blackguard | hxxps://gofile[.]io/d/ijTJn1

Analysis

max time kernel
657s
max time network
670s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
09-05-2024 12:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/ijTJn1

Score

10^/10

blackguard stealer

Malware Config

Signatures

BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	discord.com
48	discord.com

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133597313731511666"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Project Xvem (1).zip:Zone.Identifier	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3944	POWERPNT.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4352	chrome.exe
4352	chrome.exe
4468	chrome.exe
4468	chrome.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
676	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1480	MiniSearchHost.exe
3944	POWERPNT.EXE
3944	POWERPNT.EXE
3944	POWERPNT.EXE
3944	POWERPNT.EXE
3944	POWERPNT.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 3500	4352	chrome.exe	80
PID 4352 wrote to memory of 3500	4352	chrome.exe	80
PID 4352 wrote to memory of 3052	4352	chrome.exe	82
PID 4352 wrote to memory of 3052	4352	chrome.exe	82
PID 4352 wrote to memory of 3052	4352	chrome.exe	82
PID 4352 wrote to memory of 3052	4352	chrome.exe	82
PID 4352 wrote to memory of 3052	4352	chrome.exe	82
PID 4352 wrote to memory of 3052	4352	chrome.exe	82
PID 4352 wrote to memory of 3052	4352	chrome.exe	82
PID 4352 wrote to memory of 3052	4352	chrome.exe	82
PID 4352 wrote to memory of 3052	4352	chrome.exe	82
PID 4352 wrote to memory of 3052	4352	chrome.exe	82
PID 4352 wrote to memory of 3052	4352	chrome.exe	82
PID 4352 wrote to memory of 3052	4352	chrome.exe	82
PID 4352 wrote to memory of 3052	4352	chrome.exe	82
PID 4352 wrote to memory of 3052	4352	chrome.exe	82
PID 4352 wrote to memory of 3052	4352	chrome.exe	82
PID 4352 wrote to memory of 3052	4352	chrome.exe	82
PID 4352 wrote to memory of 3052	4352	chrome.exe	82
PID 4352 wrote to memory of 3052	4352	chrome.exe	82
PID 4352 wrote to memory of 3052	4352	chrome.exe	82
PID 4352 wrote to memory of 3052	4352	chrome.exe	82
PID 4352 wrote to memory of 3052	4352	chrome.exe	82
PID 4352 wrote to memory of 3052	4352	chrome.exe	82
PID 4352 wrote to memory of 3052	4352	chrome.exe	82
PID 4352 wrote to memory of 3052	4352	chrome.exe	82
PID 4352 wrote to memory of 3052	4352	chrome.exe	82
PID 4352 wrote to memory of 3052	4352	chrome.exe	82
PID 4352 wrote to memory of 3052	4352	chrome.exe	82
PID 4352 wrote to memory of 3052	4352	chrome.exe	82
PID 4352 wrote to memory of 3052	4352	chrome.exe	82
PID 4352 wrote to memory of 3052	4352	chrome.exe	82
PID 4352 wrote to memory of 3052	4352	chrome.exe	82
PID 4352 wrote to memory of 2228	4352	chrome.exe	83
PID 4352 wrote to memory of 2228	4352	chrome.exe	83
PID 4352 wrote to memory of 1356	4352	chrome.exe	84
PID 4352 wrote to memory of 1356	4352	chrome.exe	84
PID 4352 wrote to memory of 1356	4352	chrome.exe	84
PID 4352 wrote to memory of 1356	4352	chrome.exe	84
PID 4352 wrote to memory of 1356	4352	chrome.exe	84
PID 4352 wrote to memory of 1356	4352	chrome.exe	84
PID 4352 wrote to memory of 1356	4352	chrome.exe	84
PID 4352 wrote to memory of 1356	4352	chrome.exe	84
PID 4352 wrote to memory of 1356	4352	chrome.exe	84
PID 4352 wrote to memory of 1356	4352	chrome.exe	84
PID 4352 wrote to memory of 1356	4352	chrome.exe	84
PID 4352 wrote to memory of 1356	4352	chrome.exe	84
PID 4352 wrote to memory of 1356	4352	chrome.exe	84
PID 4352 wrote to memory of 1356	4352	chrome.exe	84
PID 4352 wrote to memory of 1356	4352	chrome.exe	84
PID 4352 wrote to memory of 1356	4352	chrome.exe	84
PID 4352 wrote to memory of 1356	4352	chrome.exe	84
PID 4352 wrote to memory of 1356	4352	chrome.exe	84
PID 4352 wrote to memory of 1356	4352	chrome.exe	84
PID 4352 wrote to memory of 1356	4352	chrome.exe	84
PID 4352 wrote to memory of 1356	4352	chrome.exe	84
PID 4352 wrote to memory of 1356	4352	chrome.exe	84
PID 4352 wrote to memory of 1356	4352	chrome.exe	84
PID 4352 wrote to memory of 1356	4352	chrome.exe	84
PID 4352 wrote to memory of 1356	4352	chrome.exe	84
PID 4352 wrote to memory of 1356	4352	chrome.exe	84
PID 4352 wrote to memory of 1356	4352	chrome.exe	84
PID 4352 wrote to memory of 1356	4352	chrome.exe	84
PID 4352 wrote to memory of 1356	4352	chrome.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/ijTJn1
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff89914ab58,0x7ff89914ab68,0x7ff89914ab78
  2⤵
  PID:3500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1516 --field-trial-handle=1816,i,7983688442040321290,12119061365755506519,131072 /prefetch:2
  2⤵
  PID:3052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1816,i,7983688442040321290,12119061365755506519,131072 /prefetch:8
  2⤵
  PID:2228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2172 --field-trial-handle=1816,i,7983688442040321290,12119061365755506519,131072 /prefetch:8
  2⤵
  PID:1356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2904 --field-trial-handle=1816,i,7983688442040321290,12119061365755506519,131072 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2924 --field-trial-handle=1816,i,7983688442040321290,12119061365755506519,131072 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4200 --field-trial-handle=1816,i,7983688442040321290,12119061365755506519,131072 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3148 --field-trial-handle=1816,i,7983688442040321290,12119061365755506519,131072 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4544 --field-trial-handle=1816,i,7983688442040321290,12119061365755506519,131072 /prefetch:8
  2⤵
  PID:844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4704 --field-trial-handle=1816,i,7983688442040321290,12119061365755506519,131072 /prefetch:8
  2⤵
  PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3252 --field-trial-handle=1816,i,7983688442040321290,12119061365755506519,131072 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2960 --field-trial-handle=1816,i,7983688442040321290,12119061365755506519,131072 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1476 --field-trial-handle=1816,i,7983688442040321290,12119061365755506519,131072 /prefetch:8
  2⤵
  - NTFS ADS
  PID:2004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4960 --field-trial-handle=1816,i,7983688442040321290,12119061365755506519,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1808 --field-trial-handle=1816,i,7983688442040321290,12119061365755506519,131072 /prefetch:8
  2⤵
  PID:3096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4448 --field-trial-handle=1816,i,7983688442040321290,12119061365755506519,131072 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5076 --field-trial-handle=1816,i,7983688442040321290,12119061365755506519,131072 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5224 --field-trial-handle=1816,i,7983688442040321290,12119061365755506519,131072 /prefetch:8
  2⤵
  PID:3088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5396 --field-trial-handle=1816,i,7983688442040321290,12119061365755506519,131072 /prefetch:8
  2⤵
  PID:4104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=4656 --field-trial-handle=1816,i,7983688442040321290,12119061365755506519,131072 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5980 --field-trial-handle=1816,i,7983688442040321290,12119061365755506519,131072 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=2960 --field-trial-handle=1816,i,7983688442040321290,12119061365755506519,131072 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=5504 --field-trial-handle=1816,i,7983688442040321290,12119061365755506519,131072 /prefetch:1
  2⤵
  PID:4108

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:2368

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2616

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:2884

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
PID:3116

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2168

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Project Xvem (1)\Project Xvem (1)\Project Xvem (1)\Project Xvem\READ MEE!.txt
1⤵
PID:3064

C:\Users\Admin\Downloads\Project Xvem (1)\Project Xvem (1)\Project Xvem (1)\Project Xvem\Project Xvem2 loader.exe
"C:\Users\Admin\Downloads\Project Xvem (1)\Project Xvem (1)\Project Xvem (1)\Project Xvem\Project Xvem2 loader.exe"
1⤵
PID:2296

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Project Xvem (1)\Project Xvem (1)\Project Xvem (1)\Project Xvem\READ MEE!.txt
1⤵
PID:4388

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /n "C:\Users\Admin\Downloads\PopSwitch.potm"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000012

Filesize
69KB

MD5
1aca9c8ab59e04077226bd0725f3fcaf

SHA1
64797498f2ec2270a489aff3ea9de0f461640aa0

SHA256
d79727a3a88e8ec88df6c42d9bb621a9c3780639c71b28297957ada492949971

SHA512
d63ebb8d19e6cbe9714603688bc29eda4e347e1bf0bb9b0b7816225220263781b84966413a946feb4ae27750371de01e03092dacc4051116073c518d6217fe65

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013

Filesize
323KB

MD5
a2b738dc623afe09b027f4dd219ded5b

SHA1
8ce89365b9af503fc27c5f4cb53dc84b497ea9e8

SHA256
f8b46aa6e0316802cdd4dbf9c77e807ba44816859e78032dc31526f0a1e16c5c

SHA512
4b975bc3c0c52ebcd4a772526c893aebe204653d261fdb39b122c0066bcc6145804c8677d7bda5c7b8f491366a0c0156068174db850e7f356f4f92e6c780666b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014

Filesize
140KB

MD5
88e0259471573ca8f8e00897b1afec25

SHA1
4f96c2ce33181a76b602245d23b8e5f259b9a8f9

SHA256
3e3ed2a537b78142b86afccebe2a3b3d7f06b57a2f7713f79248b6b33312bea7

SHA512
66f1e5f7ef0529c6dec933f47bf768b29a61f0decccc0e7e36d1cc6d7b1e25c382da39f089161e817909f3f8aebec50e2b60731cb64dbc7e37700e503e5c8abe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
2KB

MD5
71611e2a7c75c0b11aafd9700a8fb7a7

SHA1
14f001f94f6edf43bc60df822a5a9afd9928e0c6

SHA256
a3e8b9266468723b8f94cdf6e14effb1b002efabb7515c61564b39fdfc762ae5

SHA512
ead4138e441d775507e6ef43b39527a2e298fd7eba01dc63fa6bf8bc295e92f657c57f9260b924643a274e67aa8d6ad343f728223dcc36b905382bf08dcd9346

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
b214f93eba516f41ef8d35498273e145

SHA1
3e6217b911030ef204a54c63106f920526bf4e2d

SHA256
1c003e179663a1a78f3fe9c10e583cadcc6e0c22aeb7126bd15d44765054d8f8

SHA512
a299e986bbbcd8b42a233732943212070d26f16aa15d6c7e1577f217348360f866f807e970f03c9c9f11fe4d6aec70e3d5a1e9db5e420af58b3c2c833dc155b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
74c07c0332b66e9fd11293aa269e5ccc

SHA1
1eca251600b61f18f0fba36498e8ad5d08c6bafc

SHA256
c80c20605deb9ae277b166fbf07556cfa34f1ca2bd10908e9551adee63bbd42f

SHA512
6433d74d541d835e9cd3ff9b7d83e1fc3e649c41dc531ffa2b62f2d94d7e774759c2b5c4c13aa9bdb4f3724fe6e1da656a3c727fe90757aff5de98a01c873f1f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
bd2af23610d6c6193be76a1f45a847d4

SHA1
487cf86463fd7aacbbf84978c7809477ff738460

SHA256
d3d5168681a757d2390ab5ab9eacb965c949f744e90a715effe48fb05aa6ee6a

SHA512
89b99518abbab84b55f448e1acc20106908d016d74c37f883c62f3ae1af777e3c510079cec7a9996687dc7fdd22c34964fd741ca8b3f0c3d0c7b8e6ad864249f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
d7216cf55e420e0aa7c69f264b106d7d

SHA1
057ee114a5820994adeb7cd228f065da07a23584

SHA256
200b4ef7a1d3875ec7479007a272027211ac320a3fe5278f5a3b4038e1d21051

SHA512
022696987a9f2f28483483e3d77a9f1805308aed18c3a995010f923b71ea9bfe5385b65648989f3846dbbbe9a7af347ba9ac3900bb286084a836e057e01a4bb7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
3cba7ccb91136e22cd741da067cdeed0

SHA1
6d4cf0f8ced16c40daa7793c8cefaa8571bb9394

SHA256
090c34503162b06fe33664336d65800660163691c92588a21411b351a01275c9

SHA512
9307307bf2cea13b5cb98a046eed5f5c1cfb75b9a5445f4842f7ffd9c085f08ec035227cb9c1d9ca6ed2edc79ce47447d453aea2db12829b4afdc626c238510f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
af45501805c2717ff04130aea6c3b9ed

SHA1
42d542760e36c8bc5e2967b202b8960a20d5e591

SHA256
d8fb1f76391b2cdbcb700e5210d0f30ca224fec6c689a7dde38fa7f0ff4fd84f

SHA512
92f13ae58e6e7ecc471e4b2da48e08e1747ec570738cfe758a7079148afd3fd72ad32fd92f339ad40cf03cd8bc4c20f78e6f9bc6f5c085de0da2ca4a77ba34dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
6c1b9da925d02adb79c8955895cd7109

SHA1
8af812a6f7b1978105105d4b3b5c63730307b7a7

SHA256
928981c230c1fe266af5d10faa513ca756156c69e1039091f60a82439932df36

SHA512
bd385159884435ac05cf7c8bda6a791a67e58d7f631248e685cde04a361cb14f213eb2e5c6a1f9fbad36de18b44ff96cf29b35b343216bb045c7db0dbd830eda

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
858B

MD5
07a6029c1420d08890762a551279365d

SHA1
b245b1632476a32b230f0ad5517b1db0a75fd506

SHA256
88eaaac6c46f1a12e28ca509a18b036097920957317f2eccdb0c847482322bf1

SHA512
9daacec226280b8bc230f9ae83052b87f15d05d387d2a3cd682f15529c6ffaa22b45f9b44f218d3e283837049a809be7fefb5a06c61d56224a598f7abfbfa983

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
858B

MD5
3a1567c0d15082eea72367515e297c52

SHA1
0a2730e85e89a29ecb1cfb85562dee08ed7149d5

SHA256
20e8198c4a0c27398fd022802c2958c71904f9fe92e36a924d45475cd068f248

SHA512
882d10fe7328af02cb6b78842d9148c6ee95bde6cb4528b828a65fe7087e14b907d46a97458bb72887b825a09047f2d92820d29be44b94680747436c58ffe4bf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
858B

MD5
3feb9bdfa193bc91d225cf52b4786c9c

SHA1
3b15169f083f121c92d56267220415f588542271

SHA256
691604c56e0c052fe11c14d483669278bf402a9320113cc7498244d13d937f65

SHA512
95b862ddaa4663fff0d46a32b82d11a73e57f45e26ed2aa2f3eff3a704e0632ceadb337ef11aff90b772dbf1d0b622395da827b550abbda9ab424e8d1e4bd22e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
93fb6f0af9eaf7727686dfd9926a20c1

SHA1
720055d732b54ded75b7914ce9ced7d8890a5aae

SHA256
43007b5789a63b0f14f09eeb528c322bce4e91e14e144eabd181d9fc82aa590a

SHA512
d85473eb9907bb0101bb41f701cd2a5e503a6125b6583d20c4a6e4d65a0ff8fcca81630a84e4d237d47df9b8892864a0f05bb9cd7c2142b22582e66619d51814

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
9ef2106ab3a32491c0cf806676820139

SHA1
d9cd603de709b389c85cd8220998c74600f0e29c

SHA256
7ea69c7b9d542e827cf80e7d4bb78fcf9597c32c3e399361d5c38d3c5974fcdc

SHA512
b5bebbe19cff3c7a6d1788de2d39f361b10421632d5b631bd9f20c36b902c3cee77ab78e1893b115da061d2e8a1eba1e9fa44ad64ca51de01bd90d243cdee124

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
be2c420796b7a9b4141fb7dfda92896f

SHA1
215416debc5864cea9ec85df18b0dbc47402322b

SHA256
78043289db1d2bfbdb7989fb07bb0fada90e6a6e12f1aaed27469eb3b0e28ac7

SHA512
af1ba7f6d37162bc5e3b558060556388c49c0f7d7d050374c4f9da1c884b372f287741fdd20b724eb19b2ada78d86c2421ba246c4de09cf2830bf4cf19e0457a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
858B

MD5
c54032336e3ce64fb517a1d1a57cd11a

SHA1
b207cec2e78a4da02e07f643b684124fdd9d6cfb

SHA256
bae8de0572198b6b11c28b3b8ab3597ed418aa861d9729b44d494e956ff7140c

SHA512
8ff3e43eb039edf2d454b1d376dd5d106a4c65cf4a44e8ff6bf77b5c9aa7c8830e77f676386f76a3a4a7888ff96df1747d0ea3b24f6635b4015c9b63eb09a682

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
858B

MD5
b099c2c6a192a58cedce919d1a445443

SHA1
cc8ad6e8d84d672df93893abc49fbd76fd4ae38d

SHA256
9ad9ff7eb89fef36a79bc5f5feb66b3a07d5de2e7bfb4acc835f23a4d895c145

SHA512
28c023b590e80d29ba100b9bd3c1bd50099a4c65c0d9c22b54545135e9c631eeda588a548cb8250234a040f407fa417c256a96a1a09066027a95ef8427e4a875

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
f5bcdc9b7e6c3e4750e75584e3df019a

SHA1
f06ae23e1ad29eea023e2e7dfcffe12d2364657c

SHA256
cbb1b50947f5ea7c60a155360e668160271496cb69547e810728b48312146892

SHA512
25001fa25e4777e79d4f45b347fcbf0ce3e758fa39e89e7132880e1c57720ff522c035d88533d879a1888b7f9a620b39d9842905c0da6e774b6c1ddcbdba3442

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
632606d8492b2d8830c52c2456f7fa65

SHA1
551b11e8f123a68c7846ee0366a1802a2537cf7a

SHA256
8d7b231e7091bd4833a3d3048ee07ac79645a48536af016451b99dd217b11679

SHA512
73dfdad9243f41f8e4c21aa4e589ee4ddf93d293c246c40515bbe6a706ad1920c092c5594b1b65f0ee282f1ca45454270080b99da4c25e5bf4fa4715a3eff1bb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
2378b692608d15b8a042c465026b1ee3

SHA1
f32cc1d77ff0bd588e27e17831780deda1a14d9f

SHA256
63af7e8fa04ad3f3d2a07e30487d2a5d5ac7e192d76d60c545017092c6964f0c

SHA512
8ad2848be12751c16292cb239581204edb928d185b1cccf0a183b12947a88150edd206b9b92bc1e1430fcfa739a1be212f6fb166b1aa3ce6c9dd7a0be1c4ec93

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
858B

MD5
41b0adf8785ab394623578f120f3d589

SHA1
44554bd43f3f45fe5e0bfdfb5ef8ee8a878295d6

SHA256
e1a6bc8a0a2c42eb48ea4c949c6acb3eb9572a65f5ab0a414b9fbbbafaf51498

SHA512
d679d0ce9277773a3accd82290c6f55c90485b4b0b9449b20c5ccae9ecad4941cdede3f52fe1e9ada61a4df8807a43eba419ee96ebe087efc41b6955431c8bf8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
8620cba90c78979669de1a34a48c307a

SHA1
14c3b73c370d9be97c2fd0e5058b408ca858ab7c

SHA256
ea5c6d7954bf999c3da21b9552e39b3492b10e62d7563fddb7b9c180460fed50

SHA512
1313ac07d3e3bed6959ac2cdcef356edac0abaad214fca590e5c248d4c42e6659a39b0442dcbccac760f3f83f3b9ccde06e34bba3d67f493a5ae0c19568f8f9d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
8e9992da2f7147638b3b44db5368b3d8

SHA1
1a23b4490cd4c36072507897e6ca1b189edc3f79

SHA256
ff07e87c4d1512c4d386516a7514bc12f518fab3172a603925d0314bee4c34ba

SHA512
d8ae482bcd9c406b09be64a5501e6fc3fe8bcfdf8de16632be8b33b1d7a43537dea8aeb3632a4630b19ed0a052134cf9d648bdd50988fc9b9f9c6bf40bd4fef8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
1f2d22287e68bb8f699c4c86675a0c42

SHA1
93f57461fc019692507a9ecfbbdc5d8e05251972

SHA256
4ada0938b9ff6426a8f6362550dba1aeb2c4cff89bb617f06fceefb8efc91c40

SHA512
64fb4deb30b9cb95e7ad39de805a1f8c4de321792ddbce87ed8c688c8850838487b9d36794e6fee284e7ed93bbda923ac125b0e83899ec1ee36cc2d25462bbf5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
b1b27896b102bcaf609723f3dea21eda

SHA1
65c61c99c86fe47f6d359d01e68f1a7fc5df8f74

SHA256
f3be63111cbc75adfa7c60feb199747f375a35ef435454553b329f293c28b276

SHA512
82461a5c9e6e32f359a792b818c6273eeaf1cb0403fb9a59f11d1f52bec9ceb73ef08eb19c9baf1838e3c4cf3322752b03d6de0e53dbe8266cc234566c042089

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
f5140e32f88d6ec3d52b2e40ae33dc7a

SHA1
d501b325e91f8e56e15a900c0c93d4f92594d2ec

SHA256
ffe769e922740cbc4c9af45deb481c5420cb00ca8de0094c4575f52f125e9d0b

SHA512
1f31d4537094c80a6ee263a043adf91581270bdbab18b5ba8edb537e11d7073107720465046f56cb447685abc459ce71247aadac2d08461599e5945104d07439

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
8c26cd5bfa101275800615c83ffc4479

SHA1
9c3822f5ae8106d5903b512f837afb5d6f5be6fc

SHA256
ad5ac4d5d4f30f36d95b797e97d6f03810402c07e1bc709e6925d8c29ffd6ebe

SHA512
ab6694a1d88a4707eb99f259f9cd74d812f4c4d07e4f2d15dd5f407eca7f8adc2eda58ed391e8ef62ecc3b16a9f1757c24e1fabe1640cc9891c3073f441b1ef8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
131ae8a163bd684c1c022d577548a50c

SHA1
d3dea7a61a5ad5f94fc5cae2b98db62a7eb8b2f4

SHA256
8e990016ecf140505c989e18a78ad9258d4c592d80428f0726cc8e9617a75182

SHA512
ed9539b77d4254a104114bf7eaeb7555e7ae5640b6521354bee8097f56b8668295c629758d7c6b002dc39e0a671cb0676d308d0f8c1b116cb0b88a0b0dfcd73a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
8454535654f6abecb9a0cad190545d15

SHA1
3b889663eb909ac12c5223a936ec531cf47a4f92

SHA256
2c8de93e51fb788581169f6e7a5da0a3ed722d26a19721cd5cd8cf259842b2d8

SHA512
493aefdca15a779d89b37cea31c4f235d54b69e21112a55287329999f1c22e7b33b2efdfe538b6deb2cf6deab10c028785af162b23b945358ddc5a53b316ec6c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
6839c8437895b9311cb9c596c13e4e47

SHA1
4d9dbd8fca5cd7fc4a7d05446033117ec960eae5

SHA256
8d3f7ddbdf377945e62f396d562158da02e83177a980e10a8400e79a76b2335d

SHA512
3abc84a5285778ad785f25b5bf0c8e9b958e898795731545a44556741ac311ab8dcf14cfbbc07d2f402608a57fa98a98f151496360cc08e17171942ce1e7fccc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
21da23b185f7def9fc36fb4e4c08b73b

SHA1
015e0b0977e514b473c20bd413b98c84dd10ae61

SHA256
fa28a0b0fa37cf5d8cd5109ffc0d12fd452a1713849df3732477a2ffbbeeac8e

SHA512
3d12a6e1e921122f931dda77f85067853b66ecf11fc8b5d32000e2b2800ef12bcde050ba499cf4ace5b65d98dd0b4087ab3bd745bab68e93a86afe446ad5caba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
a0d41dd8ccf9b4703acdcad81fb5833e

SHA1
ea7a2061c8dec0bc9d16cdbb05f5d3df4e339540

SHA256
e2c6d93a4a97b66815a3aff46f1b64be5846568c3a9972d2925dd636bf06f2b8

SHA512
1163b102805ac83c589f39ba58ae28ab88b9851cae9684ebd8b82d8fd7a753125bfc630248c171732ef2eb7582ee8ef8ddfbd0a0933216196f9ed98ebb77be6f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
56B

MD5
94275bde03760c160b707ba8806ef545

SHA1
aad8d87b0796de7baca00ab000b2b12a26427859

SHA256
c58cb79fa4a9ade48ed821dd9f98957b0adfda7c2d267e3d07951c2d371aa968

SHA512
2aabd49bc9f0ed3a5c690773f48a92dbbbd60264090a0db2fe0f166f8c20c767a74d1e1d7cc6a46c34cfbd1587ddb565e791d494cd0d2ca375ab8cc11cd8f930

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5ecc76.TMP

Filesize
120B

MD5
7fe505c5a0a1aa7367960cdf9280b2a2

SHA1
bd81d80b2854eb903a1fee2da27e64ebf5acabac

SHA256
eca619ea3f7ae5ad986035b8ab5bff2a3917954d3f1efcb323977a9805653e88

SHA512
10061f785da40527d61f8de3b4ab2461badaf46e6ce27eb8fe17bafe1db0b4e93652978ae5b17d9b1f3d8e7eb057dd634d984bf98b254026e597ffcb77f7a730

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
10d02506e20171c15fce0807cd6afac0

SHA1
e65ab035ac8b1ffb5ec234eeb0187de4585d88aa

SHA256
78fc552ceffa002f2fc32e37ff8505ce785a9b7dd223fceb443d7ebca8b60a8c

SHA512
467f94ace505134b70b9664570bcafcbc95cdb64ed39b6c57529dabf1b1d82c15671a3c2a6a88dc1bb9b1ea4caf09d9c400a07cec0e8dffd1f05fda230d013e7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
9642e6b74906610d574b867f5ae4c538

SHA1
4c77199ca8eff2cb43dd92b714396efdedaee0c2

SHA256
a815bf4f73e9ad050287dcbea269c9a2b1b4f6432d1f380990acb523547c28d2

SHA512
d95bbd977613515d2a016cd0fabc64df6f69f0c9130506523a8ca5630c4c36839f8f98555ca8dbd0e325c0dcc9fda317ede2bc0f18dcaa888329afe7377db869

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
b4cc59ae352f7fbe6eade7fc49c56465

SHA1
b9a88450f79019f3d8b2d5a6a9e3bfcc2921b9f6

SHA256
dba0e2cbd4739d20ea5ff06cc3e977335bfe1ccf52d67f02379327d7165e2074

SHA512
2dbf5affe245ccefcbe45d09ea8022c96398917dd137b5233bd83aba23cf1aff1255537078087467f4d4ed07d24591bae5a03c5a87a9a49a073656322b5e561b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
92KB

MD5
8b1c2ccbf447f478b54ec5941782a2fb

SHA1
52c477fe8f03f72a0494a1cce955c883007b485f

SHA256
41ce438fe6209cfd2ba9ebf8ec092474200429dd9a9f2c15d049363e1690767c

SHA512
5707afbac951a01a659c7d923c713377e533ce769ad772d5106c2497acec2c6977b31c7e1bb707228a8f15ff7095d990eba7e46f402054ebafb6fccf37860809

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
88KB

MD5
801b6bba2a1089df5a36e9aef8df2ac0

SHA1
1cb1640f8e2f6abd39fa9e1809a8d96df271360d

SHA256
c05f54d03e429f99b847cb3f8aa2a276edb3f5ab0308ac9e345d4896f3e03deb

SHA512
c5570e3eeb9d9010f6acddeebb6c404df007d8792935f85a7c885d1ab258cd7590240bd3d78fe05b9cd86e28b506ecbff239c04961463e2388f892a5cbc16920

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57ecc1.TMP

Filesize
83KB

MD5
c080feb7212442ac63cfb3c6671978ca

SHA1
21a772804a2e1f6fd66bc47e9c13724a705728e7

SHA256
a084aaad43ae1fce3eeb50835d8d8158441f1e6cd414b3689b32b0a3bb827108

SHA512
d2bab602af93d18d4d4c90e1bed5d125db827f499a843952a3f6b115e70ea4b25ce0020ffa9da25a03bd7c78c1f5b52560d3c5aebbf10fdc2fb13b17af9135a0

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
0e3aeafd55d6bd5185cac0576dc68cde

SHA1
138e081aba01626f9cbcf67c0a886a035cd1329f

SHA256
9227c44bbf30ab193b600d87eb927114d968ab9334f4b0bcbf185464576fd9fc

SHA512
23d308c78e35cb3c53f9d417f9e741c8cdda41cd9d32fb72547a3b5f2983831e9ac5e601f7f261386dde110cfe93e7a2a31e6d060a4454a233eb7fcd33dbcaad

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
2f23663111658be2ba0b273463ff5e60

SHA1
c2af77369b83a0177bfdb90c11fad4c5f897a983

SHA256
eab4709a1ad32b0b87a53d307893899eb3ee26c6a59a1b34fe83062c79817513

SHA512
e0fdfe555a47709cbf14c4c22498c89c3e8fd61c5b40806b9dd06aee20fbdcd3d9c4f7861d1183df15e9c64ed25828f97c8292bc6b4a700d3d4586433bf45bd8

Download Submit
C:\Users\Admin\Downloads\Project Xvem (1).zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\vcredist2010_x64.log-MSI_vc_red.msi.txt

Filesize
379KB

MD5
f204afffb75989e64adc2c96a1d7c02f

SHA1
64238b99b9a33d4307a17d625143956fe3c99a96

SHA256
76fa83ef73791ae99c04c953ac38ddc25834455c5635c627978fa8f009888b65

SHA512
b9baf5cbab138cbbf9c4e5b876e3cf3f59f69e8bbc31f036b69c0a84e23546d117da521319fb13701da0db1536939b96f9d885d1d21d49e839bf9ed1a1671584

Download Submit
C:\vcredist2010_x64.log.html

Filesize
86KB

MD5
d327ad428032183043c7dbd3cbe8e688

SHA1
996f8fb0943ee3464a2ec6b7d9bdd150aabafddd

SHA256
622e4248302d2308facfac6d4e39f2507f989f0daa0d1cd98b9ace8027d07071

SHA512
80be0f1d41a8410020067dec2153e423488f03fb6c0e358783458d4ac94bf32a0377e6e6838d7f224f49e2aca3382be810c31673ca171ba98fa62aabe8b59e80

Download Submit
C:\vcredist2010_x86.log-MSI_vc_red.msi.txt

Filesize
395KB

MD5
8bb6d87ea2f79129b124c5e5417f5e99

SHA1
e4ffd90a61c189643c3bfcbfe5edf24d475ba0b4

SHA256
13f6ad7a141900d669630722af180315eacffb7e4d699a13debfcf506476206e

SHA512
bec294a3329276abb761dc5a23b9d59498c0a2ae08471898525462f0516ac4fe2c84584fb462aaeaba0de4673c8cfe989309a60e271c05aabb7894063e63908a

Download Submit
C:\vcredist2010_x86.log.html

Filesize
81KB

MD5
07d8652e740d42fa8b4cc990693eeb3a

SHA1
23bcd44013fc0d6979363ea3f2d705e02f028d72

SHA256
3791ca0d170817aa756c59fae727f6bc4cd6508e561d26a2dff7a753166ceaa4

SHA512
0e53bfab6e9749d8aa1612cbf815f3de24cdb725e1af640f9757b5e7967a23db680dd471a78b0b907cef6c8d6c18d94184456cec45d07b25a9cfb9cdf079a3ff

Download Submit
C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log

Filesize
167KB

MD5
a0be039caa3324f39a1d275852f82fcc

SHA1
2c2ce722774f25bc17e7c28f7679c0c0cfa6cf9e

SHA256
04c8eca11d2cabe95415200d43132597b5baffa10cbfae40eca86651b84bcf4f

SHA512
ead48d9793f9c4945c2427dbb3cbf6bd1c7d78b2d17848b27bd5ab6bc60986b3bda5c37e86f7146458b51e6b1789ecef32a0a91e9fdb43f76ca5cb535bd8b7f2

Download Submit
C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log

Filesize
195KB

MD5
2dfd0dc92afe61cf3b345091acc30957

SHA1
017fb08144c07a4e7ecd24aedfd4754619e9e8f6

SHA256
820062d072ce61deecadee39a9444f81f353d69c5f0ba41e81a2947f4a943cad

SHA512
9d2039a5b70dd8f76ba675b8a05d3cc47342faaa4416997eff0809a470bffc5d2a28d63d4f986d58f463851751763ef088019e31c724fd4c7ea0d2066a1fdd96

Download Submit
C:\vcredist2012_x86_0_vcRuntimeMinimum_x86.log

Filesize
171KB

MD5
96e3477e2b8759ae433df66db8581e9f

SHA1
be201867d351754c257211e610932ce7779fcbbc

SHA256
e330f26b7294c9d3c5f927fef19baa7239bcd4ab5684a82196598ea2e8deeccb

SHA512
186445b3365179d977100478a0842b89b2d7b2e0fac7dbfc61b85a2b049beb64eef9192c96cd612f6d41b235b8d24f5dbd18db110af1324b4ce619b8a2624507

Download Submit
C:\vcredist2012_x86_1_vcRuntimeAdditional_x86.log

Filesize
208KB

MD5
4dba612fa094d2e58c8f37993d9609b2

SHA1
90c8e6fd263cbd242ccaf8d8c7de8ba756efd4ee

SHA256
b8cd7b791be3f5510ed7ce736ebf53fb3c80c2a89e7bd5d225dd46d429fc6c3d

SHA512
2d59273cb6e46dcdf98f46de41802d50caa467fe483baf59806373f5ba4ee56682824a0115bf306ca0ee5ae8581aaf74de2fdd15afba86207554a6f7c1469fa8

Download Submit
C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log

Filesize
170KB

MD5
39b81f617d8f41d03568cf77855cb451

SHA1
7916db242baba3444f9bcae7de1fcf7000b03629

SHA256
defa86bd4b56c3d6a7393f9478b9ad91f5ccd1a64cc0731545fba9cadbafe354

SHA512
092193f61919b0ee4db1f8db557e0fecada8b277ccc957e22840c87d6a78e2f2e236d78e7b32b43d011f663a4833f1190d788336b38687b4ef804d5a7b69d547

Download Submit
C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log

Filesize
190KB

MD5
0bad42d9ec439623df9e8f3470b64f63

SHA1
3e05442b4dfda3403cab885619b2f10f74f23701

SHA256
74bd67086a98f2d385c84a6a025973b7db211f4b9ebd16f7f46028bbcc86831b

SHA512
32d8cc70a35b616b2ba374656b908e441a64fb6afefbddc51f06b9b79bfece437b50b80a7073e0d375193c1fbb57d7ddf9ea4b2b47c87e5887016b1402d9295b

Download Submit
C:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log

Filesize
170KB

MD5
b5573404f0284845f4f2efb130eb8a42

SHA1
0c1d36ab45dd0f8ed0e4311d1b07b69cc49aa6e5

SHA256
dd8fbec62f98b9e1239e18cded93dca0c1940c75c2c2b71d531507cf32a0185e

SHA512
f872aa9938fead7c48027d11673dc53bc3478e080a24e56563c6d3fd9a005cd54786ea2020ee416c2b1c5d8ed54a71681631b8e4deded08838d906e95eda878f

Download Submit
C:\vcredist2013_x86_001_vcRuntimeAdditional_x86.log

Filesize
198KB

MD5
02af58b273d28d17b6edef1edc3e4feb

SHA1
c59d38bc2d3b941e551380072350c2f37c3316f5

SHA256
1174bf6d9765b725ed9aa3bd9909432d1c2d3800a50b8180132a86ec24532973

SHA512
307aa49fb24dcd0cead30d8037fe6373b4c63c9f72d45bb88e50a56f019ffed25631902f268fdf4033d3bb132d0af41ec46ca227f88f8efc7279cedaa9fd1fc5

Download Submit
C:\vcredist2022_x64_000_vcRuntimeMinimum_x64.log

Filesize
123KB

MD5
28d2fd5f38208953c1a3fcdcded5ce9f

SHA1
b6cefc066890f779b08255eccdc5a4efa330c1f4

SHA256
e46bd7d47dd42e248ae72632818478d28d1880ff4559406df036c02e2079817e

SHA512
1f60f017b3e2e843e0b5dc27ac4ba00ead442cb47ab5b53cd8f566eeddf979de6b13b9b085491c52b67e18e6788e027d472344d90ea7885b30561e9bed5ed562

Download Submit
C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log

Filesize
129KB

MD5
1376a2a119ebc501cb785d7a81dcd1c6

SHA1
b3706f7370ec499d9e1b7ee2098246f4f173e607

SHA256
f47f0b57b21a7119b59da97e35849629a8baceac187de11af72d1857e454a16b

SHA512
ced17dd93dc591353458ef0c9f2e7139fbcc72783ca50542717ed8f1fa8ecca98971420633c954732dfd3b747d1d321a099e8407691efe04214ea8a888637321

Download Submit
C:\vcredist2022_x86_000_vcRuntimeMinimum_x86.log

Filesize
123KB

MD5
4fa72f3aad50ebe39ad5e83ad194e970

SHA1
ddfcfa503ddbdeb7e110c494d18be1d68fbb6f3c

SHA256
69ba59dad0b90157a6e38ffb31109ee495785b7f79cdacf27cb8380139f2cef0

SHA512
c57cbf9f62821950825c79f8335a893f2e89ac6f287a4b8cb591faf1ee08d8dd396e400cdf6cd264607e80214302c78d1359d0a6b8ee35202e7c33a3a686a016

Download Submit
C:\vcredist2022_x86_001_vcRuntimeAdditional_x86.log

Filesize
135KB

MD5
7902eabc21f48a7d8da99c814d69eb03

SHA1
005ac033b3a23ab78dfa38e6197889b117f1023a

SHA256
04395ec4c3d74309905d0e0787b82a659a7bb964513e1d48d097b0ff7c2d050f

SHA512
5a15fd2c51537d26b4b836199a9e47dbd2e0b29e36ee5aedf5f110c92ab9eeb244f207a3f337a4f1fc41ba4fdaaa5ec62eedf06c9c9d0e18d4e77062753c2cfb

Download Submit
memory/2296-197-0x0000000006F00000-0x0000000006FCC000-memory.dmp

Filesize
816KB

Download
memory/2296-196-0x0000000006D90000-0x0000000006EFC000-memory.dmp

Filesize
1.4MB

Download
memory/2296-203-0x0000000008520000-0x0000000008542000-memory.dmp

Filesize
136KB

Download
memory/2296-202-0x0000000007900000-0x0000000007908000-memory.dmp

Filesize
32KB

Download
memory/2296-201-0x0000000007010000-0x00000000070C2000-memory.dmp

Filesize
712KB

Download
memory/2296-199-0x0000000006B60000-0x0000000006B6A000-memory.dmp

Filesize
40KB

Download
memory/2296-200-0x0000000006FD0000-0x0000000007004000-memory.dmp

Filesize
208KB

Download
memory/2296-198-0x0000000006B40000-0x0000000006B4A000-memory.dmp

Filesize
40KB

Download
memory/2296-205-0x00000000097E0000-0x0000000009D86000-memory.dmp

Filesize
5.6MB

Download
memory/2296-204-0x0000000008550000-0x00000000088A7000-memory.dmp

Filesize
3.3MB

Download
memory/2296-195-0x0000000006BB0000-0x0000000006C92000-memory.dmp

Filesize
904KB

Download
memory/2296-194-0x00000000003E0000-0x000000000209A000-memory.dmp

Filesize
28.7MB

Download
memory/3944-908-0x00007FF8689B0000-0x00007FF8689C0000-memory.dmp

Filesize
64KB

Download
memory/3944-909-0x00007FF8689B0000-0x00007FF8689C0000-memory.dmp

Filesize
64KB

Download
memory/3944-910-0x00007FF8689B0000-0x00007FF8689C0000-memory.dmp

Filesize
64KB

Download
memory/3944-911-0x00007FF8689B0000-0x00007FF8689C0000-memory.dmp

Filesize
64KB

Download
memory/3944-907-0x00007FF8689B0000-0x00007FF8689C0000-memory.dmp

Filesize
64KB

Download
memory/3944-912-0x00007FF8660F0000-0x00007FF866100000-memory.dmp

Filesize
64KB

Download
memory/3944-913-0x00007FF8660F0000-0x00007FF866100000-memory.dmp

Filesize
64KB

Download