHA1
e6ccf456c69b5dc926202b9c515fa8e8618734a1

SHA256
ee05fbb4aef570d899b5c80c7e0928514d423dd4fc92966553f4bd2f828fcbe2

SHA512
e576ba58d36883024c446d5a0ec9e312704a124078ec15a955d9df02f74164a4b107d4bdb752baae5f98ecc061f407dda9eda1917a52b3eefd69278cea6b708a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
d595233e81098a6ce4095e4da15bbd84

SHA1
58b00dad11cec73bd667b524eeb2e6d4dd4deada

SHA256
3805989bae21e5c8ffc2f8c381abf10c223a10dd46d130ea24f7609c8c6deb57

SHA512
41b1e9166e89be63ff4bbbb10d77334171b74b409f3fa55a6822d5638b20c5368e3384ff9b3df471906cff60c25ef1aaf8d2fc1996573e0691fe4b3ba63a2b57

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
c797c643d265c3c9ca26c172c422e1a0

SHA1
1c1cc5cf2795c5c9fd5ca51e9729c25dc42feeb7

SHA256
ff73c96442e30998b97c8348e565952a504c05b8a247b3311428808cd80c001a

SHA512
efd1f12d522905098ef4e3c1f316596be52232797bc5e800c0d51a2b991115304c3999c1008709c2a9edd2c724b718a4634611eef9b21ff56fadc1e43adb4de9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
e713167eb28d380b30d91c0554ab3711

SHA1
1316d8563d82bdfba0499ae3a5cc74fe4e7ae5e4

SHA256
acee3f0615ae22dfebd8117294c6b0af4bae16bfb5fdb9137b0a5b1f8b0ab95d

SHA512
44d72d35cbfc68c06a81419e92df50116360457f027fd1c22fb7bbd651eb060ab2ce23638ef24ea95b6457d4222fa39c9264d6063c86fe800786ebf79b154f29

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
954be1e8422f3278911eabdbd2b99e43

SHA1
833b65b7e5d8cbdf949645f3188c6d7109b635bc

SHA256
624e0350569d19dd17fa47d5e2f6cf19ad0cc4b153b31f01ec8c49609180d947

SHA512
9b64c3d1d7d2f2dbde7521662ec53133722295f5e4cb86c4f24675fda503fa71e14e470b2801c4f5de816ecf7234c395f2a9776ac27ec094d9085d9e28aa32bf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
4e8b465d9f4c2fb10f67f3b5ca8d8d0a

SHA1
5f6bc5455ee50f6a058ddb9510becd085ebac962

SHA256
e603e329cc4f50a5836a71cf0ccdd8746eab6b4a75009fe3243d73a0dc1ef9e2

SHA512
765f8174dba973032bf2abbba219a034c7fd4825945bfbd5747290c3407ef0e4eb6496c030069db553dd743a3403826f1f5f316f6e30d9bb419c318f04d91969

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
824bfb6a03483c3dfdfcb073df233a31

SHA1
4f0691255405a564e9df58645ce670cf91e3ce19

SHA256
62a92851eac6ef67296866c5a13fd0be37b7aef1172d11eaf8ace92befcbe95f

SHA512
598a5d9f25206745f423c4e954c8ddf4227bf04a0cf12146b1e70cb8411efb9e29701d5b784ed6f2bd87227ae0182fa72480124606c04e39bfa5cf83b0cc1007

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a2233f45-10f8-4177-9253-d4d520367237.tmp

Filesize
2KB

MD5
26701472e4fad1bca513562b4baf9815

SHA1
54cbf8fc8d9e9b41a40d00b824ead41bf00172be

SHA256
6f4a4b78cfa18936b040ee77850642818ca7aa88b1dc4b86b5e670174f333e59

SHA512
429302c1e6f0587951820e3519415d8d33c31238b23714aa1651a8b62df37657a14a50c6ad868d0bb28c53c7ffecacd0b4c0630cf1da800b31362dd1dda1fa7d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
242bac49d7ad502cf33091a4ce34f66c

SHA1
dadf9393f175b58e1129b90226fb1689e9d01181

SHA256
ba1ad22c09839fe54d084597f36d54a27f94a3c3d7df0490f99d0253baf9e7ed

SHA512
64b480fd3f55ea8d4a568bfa92e2f88d7dfc0174390ed9cdaca34b1a1668c471b2f4b35eadb7c0f2f558cc66ae0cc93998409e03e2cb9907ff5af0e119b9c749

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
67c4946a99d766d356774354c3e78024

SHA1
e2b6a671e70bf38be3296830127d49fd762c41d2

SHA256
bf61a9c939d1cbe68fc2642137296ce63451eabbed75ca9d93ce754f3fdeb42a

SHA512
ff32fbaa2e0e7bae8f49c3368f9f706c7b6b9f70d0d8d8c5463dcd7b70a52deb9cf4102b1cc95626f6d39e43ada6c252175437ebd0b48e20ca89aefaf607a712

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
0479dfc924c9f2f3f2962fe763b3f42e

SHA1
f48df8cd23e52372ffb1c9911f6735c1b3420fb5

SHA256
6a197107005aee5d80ce9e2a720f13ba1f097ce941f411a5090c221ebfc894db

SHA512
882d44dc03c6ec0c7f72004daf993f95fc0741dc9014a87101de132c1865f624a67b755c0f84db7302476fb00fd58d0375813399eec0162c93623559f84b5ecd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
26d4f64a1615d03c059b94a3b12f6d7f

SHA1
775cbfe6c4b06902be93f68813fe39a0b2eb3397

SHA256
9ffbb67618917b8f970e9c15b187f9cb72a9ef9dfd10240013ed52a22f40fa56

SHA512
8a941d2ec94ad81721895aa4d0b023421a1e09b06dfeeca165909c189f2cc4832cd5dd6564dc9268f397fb44687b8ec09fa7fb7c0aab06f6f8eb61f2e4058278

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
c751b3ab650afa838802f4f56a1ff943

SHA1
754f1d350f4d5983c2c2524386413b69ed09e47a

SHA256
5d30e38f22c0f5bee694d37709d75a5eec3d73cd4cde0d7aa1da9703bbc0fb64

SHA512
48c11eeca57a41200260a4873cd12ab4e5837704b2180854e03c72a144c1e0d4c1be4db2bc34dd27f5a95593ebfbef7a297bfc6ba08ad5adeab2b84ffac87477

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
dbae097c1220ef8e49f87333bbbf2f76

SHA1
113908a0c1a76b8d983cc328940d115d2d7f5075

SHA256
2ce7fc9426f751b8d2dd79b614d83333be4d5d589f71ccbae148a63adcd8a3fa

SHA512
1a348d82318f0b0950df7e0931c15d55c30913a1c4949ae64620e5ed8afd430b0b9c5fa903c96933df70f5eb76c3ebd390849dc291f927ad4bbaed12c206baf3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
3734e97748efe4b56bf5560be4941f67

SHA1
bf8c7665aa18909cd99de54d6ac668443a782592

SHA256
a4cb5abbc1c7b5e974afaff870741aa3a045b34224425adbe73821d81b5c5e6d

SHA512
156d9e5acadc14c488950bc7d3dd39d64fa1a254d791f5ea0199dfc182e64f90e1cb5767bf3bc3fe3aa2ab53e3e15f8bc27989cee6405b7509a7434afa6ee160

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
ad5b31036eff18ea62be1639bea9f08b

SHA1
da2f5b8a772bec8c8c380175603cda24ad535f77

SHA256
1b3f7a7cd0ff78065b28ff7d90e121b77efd4e10dd9c5251e169f05f826e15d2

SHA512
3d273b74e1a84671d5563f246441e62ceeba9d300b0a0dff19aac61bca92f847c777ca27634e36fc911fe9f77bb59e3731a1d1e122c7252f1482576c447683b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
89d772d5dd9085259d47fed30a69aa09

SHA1
80e6b0194233f1dad979ee96de4b4b7827a92b13

SHA256
a769af9e6268bf2f23a5620c746a56ee49671d0aa584799d27d960e4f5ba7a4c

SHA512
1969b4d40c3d608acd52bab7ef171f01c3f9a0905f6e576919e978cbcefdd3f5b63221a155c98c1c8a49e193ec32e1ec2876e9aa5f7cca1700c5f4a799865a8a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
a22773b2c7a791178d98c3eaa3e278cc

SHA1
7970882adfe0364cc5beb0e508ba5b2f55bfccd2

SHA256
98f3278176d7e79b451bdfcabb417c232a62b9316603d245b62f7c9ed43712e9

SHA512
5b3ffd27567a56411b0d623d6328933e6e622b1fda2f57d5e592dc5bb6ea455e269c1b6f91eeeff9ae20fccd3444ddb40dadb775e6d37119c25b9d10c276ad8e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
b00cff5cbc148742434da33f38349e8e

SHA1
ebc53bcca9bcc397a2885f21afc344076ed6bfb5

SHA256
e08558e548e68ce081c35333e907dbe157b6c7ee6fdbf69312a13277c6aca0a2

SHA512
7c00e470969d89a4c384fa579e1c7763fa06d887feb6537ac56111eac36fa5f927447d53234f40545cb557194fc015b2f6c5111c05354a8bf60ab31cc8203466

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Filesize
8KB

MD5
f577ccf38b324674fdfe4167a02c0c56

SHA1
099a11120352cc2a9790c94fbf99b079f93d04f7

SHA256
863d63f511e16505e3f500037b6f93a0f1597ddc0ae4e2aa527f1ecebb791e11

SHA512
2eb1bcbde58ecb1964ec92c8ffd142f32672630e6e045eee8c78b4d5d99b618ea44ae64caf1eb738925edb6d4a4849cf228135a3736879f4ae92db7d30a3a934

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
0dc8ad465b36afa0492b7b88afaf4444

SHA1
eccaa3fd61ff35a9d9acbdf3184435668a95ba5e

SHA256
0cef11679ae94a4ba902514771e4a334b46766ffc291e7cb459b7a339099587c

SHA512
4187bbee65e0b5d7498b2ac15f65a9094cdaa6745e731c741e904c13b5def5fc3138e8822ab92fe916028c0da8238ea642cdfb42868362ea27547c65f2c39ced

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
e167b0be98cbe9134c27bf24677af1ae

SHA1
b6c6787f737d4e93b56fd29306b84448796f0caf

SHA256
b620f24457c4801d646f823baaf3ff1d672dda9c947280b4b95b6b56ceac97fc

SHA512
0b66f9d9abf6daf537da8aa651bc0d04816dbd641fa413596cbd450bbf2427504149644ede3e0413758d9818137bc992d735b231e498c8a9ba57fadbe086f5ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a77f0.TMP

Filesize
48B

MD5
3da7a296826919affdc839d2fd5123c9

SHA1
0dc6e296b75f018f196c84890cb02d230d127344

SHA256
2d517fd645c1c400dd763f23c22de225e84e6a983aa62fcb301cd4cbb912c54f

SHA512
e0149854d936ec692b9db6a955215484e3376862c0fd9b8dcb43e7ad99c0042c1a782f44389de44dc1adbcc35195de162971405406e650e2622390b8d03bd427

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
192KB

MD5
69275396d7c40eeb229ff55f0a6192c8

SHA1
93fe990e1dd03cb2c746d4fd19aaa382a108ccfa

SHA256
ff5ebf24fed5bc42d6e011d603bfd196f10d565b43157e1f8bda06e43e64a68b

SHA512
1e70c4732d01ecedc8a99472bffc82b9221b6fec0bb8fa4e0452ad6acf7b8c6a0fb966a5cbeeb0eff3e9d6e29d8c35f6858fd7f21dc414a8fe4dcae4a940497f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
192KB

MD5
7d8bb7bc43783d969378b7c2ade6c2b0

SHA1
90928f2cd6e4cf129bc2647ce50d653579934ea0

SHA256
245c8c109122474272b0c6bd3bfb8ff3bf225d5f729be8b2979ee416deb665bf

SHA512
4ef09a6a6012fa4a8c20958712686d836cbe0b5d1757add2c064896d03544cda2920cbb019ce0fbc938930ef6fa43696becc985d2618fae45e4ae220267e4466

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
192KB

MD5
1a44ce036344ec48efa8f27f2693e65d

SHA1
6003d2f9166b73f6512e859a1374f5ea0c2234c5

SHA256
a880b3c360d833a425aa7c98f22087560c3880740bd5e05443da768b1baf3581

SHA512
eb953e8ed5f4959d80d234dfe26a170bb5b868a1caf95f7185063de19080deb6c07337ec1e443f99f8b1e9d70e4eb020ec1a2e4723d479e68f6b78d9dd9fe243

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
108KB

MD5
b13564066f8543145b0f9dd349c19d55

SHA1
bedf73dcc771d8a36884050f9c009f9a0aaff041

SHA256
f750d4333c8113335cdbd9ca7b68d733c2a95b9602ed4196a8d9960ad3ee147a

SHA512
3c037abbc89b51c6058d17502d8b646969e8925116f01c9ad380919cd0593880e2b62657f648171e5cdc72d4fb4335ef45f8b68ba5a84f1ba709c39bd43e447f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
97KB

MD5
c9c236ea3bde323a55c2d9e298349087

SHA1
77a2936541a8262caa8456e6f00f7d9f2272a1a7

SHA256
04e517eaacd6ca49ace0324825174ad4c1e72238e7e9d7db32e85c57e366941f

SHA512
7fb5580531376d964acfebd953431def3feb22c931b403183c4fefb0786af43878e20248fef8b18bd4d8721f5e6faad87c21c94624c11b4f1bf703af35c6cea5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
114KB

MD5
c6b7e518be670ffaad735cad4a4158b9

SHA1
f1ff31c365c7385293972eb0a82388af404fa16d

SHA256
adb7615f56a291f45f62f984b073ad07e956ddb12f55764a5eda0bca96319a68

SHA512
5c4f2e4dcbc5bec20e00a067b5da1ee52732702e4737222167e77613389bbbf3761cedbd4a686eb878fc0c4b963e6c8161e0606130f3c10c7187998889ab98c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5b1838.TMP

Filesize
92KB

MD5
797c463756c7f286ec9a9bd18ada80aa

SHA1
c3732db56d3de7e2875c50a5cf49ef091603cfbc

SHA256
d033dd1373740783bc43ea5641843a93f6388b5754c957935a7857c1eb2a868f

SHA512
3804cbdf13b0f1782a4d1a156f939dff000adce52973340cc5e2b521fe8d845d6e9500f56f2aa1691ea52cf35c74c0123f2e68d468d4d3dff892f4f66b43915b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EFXR3MGF\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
16KB

MD5
065cc9f19d6102efca920cb7885a4535

SHA1
43b42bfdd9258e9bce50893f702e7d09536bddde

SHA256
5aa8616da0d6ec974a10584d0d6434e2c74745a2af69546c4b6cbd226910e81d

SHA512
097980f3be2271736031914bb570d0d4e4d8fe83307d356d2cbb4ae7f5672d8a19fca7fcf87ecaed047fe13f6add3b7ada9d1f15ce801414a11d77236af10c0d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\SM8EMT2T\disk.yandex[1].xml

Filesize
342B

MD5
182010d2f09dadede8713bcdcb04468b

SHA1
a38b9b8ad8215746e0aeb5ccc6fc679e9c5ae233

SHA256
8b559df4577eb1c9b5c8e8ce198a6d90e272465ce9f14632935bce65dfc739de

SHA512
9e52ae379b32e69387e17b9725a05d44597f69eccc3fe4813d299189eb4db854d20881bb34e1dad3decfb6a281aa110de6f30112e03e2e1325ab0c5eadc65b1d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\SM8EMT2T\disk.yandex[1].xml

Filesize
1KB

MD5
8c261f1d5320784abfa96d239c47b428

SHA1
f1dbefcb9241acfeb314629e6959d088a05fa087

SHA256
d708634d27c211c7de14c889a3648d1cad3cbf8c6e47c59a4085760701b20163

SHA512
7a51bef6f2a377ef5ea4da75eac1dbd7425f1bde84ce196b5805cd3cbe140a3f00178e91322ca7354ff1cbda8f7c3eec72d9399dabea693ffb4178c137b51a79

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\SM8EMT2T\disk.yandex[1].xml

Filesize
2KB

MD5
9e2bdf407058567828b570f3c4aebe6e

SHA1
278399d678d1811399a7c3ec1bd25efec75bb55d

SHA256
5ef7e77f6bf8f070093aaad733885db37701c810d1a6000d01f19e03f2e4f5dd

SHA512
c24871087ab8a92c2e4102b17ad63e1edfef9e63d88a7fd3c8d99c036cb19e7ff36660fb8926a76862cbd9c13c35186e868381de30cdfeca58b72918545480b2

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\JD3QMI5M\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\X2RNIXZ4\favicon[1].ico

Filesize
32KB

MD5
bb797e3d12d7c484b76b807efa2cf3b3

SHA1
5ef5e20be499b7b92abb8881633425a4188aff17

SHA256
44b11bc4be4a9c3f47ca27011c460707a9355deceaae1db98d166caad8d5f527

SHA512
b67f34caff4fc24c1543a284b0bd36a31a7a9ebed84c95ef3d953312de3898aeff1754587d3c372e8cc528e4a1d3516a7ba27fee7cb16d3591a86a4eb393b017

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_znwtdjps.mi5.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-2AB3S.tmp\NordVPNSetup.tmp

Filesize
3.1MB

MD5
29ca787f3a0d83846b7318d02fccb583

SHA1
b3688c01bef0e9f1fe62dc831926df3ca92b3778

SHA256
746b972e21acb59e4086b5b25fe53ef2cddcecfa94dd56ad68c8e5bab9960c3c

SHA512
a6c21bf5590dc91a5d9bc729d9c04c20b54341d3270efd2fb7d2b548d7dc7b23a1a351147a07dfd569e901a608cb44533304de10725cb02fec781cada80b8e3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-7HS1H.tmp\is-9L8B4.tmp

Filesize
647KB

MD5
d4df8c703b3fbcf9aedaad2d73cf825b

SHA1
fae41f401bf6b2dfa0ae95a5de26c5e15ea84e47

SHA256
4954ec16e1ddfea2c1358dc59268a9505838b858b02d80c0cf53a0737b182e73

SHA512
f14ec201637a87b02d47164bb73513f6b40656acb30569301a499a35b32b7b3181088785cec9e44dec26144579c351953a670add657c0177dfce963bb215728a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-7HS1H.tmp\is-9L8B4.tmp

Filesize
647KB

MD5
d4df8c703b3fbcf9aedaad2d73cf825b

SHA1
fae41f401bf6b2dfa0ae95a5de26c5e15ea84e47

SHA256
4954ec16e1ddfea2c1358dc59268a9505838b858b02d80c0cf53a0737b182e73

SHA512
f14ec201637a87b02d47164bb73513f6b40656acb30569301a499a35b32b7b3181088785cec9e44dec26144579c351953a670add657c0177dfce963bb215728a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-FELTN.tmp\Nord.Setup.dll

Filesize
40KB

MD5
b18bd486c5718397bc65d77a16ce2593

SHA1
58fe73e27c5c04e6915c5358f698f7fe8c2b5af8

SHA256
0bbf32b0553ca1292602e8c2c0458e075fdee2c8b6ef8ea81e924a86bc065f3c

SHA512
f4ffa1c8983914c41657fecc11c9324caa5899ad875b9687da8ffcf79ab189f19d6f926e16f09f240de9e6b22e26691fae785ed95657af310de5bf6c58ce8e0e

Download Submit
C:\Users\Admin\Downloads\setup-bffRhVDadOf8.zip

Filesize
10.0MB

MD5
c478402ad500f52f9e50bef920a87ea1

SHA1
151c30e4fbea173341e48a45f4dd3004752e4674

SHA256
bee3f4c3a7c708726122457a10f36347918d188a5263e997b8ce8fb78f2ce6b8

SHA512
03cb908a6645e0773b7997ae10fc3cd9c52df15f4c09f115efd794d0e3e3a2a13676a61fd911a2baddd1f3c4019ff55e827d1e61ffeafed803f9af4079761af1

Download Submit
\??\pipe\crashpad_4768_SXMDSBNBZDQGPLBQ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\is-FELTN.tmp\Nord.Setup.dll

Filesize
40KB

MD5
b18bd486c5718397bc65d77a16ce2593

SHA1
58fe73e27c5c04e6915c5358f698f7fe8c2b5af8

SHA256
0bbf32b0553ca1292602e8c2c0458e075fdee2c8b6ef8ea81e924a86bc065f3c

SHA512
f4ffa1c8983914c41657fecc11c9324caa5899ad875b9687da8ffcf79ab189f19d6f926e16f09f240de9e6b22e26691fae785ed95657af310de5bf6c58ce8e0e

Download Submit
\Users\Admin\AppData\Local\Temp\is-FELTN.tmp\Nord.Setup.dll

Filesize
40KB

MD5
b18bd486c5718397bc65d77a16ce2593

SHA1
58fe73e27c5c04e6915c5358f698f7fe8c2b5af8

SHA256
0bbf32b0553ca1292602e8c2c0458e075fdee2c8b6ef8ea81e924a86bc065f3c

SHA512
f4ffa1c8983914c41657fecc11c9324caa5899ad875b9687da8ffcf79ab189f19d6f926e16f09f240de9e6b22e26691fae785ed95657af310de5bf6c58ce8e0e

Download Submit
\Users\Admin\AppData\Local\Temp\is-FELTN.tmp\Nord.Setup.dll

Filesize
40KB

MD5
b18bd486c5718397bc65d77a16ce2593

SHA1
58fe73e27c5c04e6915c5358f698f7fe8c2b5af8

SHA256
0bbf32b0553ca1292602e8c2c0458e075fdee2c8b6ef8ea81e924a86bc065f3c

SHA512
f4ffa1c8983914c41657fecc11c9324caa5899ad875b9687da8ffcf79ab189f19d6f926e16f09f240de9e6b22e26691fae785ed95657af310de5bf6c58ce8e0e

Download Submit
\Users\Admin\AppData\Local\Temp\is-H1ORV.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
memory/8-1289-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/8-954-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/1196-1624-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1196-1287-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1196-947-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1520-1288-0x0000000000400000-0x0000000000C51000-memory.dmp

Filesize
8.3MB

Download
memory/1520-1621-0x0000000000400000-0x0000000000C51000-memory.dmp

Filesize
8.3MB

Download
memory/1520-1297-0x00000000037B0000-0x00000000037B1000-memory.dmp

Filesize
4KB

Download
memory/1520-1285-0x0000000000400000-0x0000000000C51000-memory.dmp

Filesize
8.3MB

Download
memory/1520-1290-0x00000000037B0000-0x00000000037B1000-memory.dmp

Filesize
4KB

Download
memory/1520-1295-0x0000000000400000-0x0000000000C51000-memory.dmp

Filesize
8.3MB

Download
memory/1544-26-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download
memory/1544-1-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download
memory/3060-1269-0x0000000003710000-0x0000000003711000-memory.dmp

Filesize
4KB

Download
memory/3060-1282-0x0000000000400000-0x0000000000C51000-memory.dmp

Filesize
8.3MB

Download
memory/3060-1265-0x0000000000400000-0x0000000000C51000-memory.dmp

Filesize
8.3MB

Download
memory/3060-1267-0x0000000000400000-0x0000000000C51000-memory.dmp

Filesize
8.3MB

Download
memory/4852-24-0x0000000073560000-0x0000000073C4E000-memory.dmp

Filesize
6.9MB

Download
memory/4852-31-0x0000000073560000-0x0000000073C4E000-memory.dmp

Filesize
6.9MB

Download
memory/4852-30-0x0000000004380000-0x0000000004390000-memory.dmp

Filesize
64KB

Download
memory/4852-29-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/4852-27-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download
memory/4852-25-0x0000000006A20000-0x0000000006F4C000-memory.dmp

Filesize
5.2MB

Download
memory/4852-23-0x0000000003750000-0x0000000003760000-memory.dmp

Filesize
64KB

Download
memory/4852-6-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download
memory/4852-19-0x0000000004380000-0x0000000004390000-memory.dmp

Filesize
64KB

Download
memory/5140-1570-0x0000000006E20000-0x0000000006E42000-memory.dmp

Filesize
136KB

Download
memory/5140-1569-0x0000000006B10000-0x0000000006B20000-memory.dmp

Filesize
64KB

Download
memory/5140-1616-0x0000000073560000-0x0000000073C4E000-memory.dmp

Filesize
6.9MB

Download
memory/5140-1563-0x0000000073560000-0x0000000073C4E000-memory.dmp

Filesize
6.9MB

Download
memory/5140-1609-0x0000000006B10000-0x0000000006B20000-memory.dmp

Filesize
64KB

Download
memory/5140-1608-0x0000000008E20000-0x0000000008E3A000-memory.dmp

Filesize
104KB

Download
memory/5140-1564-0x0000000004850000-0x0000000004886000-memory.dmp

Filesize
216KB

Download
memory/5140-1565-0x0000000006B10000-0x0000000006B20000-memory.dmp

Filesize
64KB

Download
memory/5140-1572-0x0000000006FA0000-0x0000000007006000-memory.dmp

Filesize
408KB

Download
memory/5140-1573-0x0000000007780000-0x0000000007AD0000-memory.dmp

Filesize
3.3MB

Download
memory/5176-1574-0x0000000007390000-0x00000000073AC000-memory.dmp

Filesize
112KB

Download
memory/5176-1571-0x0000000007260000-0x00000000072C6000-memory.dmp

Filesize
408KB

Download
memory/5176-1575-0x00000000084A0000-0x00000000084EB000-memory.dmp

Filesize
300KB

Download
memory/5176-1617-0x0000000073560000-0x0000000073C4E000-memory.dmp

Filesize
6.9MB

Download
memory/5176-1568-0x0000000073560000-0x0000000073C4E000-memory.dmp

Filesize
6.9MB

Download
memory/5176-1566-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download
memory/5176-1567-0x0000000007480000-0x0000000007AA8000-memory.dmp

Filesize
6.2MB

Download
memory/5176-1578-0x0000000008270000-0x00000000082E6000-memory.dmp

Filesize
472KB

Download
memory/5176-1607-0x00000000099A0000-0x000000000A018000-memory.dmp

Filesize
6.5MB

Download
memory/5176-1612-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download