discordrat | 56d6515c05a0b8622e592c88c886c5beaafba13b3ec8df773a3f15e0e315b4bb

Analysis

max time kernel
894s
max time network
897s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
08-05-2024 13:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mtree.jpg.exe
Size

518KB
MD5

eaa398192f1c312d60688e027b179edb
SHA1

256e90ab6bfd0b19a44d73649d07d6c10b19a7c3
SHA256

56d6515c05a0b8622e592c88c886c5beaafba13b3ec8df773a3f15e0e315b4bb
SHA512

e502f831348b195f99daa55404332c6baa6cf7c5ab47388d75a3ef47b607c32a276ec8008c2b0a699deff148264e9262cb41bd372414d3cdd48b60b000623ae9
SSDEEP

12288:FCQjgAtAHM+vetZxF5EWry8AJGy0yQKMIYJiIPalXSu307c:F5ZWs+OZVEWry8AFBuJitx/3r

Score

10^/10

discordrat persistence rat rootkit spyware stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIwNjA0MDA2MDI2NTM2NTUwNA.GStFBi.KFxuLXKvS3XujUPdFiaRzwKmwtmjd2uDdKdcmY
server_id
1237709600602722354

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
4636	Client-built.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 21 IoCs

Web Service

T1102

flow	ioc
222	discord.com
226	discord.com
240	discord.com
100	discord.com
190	discord.com
207	discord.com
219	raw.githubusercontent.com
208	discord.com
227	discord.com
252	discord.com
200	discord.com
223	discord.com
237	discord.com
101	discord.com
102	discord.com
194	discord.com
198	discord.com
189	discord.com
218	raw.githubusercontent.com
225	raw.githubusercontent.com
306	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133596476832663737"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "2"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe100000002eb059e18986da01911b15f98d86da01911b15f98d86da0114000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "3"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3872	chrome.exe
3872	chrome.exe
4844	chrome.exe
4844	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2460	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2460	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 4388	3872	chrome.exe	77
PID 3872 wrote to memory of 4388	3872	chrome.exe	77
PID 3872 wrote to memory of 3364	3872	chrome.exe	79
PID 3872 wrote to memory of 3364	3872	chrome.exe	79
PID 3872 wrote to memory of 3364	3872	chrome.exe	79
PID 3872 wrote to memory of 3364	3872	chrome.exe	79
PID 3872 wrote to memory of 3364	3872	chrome.exe	79
PID 3872 wrote to memory of 3364	3872	chrome.exe	79
PID 3872 wrote to memory of 3364	3872	chrome.exe	79
PID 3872 wrote to memory of 3364	3872	chrome.exe	79
PID 3872 wrote to memory of 3364	3872	chrome.exe	79
PID 3872 wrote to memory of 3364	3872	chrome.exe	79
PID 3872 wrote to memory of 3364	3872	chrome.exe	79
PID 3872 wrote to memory of 3364	3872	chrome.exe	79
PID 3872 wrote to memory of 3364	3872	chrome.exe	79
PID 3872 wrote to memory of 3364	3872	chrome.exe	79
PID 3872 wrote to memory of 3364	3872	chrome.exe	79
PID 3872 wrote to memory of 3364	3872	chrome.exe	79
PID 3872 wrote to memory of 3364	3872	chrome.exe	79
PID 3872 wrote to memory of 3364	3872	chrome.exe	79
PID 3872 wrote to memory of 3364	3872	chrome.exe	79
PID 3872 wrote to memory of 3364	3872	chrome.exe	79
PID 3872 wrote to memory of 3364	3872	chrome.exe	79
PID 3872 wrote to memory of 3364	3872	chrome.exe	79
PID 3872 wrote to memory of 3364	3872	chrome.exe	79
PID 3872 wrote to memory of 3364	3872	chrome.exe	79
PID 3872 wrote to memory of 3364	3872	chrome.exe	79
PID 3872 wrote to memory of 3364	3872	chrome.exe	79
PID 3872 wrote to memory of 3364	3872	chrome.exe	79
PID 3872 wrote to memory of 3364	3872	chrome.exe	79
PID 3872 wrote to memory of 3364	3872	chrome.exe	79
PID 3872 wrote to memory of 3364	3872	chrome.exe	79
PID 3872 wrote to memory of 3364	3872	chrome.exe	79
PID 3872 wrote to memory of 3364	3872	chrome.exe	79
PID 3872 wrote to memory of 3364	3872	chrome.exe	79
PID 3872 wrote to memory of 3364	3872	chrome.exe	79
PID 3872 wrote to memory of 3364	3872	chrome.exe	79
PID 3872 wrote to memory of 3364	3872	chrome.exe	79
PID 3872 wrote to memory of 3364	3872	chrome.exe	79
PID 3872 wrote to memory of 3364	3872	chrome.exe	79
PID 3872 wrote to memory of 3292	3872	chrome.exe	80
PID 3872 wrote to memory of 3292	3872	chrome.exe	80
PID 3872 wrote to memory of 2552	3872	chrome.exe	81
PID 3872 wrote to memory of 2552	3872	chrome.exe	81
PID 3872 wrote to memory of 2552	3872	chrome.exe	81
PID 3872 wrote to memory of 2552	3872	chrome.exe	81
PID 3872 wrote to memory of 2552	3872	chrome.exe	81
PID 3872 wrote to memory of 2552	3872	chrome.exe	81
PID 3872 wrote to memory of 2552	3872	chrome.exe	81
PID 3872 wrote to memory of 2552	3872	chrome.exe	81
PID 3872 wrote to memory of 2552	3872	chrome.exe	81
PID 3872 wrote to memory of 2552	3872	chrome.exe	81
PID 3872 wrote to memory of 2552	3872	chrome.exe	81
PID 3872 wrote to memory of 2552	3872	chrome.exe	81
PID 3872 wrote to memory of 2552	3872	chrome.exe	81
PID 3872 wrote to memory of 2552	3872	chrome.exe	81
PID 3872 wrote to memory of 2552	3872	chrome.exe	81
PID 3872 wrote to memory of 2552	3872	chrome.exe	81
PID 3872 wrote to memory of 2552	3872	chrome.exe	81
PID 3872 wrote to memory of 2552	3872	chrome.exe	81
PID 3872 wrote to memory of 2552	3872	chrome.exe	81
PID 3872 wrote to memory of 2552	3872	chrome.exe	81
PID 3872 wrote to memory of 2552	3872	chrome.exe	81
PID 3872 wrote to memory of 2552	3872	chrome.exe	81

C:\Users\Admin\AppData\Local\Temp\mtree.jpg.exe
"C:\Users\Admin\AppData\Local\Temp\mtree.jpg.exe"
1⤵
PID:4604

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xd0,0xd4,0xd8,0xac,0xdc,0x7ffe3da99758,0x7ffe3da99768,0x7ffe3da99778
  2⤵
  PID:4388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1616 --field-trial-handle=1868,i,4853200817845509900,17701093896815436335,131072 /prefetch:2
  2⤵
  PID:3364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1816 --field-trial-handle=1868,i,4853200817845509900,17701093896815436335,131072 /prefetch:8
  2⤵
  PID:3292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2088 --field-trial-handle=1868,i,4853200817845509900,17701093896815436335,131072 /prefetch:8
  2⤵
  PID:2552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2896 --field-trial-handle=1868,i,4853200817845509900,17701093896815436335,131072 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2928 --field-trial-handle=1868,i,4853200817845509900,17701093896815436335,131072 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4436 --field-trial-handle=1868,i,4853200817845509900,17701093896815436335,131072 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4652 --field-trial-handle=1868,i,4853200817845509900,17701093896815436335,131072 /prefetch:8
  2⤵
  PID:2784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4808 --field-trial-handle=1868,i,4853200817845509900,17701093896815436335,131072 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 --field-trial-handle=1868,i,4853200817845509900,17701093896815436335,131072 /prefetch:8
  2⤵
  PID:796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4804 --field-trial-handle=1868,i,4853200817845509900,17701093896815436335,131072 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4760 --field-trial-handle=1868,i,4853200817845509900,17701093896815436335,131072 /prefetch:8
  2⤵
  PID:2972
- C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  PID:2752
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x258,0x25c,0x260,0x234,0x264,0x7ff64bd47688,0x7ff64bd47698,0x7ff64bd476a8
    3⤵
    PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5164 --field-trial-handle=1868,i,4853200817845509900,17701093896815436335,131072 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3912 --field-trial-handle=1868,i,4853200817845509900,17701093896815436335,131072 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1860 --field-trial-handle=1868,i,4853200817845509900,17701093896815436335,131072 /prefetch:8
  2⤵
  PID:200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5416 --field-trial-handle=1868,i,4853200817845509900,17701093896815436335,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4768 --field-trial-handle=1868,i,4853200817845509900,17701093896815436335,131072 /prefetch:8
  2⤵
  PID:3032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5976 --field-trial-handle=1868,i,4853200817845509900,17701093896815436335,131072 /prefetch:8
  2⤵
  PID:3424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4888 --field-trial-handle=1868,i,4853200817845509900,17701093896815436335,131072 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=4596 --field-trial-handle=1868,i,4853200817845509900,17701093896815436335,131072 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6004 --field-trial-handle=1868,i,4853200817845509900,17701093896815436335,131072 /prefetch:8
  2⤵
  PID:1744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2992 --field-trial-handle=1868,i,4853200817845509900,17701093896815436335,131072 /prefetch:8
  2⤵
  PID:3368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=2996 --field-trial-handle=1868,i,4853200817845509900,17701093896815436335,131072 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 --field-trial-handle=1868,i,4853200817845509900,17701093896815436335,131072 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3120 --field-trial-handle=1868,i,4853200817845509900,17701093896815436335,131072 /prefetch:8
  2⤵
  PID:1688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3004 --field-trial-handle=1868,i,4853200817845509900,17701093896815436335,131072 /prefetch:8
  2⤵
  PID:3104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=980 --field-trial-handle=1868,i,4853200817845509900,17701093896815436335,131072 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=3808 --field-trial-handle=1868,i,4853200817845509900,17701093896815436335,131072 /prefetch:1
  2⤵
  PID:588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=4768 --field-trial-handle=1868,i,4853200817845509900,17701093896815436335,131072 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1848 --field-trial-handle=1868,i,4853200817845509900,17701093896815436335,131072 /prefetch:8
  2⤵
  PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5076 --field-trial-handle=1868,i,4853200817845509900,17701093896815436335,131072 /prefetch:8
  2⤵
  PID:352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=5768 --field-trial-handle=1868,i,4853200817845509900,17701093896815436335,131072 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=5368 --field-trial-handle=1868,i,4853200817845509900,17701093896815436335,131072 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=5124 --field-trial-handle=1868,i,4853200817845509900,17701093896815436335,131072 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6200 --field-trial-handle=1868,i,4853200817845509900,17701093896815436335,131072 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6008 --field-trial-handle=1868,i,4853200817845509900,17701093896815436335,131072 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:2116

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4352

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2484

C:\Users\Admin\Downloads\release\builder.exe
"C:\Users\Admin\Downloads\release\builder.exe"
1⤵
PID:1600

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2b8
1⤵
PID:4716

C:\Users\Admin\Downloads\release\Client-built.exe
"C:\Users\Admin\Downloads\release\Client-built.exe"
1⤵
- Executes dropped EXE
PID:4636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000002

Filesize
58KB

MD5
188496839a8ec880e8955e85b5d98e48

SHA1
63c0f3876ad72a170ba618ad765132048acb970e

SHA256
875394931d73230a8688b89796970d4513c45bffad839b5e448ad48c9a3285e3

SHA512
8288040c3a97cca7528ae5ecbd6fc73ec389a492ecdb7443979297f50e324e86220b8beeb2ada80cd836cdf32046d2199afb4d81d3a62078559335cc0b1be162

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000003

Filesize
40KB

MD5
5ce7bdeeea547dc5e395554f1de0b179

SHA1
3dba53fa4da7c828a468d17abc09b265b664078a

SHA256
675cd5fdfe3c14504b7af2d1012c921ab0b5af2ab93bf4dfbfe6505cae8b79a9

SHA512
0bf3e39c11cfefbd4de7ec60f2adaacfba14eac0a4bf8e4d2bc80c4cf1e9d173035c068d8488436c4cf9840ae5c7cfccbefddf9d184e60cab78d1043dc3b9c4e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
0bc5d8d14416c972610d3491bd6c3bd4

SHA1
ad669311d1cacb296aa2a5ed9c2f236d724cb9de

SHA256
fb62d7a1dccf70529c7c505babe65da5458d80b570d87c4f881b5e1c727dfc5e

SHA512
4b2956461db1680728d6938cf5fc32cb95eb2673775cd8a53b4e05b50617438cb8f755883078f5e3e65273b1a8571602b024aa724b1c404d5c9da6d3cbb9ec30

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
aff302de5cf7011f8136119d542f19aa

SHA1
0ba03bf00a747c7174234b4410045787cfe9c453

SHA256
e895394912baed6d6ed89545d9514ab3b2323378ca00801bc84863fe2d81add9

SHA512
0cab419b448a49ea7d711d2ed7ce7df76baa9d7bb41dc7fc6508ada0fd0a8d28436ef0beada9cb3cc3a76572f83771c95716d0f4290ca30ff4bd1d8b1364dc89

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
980c90d05d6489e436e372e82387cb80

SHA1
a62a96bf4b7b3e4902f64f2c318c27e6dae18521

SHA256
6e0169349c17124f3ed1d73aa6efdbb29270eb7a7ecae962dd74c5675aeea5b6

SHA512
8846ea337b8344bae9d44e76f6ec7a86b8f726106919c6ae72eeb2ea58e319ff6f1296ddaf6c63288d047c0cf7665f9817df2f895da3c3cb6da1754c6ed69c2a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
a234c171eec9b803ddf990ec1146ae64

SHA1
32daf5960c8fc33c2359d1ec01c3db72d7c779d4

SHA256
5a9bc4dfc0302bc1f3ed105c8777d0b3575672d0b12b4c832ffa169a4f19b2ea

SHA512
36ad6cadc9e9fb8085d034bfcd8ec070cf70be8be812d2dccdd6449fa189cc05b06c58fdb34bb8482881de3e8bbcb5e322ce4835b4143c3617df1f24a6918d35

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
9a65cc0127ef8c750f9de401118eba5a

SHA1
c33d8e033414e6af2cc5e10e7e1d1915d6d0a0a7

SHA256
1ec66441618e0fc2ee81e714e506a21d6d16d25bdf60b2c566c59b2cdba27ae0

SHA512
b75819224bd3d154453ccc233b1815f3f27491c63c4ed2b841b0f08477b2942602fa0f2f40c0a21ee55292f958be6de04420c4eff550d39a6d898d91ba3afd7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
6eb45f04cac6e48e26dc4f00f1126ab3

SHA1
9743ae780a4a1723cad07b6fff8a882b522c256a

SHA256
b98204fe02a37d34dfa7b8819a725da936f5132fb0094e7b721054898d8ffd2c

SHA512
50edaf3659548cc5fc5d8dd4c14ff7e62d0227d41a5d5ffc9dacc56bb69fea7fb0a6eaf3639c6ceb73333cebdafcf1ddf70ee61ffbc828b1b10194d97037442e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data

Filesize
46KB

MD5
9886d7bec59b218a660ffd3659266ff0

SHA1
5a84b3051b28a1f260833642f97e97eefe0045fb

SHA256
82e4233aa62ae3bb80aaa4788545eb8ee7f11bc5cdd4f481c8441d903c43836f

SHA512
19b009a1e72d90fa9fba1384141b4c72e5d6c1fc3a144b8446ae7dd37d2be9802575aeb691345766d697abb963fb7d2a6e0d9cde9e2a085457f683ae560ec7d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\210b9293-6f40-41fd-a7ba-eae59da8ff1e.tmp

Filesize
371B

MD5
6603950e1802243386865b7d26e508ad

SHA1
82b1039c0e9fb3f66243d7d694b011aaf2e2f5c2

SHA256
90428c79cdf19171d04882eb13d3ca8ac5b616baa8e38c00d1aeaf90eadc08ed

SHA512
2ce7bc9c5f1939ccc2d1e8cb44e87d42e84ccd4c6f69bc924bc077cba25503bcd7a82093e7fe63af6b96672a4ffeeb68a2218a6a4a4f50f9ebf94d4f61e50bdf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\57ff026a-0a3c-40b9-bfc5-a059351dcd4a.tmp

Filesize
2KB

MD5
768d70b76b16c140f9a5ab2e7bbfaaff

SHA1
dcf9bffad225fae8be0654ec30baf1a2e3fa94e4

SHA256
6277024e80889d4a4f1c6f80efee022e189d8eac46849547277738f5c2276cdb

SHA512
88eeb585d85ddf27eb821c79bcb00df71db6ad48e5d883a758752ee51f27f6e32b6b4cb3ac17c6402f5dfb13795bdf3148c8f3f18411d39311480c574d60db52

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
a63a2fd79781cac5e92949ad6dd87e3a

SHA1
2dacc0fa49bdf6a2271f19f6334c66c7d78dab8e

SHA256
192174592b1a454c3d65cd65a63335a32fa3eb4ff5b70080f830e8159eb0baa5

SHA512
de4a170b458afd1c4d58b224243428d3649287e860e73e401f4b2ff4a25b125a5befcf8493885594f1c2369a6c2febdf7ce1c4f08ed75d69cf760fc416629ff3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
359c0e6aced5096e6dba0687fb2f715a

SHA1
be2ff1cda66dd9d056a3470fcbaf9678408d1431

SHA256
19f81d325f9fcd3e24f35f6520e920af6c21f7d53a19d4e0c423e73350f030f8

SHA512
ba52a11316649479df226859a3e68960c35c92c208295c92f15dbd35c6ab878f535422944cbc43eab7bde4ebffdb92a1dd4f144348cbcbad036b02b4797ad357

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
a803bc17c81cfe876d8a5c3f938aa042

SHA1
f5b895952ef9b539c7b7553f355323d549e5d5b3

SHA256
d13bd72ab3ef66f93d52c38f470b35a435082d024ed31183261a2cc34f5295e2

SHA512
9f6be9d7da9781f7b1a129087112b9e72a7ef9c0d3b96e4f63eb5ab3d0cff50cf2788d86549c138eba2256ed7aa4d57796d75517e39b922ce0f5538ff09dc482

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
078b0f7f2d1dbfd6de3f31afd4b80e2e

SHA1
5660c2eedcf43d889c9302810fad9312bf16c9c0

SHA256
b2cd10b0d3cf06cb0700673fec0db37e81407fe3a6e8af1f8f1d827f395558f6

SHA512
de2a5379032c9d4e7d0256b15861e2c83c9dec961888f4d9c19fcaeeb6ab9f280b296a2c975b7e00f0282fe3f457a7042cae917f9325f62579000dc8a54efdf5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
6c6dcf35da8a41b9b647f91a9e010259

SHA1
4991946a90aa40975bd9647349d8a9f4ce88b0ed

SHA256
18c0bfbc2530aa1fbad177414861e7441ef5c0ec13f550e0470c6e4ac8430330

SHA512
112d44f42d0b77d52bcd4960c376bd672f0d4214ff8b8de57b819b0895b558d07ed5ba432dfae0634d2121a43c1a966c152ddf7dd88b5eae37216fcca243dfee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
b2cf282c4dbfdb4c74544180b9a25e54

SHA1
4992088def87aeb5c27da0d74ce9f78eb20fdf0b

SHA256
802d6777a6c287b009492f967922387cf49026c263e6c6237d300c62993988ae

SHA512
9ea781b8902d1734283ce7bfd527459262547b77c2822b02daa604b54a39beba81b92b9ec1fac1e4c918b137452d584b5f7c38dc347aff3471c2e0d48829d430

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
674c2169ce6ae8e546b6c01f4213e3f3

SHA1
ad1535790a6831d15a76aa65af4c60e14f4a0aab

SHA256
5c8300fbbffde4e1f75d58adc808955cad129603a513755d0b8f36aaee058342

SHA512
64fcdbe4ec8ef47543a1a408779f1516f4912bc8e83282a53eae56665d1e3667f73fd9ecc41050d50d75755420b4cb8a1802d1f101ef8b88892d415125398410

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
d708e12ebda7820d19cfb4aabe45957e

SHA1
a332436f0faf67769b628837c4528d4504dea833

SHA256
c7c248b6648325946b5909c2a30da0cfa43b28ae3f0121813ce0708918a5270f

SHA512
eb6037058e8285a50aaafc2880659acd5ac343ad584ac85c0fd7e6fa2d104cabf99f2a4a4ae173a250476362d950bd17c3720cabd685dbf06597fd91fe6cfdb4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
d1d32e4a2167a787bc0313bbc7adea3b

SHA1
e9ae28a9be24a32ca702b4643c4be596713e27c6

SHA256
13bf53c9adfa468b9819b684ba7c165baf2d52c28c69720b8a798cc0add022ea

SHA512
44075ce610122b6aab3ae7f3723b4546cfd33624d84323d01d3e2c44d62cbc842eb1739a9af12edffbcd0bbe02d4e90534e8c67171504f0b806e525e01addb0c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
512bb7a25b3f8de00688e44c26589264

SHA1
ace4952591627bd1fbb1f9ee7b554f6b67141195

SHA256
236618ba58532cf4cc34ba8d35548856643ce413552f0224e6e631eb1922e3c8

SHA512
0b891a1810b47f9cf157c3a4ba09458fb2225c60aee0fc07bc136170df1fc03399b5c31766128beb1f3c89f44a2746b144ac9d05c592f5fc2e7b10708f4a2246

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
6ab82e2a5d5c1213c3909230ad9354bc

SHA1
3eebb16d8e48f1c41a0e24290e88f1dbbbea2fa2

SHA256
44015e3fea8396386b89443bc832cf4975b4a51f221c833e532a1933f7e08a2f

SHA512
7c16a375bd149711f090573bdf86798796851a9776bd028eb028c3c6620f19f72348969a2b86f10d231e62f4a4d6de0a44365620cea8c25a1de0f26a9b903206

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
ebaf593dd292b8fefb33e5472048efaa

SHA1
8e07637a4fe5e6123abbf0046f5e34db471731d4

SHA256
83cdbe5e963cfb1fd60399b2ed3f51f0e841c0c08b7334b34a09032b4edcf18f

SHA512
86726d74dae2524cf289218f93547a5af90d3b79c0e50b9b9f66f93a217471f26697f88e4fa9322717d25081e9d6b2defe3d1575aa370c602905b8a3156f6bdb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
5ea7c54fc3513e0fb022cee5d7177f1b

SHA1
c46119a0c6f46884912bcc23009b661305c4244d

SHA256
91d3dd21ab144a82a1be86a9492c37a2cbb4f6f053e8deb717c9adbffe99db0f

SHA512
99aad93a023ac5b8027045822822f8ae46b84d032046a6c1fcce252a6221e44df37e4f350d7397525bf8651ac5698d5653b4ed23674639220d9959ecf33f9956

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
fcce62144d27f16811eadd723008641a

SHA1
9c38beb824457516bf82402128c281c919409219

SHA256
96912fab2923d4fb7b8404bb3a57e79b61a349b53dedf1405f483cd505a26f26

SHA512
936ccfe1b7939c83afa8bb36d854c2c5de439fc88dfd28a0144dc558f7d0cd0bfe6cdb35426206c6576a23294730a196edf2bd7f9082eafc28e38725dcbda814

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
0f428271380aa4412c95ee0685adf751

SHA1
28ac92a7b244ab65788e5efaddc05f8d8482d983

SHA256
6fb883dfa904677540875fc8ff8e69c64f3cad3942b1cf69dfe8cc23be052ed8

SHA512
b5b48050fa624fc2c6a5ec2ae6899ca9c687d3bcfc7e242d2d7e42e89d4243b1e64261d5da29b65549243f15394f281fd051f61c6d3189bfe5d780b212c2a7ea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
5a81c1798230298171872b44834fdeeb

SHA1
c67e9943736a281c4ff6d876dfc50c7ffe7c6eac

SHA256
a4799e647029c9b076b5512f4ff54b1584f17ef8d8683217ac2a8cb4193c37fc

SHA512
0b34d731780b42b0ba6798341474edd690d9cd45968e24885837c7c45250cee803b153d9362cdbf26a637b37087d1a48b8cc2d45fa0b133d245d09709dca4b9c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
3682eaf8e870f30be823c660e8346c45

SHA1
0649a298a562b35a7f5b5ab855b3aef2742ca8bb

SHA256
d3f00451f53973960ae8b9ae16c8712e7e793ce23dbbe3c5e4028e197a443a53

SHA512
d3a1b73c7cb6509870dec3465fea7dee1781d1af5eec5e3f33374bc1c7ae474a0dac9fc992c45f89e8b00abaab6afeedc87693871fa3971155b959da7a7e1227

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
3e342b7d38fcc8111df12031f6ce366a

SHA1
f1bc439fb5d92d834b3781551412a8fee9c0a446

SHA256
2500c27a5bfcffb937ae57feb77049e3dce2d315a7da88bdf0cf2e94e0cd931a

SHA512
68914741b1300f34623e14eb3172c3761eaacf586fdadd5a58234003e938e99fbd714c6db686a3214dab5ac283e19a1ff2d8a3809c8e69250c23d65599ce47bc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
1dfd9e54c3e49a3fa53dde6c616f5003

SHA1
0f02cb11f3900cd9ff9d9e1e737976a61ebc5d3e

SHA256
dd14f253b8d0c1397d882a86d087b0fec77491d789facc755048e48ff7df8b7a

SHA512
75a27976807e821a8bb7110cde327657bab5b6881a31d133ad24bb11dce86af55c5278d0d81f7b4a0a39b77bac24aba0163f280dff849d14f81117e8dbb8259f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
108a44a62312bbebd134e8602480bc15

SHA1
601c2244995e68802a149d32fe79cfaa5c28da54

SHA256
0d6136fc565c0e8eb815f6b3c8f55871b6d70afdd2ab64b706d75002946828a0

SHA512
3670e5a3c38898a42831c0a379b436be2e9a4d9ace5d156f2db549e59e2a6a354ba1eb4cfe757e7aa31f173f47a5ca3e6bfe5cd1a35465edf3cf1b8e7339a3bd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
09f273218c56a77e66b9582e8d83d526

SHA1
2c5efa9232b4166b04c5154455442fc82d1c9457

SHA256
9661baf3c552006f578fcac233a433e51125145d3de25ac0cee544cd25e5e15a

SHA512
a8a1ea3ec1dd0b25f6d15418bcc1564ec42cfcc97d261dd00fad4743ccc7947bac5efeca5ac0181f24ec959c283f302bcbcaf86b7c4a2cea928dd6da2fb6f988

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
f4803e05456c933da120463af53bdb7e

SHA1
06af8fa0566e5f7e615baeb0c7b1c097f4093f30

SHA256
e37873d2db271ccf15422523d8cb94f73c3eebb3d2d8254b0bc0bb6c3ced4ea7

SHA512
a00581005c8316daae85122c459c05c22a05e901f057ddfd285df51ac098ca1e05ad158ee864d20fea6a2605dfe453fb9e2515ad9def981cb9b958e99d3bf55c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
c2324417369436168086517a05b291be

SHA1
14002ffcae2a4696159e3494848c1f7b41895553

SHA256
bd828eb6ad0af22da2e242105476a561ef292abe6aa0d5f7dfb81e8209ebc1fe

SHA512
841bdfe9dc2282dfa860f7c8fe4112c2a31101696814df4bc3834fc0ce6db1a68daceecf1439ea5b0b683ac13e45d7ead2766f5842ec36ce2ece314c1b05dd0a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
c63a4782fe7df11861821c6943fba2f2

SHA1
d9a1e5d5c1bd1e0a7b1c1d2eaf3018d8a524c8d9

SHA256
52013f46ef25127d9a80228150df6c360e98ef3cba9355d38fe1e7122713152e

SHA512
6c4d1559e5236c6b5785a6cc4075aaac3df268dcf05d33f1bb9d11e03d72da8e63d875725bc3d9f38ac1ef6547ad02e06eb64ce8b10402ae53454c87e4140095

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
95d51dc0a3e93585880ff780a87719f5

SHA1
7965ee6106da64b7be3e4d0f19ca3bfdb5809783

SHA256
81b90916fc6224dd182485fa448b5833fea24ceafa78bdf1e449b3353388cf53

SHA512
ffc16a812afa72573c7b0f674ed607d0cb554fef61de0a74e412160fcbc2c38eb48bcbfe034b262ed9ee256551c02826263c5105ed8209e44a330e3fd039b17b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
a906fc8b767aef481f6d861d6ba6eca9

SHA1
ffa41c2c02e6906e8d80b396b106e4a2e9eb4a10

SHA256
e6da8434cd5286178b36c86113ccf219ea36132c67d27144a7d2f1ee16f51dc1

SHA512
d60c0e28b47a32578d4b427ed2b93951057f10fc685a156a0646d44703ff87af64d25fef29172ec82688ae8ad05b2ba308dbdf8667ec271f0cd38404b83b38db

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
09a61bdb886a35bb08e55b0538c81525

SHA1
df34e9cc8cd95c93b888e5aa2e1a41939f65f54e

SHA256
06befe63b04eea608364e9ba60a9b3c9b2c73051e5b305aa4416b858da65aecf

SHA512
27370f4b494debce7e61c98b268ca2ee5be2a03ed148a8ebf68ceaa19b1600b3994d9058cb34551b617259452ad4c1a26c401b9b1131205c6968b72b3573d350

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
edd9db3020aa6c5c0d4639b91dd81d1f

SHA1
952a6e1a4434f0a7076799e4ea47d108eb15c7b4

SHA256
a4c0b21236a84fc3ec85f91564ebc3a7f5d9c62585e782443c6ca46825172bf9

SHA512
00b2010504e16bc86c18ff3613b30fa7cefe6fd03f8ac229e55747f2c97271008ba43f703e9ae3c9aeeddc7a371008fd056e27ffe879a21bc6102eb46e88bf6c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
67df457fcf787744a7c16d9e267a2602

SHA1
115e7552ca0af6e9bfecc284fa5c868b8e101388

SHA256
888fd71045dca269a3c63bf3aa6783652ce4f45ac7f3741ef7c14cfa7c1a493e

SHA512
f009cdd184ce9e7e174edd3deb55b34d7bb17b859fe8c52e47648af31601437dd0970d45e8edb506d798939f14f821ce6439547a5757f064d3dc7afa4dbb958a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
515ebb7be575a28024e17d363cde3d43

SHA1
cfeba5af3f1785c515e2377d59501e759ce5703f

SHA256
3cfbb80b8c696f17ebff14c4b8e04ac9bb9ba63e4fb0d32a3ea46223e83efcbe

SHA512
3e598e5fcc9fdfc82601a9b821f45718ac2f53dd4df0f98743c02a5ed0ec67956e6987ad75b25879975260496d8dfe45be3887c7e2e69689fcc0fdcb6d941067

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
8485671ea94fe42dace6a7f6331cdf1b

SHA1
0bf336932b5c3daf9909398b600286c06060bd77

SHA256
460cf437f31690ce0d8c15d0ea1785838d64c1ef9da641cb170d2ebcb659cb5b

SHA512
8fa76b0d7ef2c8e0bedc3f336afc9b6a37f4357338519151c6a55e87088c5d10ba966b5bd127a062233822b0c595a9e376a51a1aa3fe3938b518948929e0eb6a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
9103d80305c60a3afbcf10e3d19e7c2d

SHA1
a3729e4fd7655850fe318f54a0b9100c82e73794

SHA256
ecf572706119064144993e290bf87dddad8fb4affe4a35b828dd456783b2e6bb

SHA512
00b94cac53cc876eb117df8ceea9728f045ab4c81eed43167cb269d53bcaf2090dbe1fc92814b296c6c227340cb3d3602f26f6d5bb88cdd88fc66eca950a8a32

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
37ffe5690e4c2ffa8fcbd5043892b347

SHA1
3749f1d9a6d057dc022b467e6bbe04c010c751c2

SHA256
f2bf888f043908a0875b7dbbdd3f08931c5f20252d36b3d7aef12356a04c4543

SHA512
1ab4debda9dec6e991caccc0c664b4ff5aaea13a3991456391e0c015fd0afc48f3355636b56d7d78b5b1af8281c65a2fb5b69b0cd88805ac42d36f77517ac2f4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
9cf0a0e93e9cd5cc5bcb786a67d6b71b

SHA1
e54deda344acf08b3871e3212d8c97848c88b383

SHA256
67ba8dfbe1d2c073f3ea6305a4ae3bf08b4fb9cda4a72fa714a7b2bc9cca2d45

SHA512
dac29920f651311069fb69c87d4b8db0d04fe2d79dbe58ff66a7739a21d29cc2b4df4f6b507925a28ac060e8448f70321f99373836b65824d755fd986caa24c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
7839cc475648c610061e995405dfdf43

SHA1
2fc7fd7d882dadb0b03120a0cbf5f67e131ece79

SHA256
38c1a5108fa1d5d2044867042352b5f628d8fa0f899991508bdc6898c078010c

SHA512
95973feee80273d42f7de92c947d0bc1f63b9625a130eef8f700d2ddf040867f2209913aec39821a33a4cb5fd431cf6415f00487744178e6625837f02d712ecd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
6a43c8b6f639bad56fbda3958e0047c2

SHA1
d7e52d107a28270c50ecfde15d6fab269c88cd43

SHA256
5b1d1660c349de8e95fd0ba94e72245c7f5e5779445cd5567296b155863116d9

SHA512
8543c472b120558339bb8cfc7756364a4e97362afd57b1d6951680253f9baecd05736c73550e3390d481099c2dae92478db6314383a7f987eba9f412ba2e34b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
ef5187472c59e6bd9b3f7f059607b24a

SHA1
5780b7b19077aae545a3039bf8697e5c5d843fed

SHA256
b1b356f44163064a35dbf5a9a57aeeeede011abc85893e3f202a2740010f7190

SHA512
93e00e70e540807dedadf60f2db31e64c376694ca79a136cf93b426341b1303a1f4e36fb4e353b0b45a6bce3dc79f4c4387c86e690784de255ef8ef5d88de6d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
7c10a83c9adf2e858a4ccb789acd26d6

SHA1
41d0cf9709358105ca3ce28fd9fc1b9452784c85

SHA256
2841c8318b2887b5e1841a2bd5c81b55f55314e9c242d3488e6ecb929dd46fff

SHA512
2116870acc5cac6f1b3ccc89b9297d9b57d7f3f1a2fc95ce18e763a4a3f912c5b74efcbd920c4022e4fbf8f6e729de42b9163f4c1ae6c8f9e0894c30abdcca90

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
a860d124dd878081d4842aa2a1586937

SHA1
b8209f7d6142ff88a054a09caf4dd9f9e4bf1c33

SHA256
bcd095dd5eea43121bbc09009642ff3e139db8faa69ebc4f8af75493d7d70666

SHA512
63d30c85dc349352f04ffed164b1378c96747495d80377787b8b07ac2847ecd260099152c762f185e8c90f17b59e84ec05305ae62652376419d1ca15197eb03b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
e8e0efa01e175d31d0d0d210a1475fc4

SHA1
e3b02acc82cad6ac16329ee8939786ceddd7cf09

SHA256
b1ac9e51c3c1b3cbf1a11678ee6c03226d2bb8afc2c03525c464be6d9df202f0

SHA512
1ed165a2c68a93c746bcea4f50cd132bdd6cc7080281bd8856bdae02c7c540098a1cb3f685409f7c388d57e7de5039882ad1701ccfe121d94f9aad0993c54978

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
12KB

MD5
701bee2fc417eb52440801d06fda838e

SHA1
7eb6517edd8ac99926a614bfefb8750fa119243a

SHA256
7081c6d0aff23caee20d9114973f868ade45d949cad743f35ed165c00334e271

SHA512
b9877faf0325c39e483da575570b83bd6fbb236202942450bbb2e37179fb6fd107ce0ed6181ac9d5197716bc3eb19397d8545c7dd3d3643c53665d123693dd37

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
272KB

MD5
2dc7160d20529e42a1942f96cd4e15d6

SHA1
ddcdd856ba1c1a3be9b0a8ae4aeda90de7a30767

SHA256
d0871c55f97bfbdf21ba943993c53ae4082f3d20eabde79bc41b8bde4c7bc77d

SHA512
193f07b4b89bcf74c9a2d9b4d8aaee6038f287086d6a80b23ce176acbc14fc0e8383c5b98b913e058076b41b193455ba1e251527e6a67fdf1b749415a5ab6120

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
272KB

MD5
e57ecfb8d7ebd17e820bccc133332690

SHA1
93fceb5a823b396784776b16fecdfa25967b3bfe

SHA256
8e8f2374799ed86110099ab1687cabf40d1bf911b455507a41e71f9010c97727

SHA512
4fcf0404c5bb536f783bb4d7fa9cc91e343fd6ef4e87eabb04be5249739a09ee0eadc2cbe3e595dc9d02af310b91dedebcb93a8fbe3c1c22df80e4848d2b70bb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
272KB

MD5
f18887f6fd5609db4a07cda6be485aea

SHA1
f92a0f646c35f0bd8c82ee6f3a2ac4903481fa2e

SHA256
7609c855c195e3e27d4ee924dc55f68610cb8c5121b31be6bbd8fd3efc60932a

SHA512
e0c49a53276d833bec81cd828e56458bc85c38a01f928957d761d07d326cc558a0ad7b5609a1aa36dc86c79f5be88616cb991781398ab4a10a792429a5522363

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
108KB

MD5
4da4baa7debc9018d4343719fad662cc

SHA1
2e44ca699f393cab22c018039c1ce1a499366c06

SHA256
ba2dea4a38d707189940b71ac5c3222b67dd345272b6f204dc5bf0af81fe560c

SHA512
6c6afc2067e8bf85c1a0094951f22b473d6b0972f40147bdee299aee517946edc902999114d298482d02f6bce4bd82e35c54b1bd9ab77e1aedbd47981a4849d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
110KB

MD5
23892ad5d6d56242d5701114fc237b19

SHA1
9cfaafa77a226c7332f1671c57f0c9f52f050728

SHA256
4ebc20aad963350aa0a2c4883176dc44157067cba916272474dc5f6c32e3b8ee

SHA512
c7177bf2bf46f842dbda372f0f741286c181acac3c4d59ef95dc4adf6038b0e54491cc141972ebf1193cebeec6e4b8d8bf3580a9e198a7cd93532ddcb4fd9960

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
98KB

MD5
c6e11a02cb4698b5163cd2eb9e1864a9

SHA1
d6d8008c483f630f0ecb589723832d0c58d7f575

SHA256
95aa3b4fdd4dbeb02241976f308b2a977d6240823157d985bb2a30987a5876eb

SHA512
848a49675367ca3c6ea486f6598f222cb2ff54b618be00f0cd67ca6256425cf40231c59aafd56f37deb55d8878717472f4a43f0c4c934da6142c9599baf912e0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
112KB

MD5
02d6975418e2c1f1361e46dd48190911

SHA1
319fe9676c4d1cc25e9f4ff7ee880a26917a96a4

SHA256
22700800989368e208bc9b3c791043ca7989df6fb65aa192bac803f941e8b6cf

SHA512
d918b468731e16d3c032306eeeb25d4ca3c2e1352e28fa24021b7d0644b037f2471dd368d63f224a26322c79d1790ae83c322fb229ba002bb9240bce663262f3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5925be.TMP

Filesize
93KB

MD5
ff8b46531ac5a8762ad3f36dcc7e00ba

SHA1
9aacc8885682ce9d3d4090bb1e89a9040e313c84

SHA256
fb63f89f2ea93c485734e11aff6f68639a6be1b06e1fa4eae572d52f526fcf4d

SHA512
2162f1df64f8dabcb0f7fe71470a63a5accc50378902575bb357fbc87da034054a48ef3a5cb33f978282cb8a9568422f68b8a682ab009f6915b4374579dcfbe2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ec467326-cffc-4ad1-b4d6-0e22594eea53.tmp

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\Downloads\release.zip.crdownload

Filesize
445KB

MD5
06a4fcd5eb3a39d7f50a0709de9900db

SHA1
50d089e915f69313a5187569cda4e6dec2d55ca7

SHA256
c13a0cd7c2c2fd577703bff026b72ed81b51266afa047328c8ff1c4a4d965c97

SHA512
75e5f637fd3282d088b1c0c1efd0de8a128f681e4ac66d6303d205471fe68b4fbf0356a21d803aff2cca6def455abad8619fedc8c7d51e574640eda0df561f9b

Download Submit
C:\Users\Admin\Downloads\release\Client-built.exe

Filesize
78KB

MD5
a4b35f10a18f1c4360b00f828abbc2b5

SHA1
78c9ba86d8b3ca966b66ddb182c08268c79858a6

SHA256
b4ca7c2c6efafb1d7402096885dcae56f6fb3d845b758ed3c1cfef21792e1444

SHA512
47703141997cae647f52f692a62b38bc7543f739b5334f387f8753716cadb488898abeda21732b13c7153e0bcbc76a44c9d821f899c3b137892587538296bb3b

Download Submit
memory/1600-368-0x00000000057B0000-0x00000000057BA000-memory.dmp

Filesize
40KB

Download
memory/1600-366-0x0000000005E20000-0x000000000631E000-memory.dmp

Filesize
5.0MB

Download
memory/1600-365-0x0000000000E20000-0x0000000000E28000-memory.dmp

Filesize
32KB

Download
memory/1600-367-0x00000000057C0000-0x0000000005852000-memory.dmp

Filesize
584KB

Download
memory/1600-799-0x0000000002E70000-0x0000000002F92000-memory.dmp

Filesize
1.1MB

Download
memory/4636-914-0x0000019DD86B0000-0x0000019DD8700000-memory.dmp

Filesize
320KB

Download
memory/4636-910-0x0000019DD8430000-0x0000019DD84A6000-memory.dmp

Filesize
472KB

Download
memory/4636-911-0x0000019DBD500000-0x0000019DBD512000-memory.dmp

Filesize
72KB

Download
memory/4636-815-0x0000019DD8960000-0x0000019DD8E86000-memory.dmp

Filesize
5.1MB

Download
memory/4636-814-0x0000019DD7710000-0x0000019DD78D2000-memory.dmp

Filesize
1.8MB

Download
memory/4636-813-0x0000019DBD060000-0x0000019DBD078000-memory.dmp

Filesize
96KB

Download
memory/4636-912-0x0000019DBEE40000-0x0000019DBEE5E000-memory.dmp

Filesize
120KB

Download
memory/4636-934-0x0000019DBD510000-0x0000019DBD51E000-memory.dmp

Filesize
56KB

Download