Malware Analysis Report

2024-11-13 13:42

Sample ID 240515-wlevsscf95
Target chainbrowserSession - Copie.exe
SHA256 3fe6c89a0fdadaf3172be13af4fad92f5f3e08c3bde723c8b6957ac68a3503ae
Tags
rat dcrat infostealer persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3fe6c89a0fdadaf3172be13af4fad92f5f3e08c3bde723c8b6957ac68a3503ae

Threat Level: Known bad

The file chainbrowserSession - Copie.exe was found to be: Known bad.

Malicious Activity Summary

rat dcrat infostealer persistence

Dcrat family

Process spawned unexpected child process

DcRat

DCRat payload

DCRat payload

Modifies Installed Components in the registry

Downloads MZ/PE file

Executes dropped EXE

Looks up external IP address via web service

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Creates scheduled task(s)

Enumerates system info in registry

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Modifies system certificate store

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-15 18:00

Signatures

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Dcrat family

dcrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-15 18:00

Reported

2024-05-15 18:30

Platform

win7-20240508-en

Max time kernel

1796s

Max time network

1803s

Command Line

"C:\Users\Admin\AppData\Local\Temp\chainbrowserSession - Copie.exe"

Signatures

DcRat

rat infostealer dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Downloads MZ/PE file

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Active Setup\Installed Components C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Active Setup\Installed Components C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Active Setup\Installed Components C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Active Setup\Installed Components C:\Windows\explorer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Windows Media Player\it-IT\smss.exe N/A
N/A N/A C:\Program Files\Windows Media Player\de-DE\audiodg.exe N/A
N/A N/A C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\sppsvc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\hrtfs\dllhost.exe N/A
N/A N/A C:\Windows\Resources\Ease of Access Themes\chainbrowserSession - Copie.exe N/A
N/A N/A C:\Windows\AppPatch\csrss.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\spoolsv.exe N/A
N/A N/A C:\Users\Public\services.exe N/A
N/A N/A C:\Program Files\Windows Media Player\de-DE\audiodg.exe N/A
N/A N/A C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\sppsvc.exe N/A
N/A N/A C:\Program Files\Windows NT\smss.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\lsass.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\hrtfs\dllhost.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\wininit.exe N/A
N/A N/A C:\Program Files\Windows Media Player\de-DE\audiodg.exe N/A
N/A N/A C:\DCRat-HRDUserModeLauncher.exe N/A
N/A N/A C:\DCRat-HRDUserModeLauncher.exe N/A
N/A N/A C:\DCRat-HRDUserModeLauncher.exe N/A
N/A N/A C:\DCRat-HRDUserModeLauncher.exe N/A
N/A N/A C:\Windows\Resources\Ease of Access Themes\chainbrowserSession - Copie.exe N/A
N/A N/A C:\Windows\AppPatch\csrss.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\spoolsv.exe N/A
N/A N/A C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\sppsvc.exe N/A
N/A N/A C:\Users\Public\services.exe N/A
N/A N/A C:\Program Files\Windows Media Player\de-DE\audiodg.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\hrtfs\dllhost.exe N/A
N/A N/A C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\sppsvc.exe N/A
N/A N/A C:\Program Files\Windows Media Player\de-DE\audiodg.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\lsass.exe N/A
N/A N/A C:\Program Files\Windows NT\smss.exe N/A
N/A N/A C:\Windows\Resources\Ease of Access Themes\chainbrowserSession - Copie.exe N/A
N/A N/A C:\Windows\AppPatch\csrss.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\spoolsv.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\wininit.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\hrtfs\dllhost.exe N/A
N/A N/A C:\Program Files\Windows Media Player\de-DE\audiodg.exe N/A
N/A N/A C:\Users\Public\services.exe N/A
N/A N/A C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\sppsvc.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ipinfo.io N/A N/A
N/A ipinfo.io N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Windows NT\smss.exe C:\Users\Admin\AppData\Local\Temp\chainbrowserSession - Copie.exe N/A
File created C:\Program Files (x86)\Windows Photo Viewer\wininit.exe C:\Users\Admin\AppData\Local\Temp\chainbrowserSession - Copie.exe N/A
File created C:\Program Files\VideoLAN\VLC\hrtfs\dllhost.exe C:\Users\Admin\AppData\Local\Temp\chainbrowserSession - Copie.exe N/A
File created C:\Program Files (x86)\Windows Media Player\it-IT\69ddcba757bf72 C:\Users\Admin\AppData\Local\Temp\chainbrowserSession - Copie.exe N/A
File created C:\Program Files\Windows NT\69ddcba757bf72 C:\Users\Admin\AppData\Local\Temp\chainbrowserSession - Copie.exe N/A
File created C:\Program Files\VideoLAN\VLC\wininit.exe C:\Users\Admin\AppData\Local\Temp\chainbrowserSession - Copie.exe N/A
File created C:\Program Files\VideoLAN\VLC\56085415360792 C:\Users\Admin\AppData\Local\Temp\chainbrowserSession - Copie.exe N/A
File created C:\Program Files\Windows Media Player\de-DE\42af1c969fbb7b C:\Users\Admin\AppData\Local\Temp\chainbrowserSession - Copie.exe N/A
File created C:\Program Files (x86)\Windows Media Player\it-IT\smss.exe C:\Users\Admin\AppData\Local\Temp\chainbrowserSession - Copie.exe N/A
File created C:\Program Files\Windows Media Player\de-DE\audiodg.exe C:\Users\Admin\AppData\Local\Temp\chainbrowserSession - Copie.exe N/A
File created C:\Program Files\VideoLAN\VLC\hrtfs\5940a34987c991 C:\Users\Admin\AppData\Local\Temp\chainbrowserSession - Copie.exe N/A
File created C:\Program Files (x86)\Windows Photo Viewer\56085415360792 C:\Users\Admin\AppData\Local\Temp\chainbrowserSession - Copie.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\hrtfs\dllhost.exe C:\Users\Admin\AppData\Local\Temp\chainbrowserSession - Copie.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Resources\Ease of Access Themes\ed46fb86cf7d8f C:\Users\Admin\AppData\Local\Temp\chainbrowserSession - Copie.exe N/A
File created C:\Windows\AppPatch\csrss.exe C:\Users\Admin\AppData\Local\Temp\chainbrowserSession - Copie.exe N/A
File created C:\Windows\AppPatch\886983d96e3d3e C:\Users\Admin\AppData\Local\Temp\chainbrowserSession - Copie.exe N/A
File created C:\Windows\Resources\Ease of Access Themes\chainbrowserSession - Copie.exe C:\Users\Admin\AppData\Local\Temp\chainbrowserSession - Copie.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 14000000070000000100010003000000140000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000eac000000000000002000000e80705004100720067006a0062006500780020002000330020005600610067007200650061007200670020006e007000700072006600660000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000074ae2078e323294282c1e41cb67d5b9c000000000000000000000000f07dd79ef2a6da0100000000000000000000000000000d20218f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000002000000e80705004600630072006e0078007200650066003a002000360037002500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000073ae2078e323294282c1e41cb67d5b9c00000000000000000000000090c43c9ef2a6da0100000000000000000000000000000d20218f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_Classes\Local Settings C:\Windows\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\LastAdvertisement = "133602717874890000" C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_Classes\Local Settings C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\PastIconsStream = 1400000005000000010001000200000014000000494c200602000400300010001000ffffffff2110ffffffffffffffff424d36000000000000003600000028000000100000004000000001002000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c000000410000000c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c0000004b818181c00000004b00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c0000004b818181c0ffffffff00000080000000000000000000000000000000002e2e2e8a0000004b000000000000000000000000000000000000000c0000004b818181c0ffffffffffffffff0000008000000000000000000000000000000000b7b7b7b73838388e00000045000000000000004b0000008000000080818181c0ffffffffffffffffffffffff0000008000000000000000000f0f0f810000004242424242ecececf40b0b0b810000000e00000080ffffffff808080ffffffffffffffffffffffffffffffffff000000800000000000000000e5e5e5ed191919830000002381818181646464a20000004200000080ffffffff808080ffffffffffffffffffffffffffffffffff000000800000005c000000276c6c6c6c939393bb0000005730303030bababad30000006800000080ffffffff808080ffffffffffffffffffffffffffffffffff000000809d9d9dc10000005c0c0c0c0cecececf40000007a0c0c0c0cecececf40000007a00000080ffffffff808080ffffffffffffffffffffffffffffffffff00000080a4a4a4c50000005f0c0c0c0cecececf40000007a0f0f0f0fe8e8e8f10000007800000080ffffffff808080ffffffffffffffffffffffffffffffffff000000800000005f0000002a6c6c6c6c939393bb0000005730303030bababad30000006800000080ffffffff808080ffffffffffffffffffffffffffffffffff000000800000000000000000e5e5e5ed191919830000002384848484646464a2000000420000004b00000080000000807e7e7ebfffffffffffffffffffffffff0000008000000000000000000f0f0f810000004245454545ecececf40a0a0a800000000e00000000000000000000000b0000004b7e7e7ebfffffffffffffffff0000008000000000000000000000000000000000c0c0c0c03636368d00000045000000000000000000000000000000000000000b0000004b7e7e7ebfffffffff0000008000000000000000000000000000000000272727880000004b0000000000000000000000000000000000000000000000000000000b0000004b7e7e7ebf0000004b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b0000003f0000000b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000035696969690000007000000080000000800000008000000080000000800000008000000080000000800000004b0000000000000000000000000000000000000058b0b0b0b0000000adffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0000008000000000000000000000000000000000000000a5ffffffff000000c0000000800000008000000080ffffffffffffffff00000080000000800000008000000080000000800000004b0000000000000000000000c0ffffffff7f7f7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff000000800000000000000000000000c0ffffffff000000a60000004d0000004d0000004d0000004d0000004d0000004d0000004d0000004d0000004dffffffff000000800000000000000000000000c0ffffffff000000a60000004d0000004d0000004d0000004d0000004d0000004d0000004d0000004d0000004dffffffff000000800000000000000000000000c0ffffffff030303a80303034f0000004d0000004d0000004d0000004d0000004d0000004d0000004d0000004dffffffff000000800000000000000000000000e07f7f7fff030303d6101010580f0f0f580a0a0a54030303500000004d0000004d0000004d0000004d0000004dffffffff000000800000004b00000080000000c07f7f7fff0e0e0eb00e0e0eb0141414901c1c1c611c1c1c611717175d0c0c0c550202024e0000004d0000004dffffffff0000008000000080ffffffffffffffffffffffffffffffffffffffff141414b428282869282828692828286928282869262626681818185e08080853ffffffff0000008000000080ffffffff808080ff808080ff808080ffffffffff1f1f1fbc3e3e3e783e3e3e783e3e3e783e3e3e783e3e3e783e3e3e783e3e3e78ffffffff0000008000000080ffffffff808080ffffffffff808080ffffffffff333333ca66666694666666946666669466666694666666946666669466666694ffffffff0000008000000080ffffffff808080ffffffffff808080ffffffffff7f7f7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0000008000000080ffffffff808080ffffffffff808080ffffffffff000000c000000080000000800000008000000080000000800000008000000080000000800000004b0000004b0000008000000080ffffffff00000080000000800000004b00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004b000000800000004b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000424d3e000000000000003e0000002800000010000000400000000100010000000000000100000000000000000000000000000000000000000000ffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8ff0000f0ff0000e0f30000c0f1000000c0000000c000000000000000000000000000000000000000c0000000c00000c0f10000e0f30000f0ff0000f8ff0000c0030000c0030000c0000000c0000000c0000000c0000000c0000000c000000000000000000000000000000000000000000000000000000001ff0000c7ff000000000000000000000000000000000000000000000000010000000800000002000000040000002400000001000000000000000100000000000000 C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_Classes\Local Settings C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_Classes\Local Settings C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify C:\Windows\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "133596513413352000" C:\Windows\explorer.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Program Files (x86)\Windows Media Player\it-IT\smss.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Program Files (x86)\Windows Media Player\it-IT\smss.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\chainbrowserSession - Copie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\chainbrowserSession - Copie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\chainbrowserSession - Copie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\chainbrowserSession - Copie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\chainbrowserSession - Copie.exe N/A
N/A N/A C:\Program Files (x86)\Windows Media Player\it-IT\smss.exe N/A
N/A N/A C:\Program Files (x86)\Windows Media Player\it-IT\smss.exe N/A
N/A N/A C:\Program Files (x86)\Windows Media Player\it-IT\smss.exe N/A
N/A N/A C:\Program Files (x86)\Windows Media Player\it-IT\smss.exe N/A
N/A N/A C:\Program Files (x86)\Windows Media Player\it-IT\smss.exe N/A
N/A N/A C:\Program Files (x86)\Windows Media Player\it-IT\smss.exe N/A
N/A N/A C:\Program Files (x86)\Windows Media Player\it-IT\smss.exe N/A
N/A N/A C:\Program Files (x86)\Windows Media Player\it-IT\smss.exe N/A
N/A N/A C:\Program Files (x86)\Windows Media Player\it-IT\smss.exe N/A
N/A N/A C:\Program Files (x86)\Windows Media Player\it-IT\smss.exe N/A
N/A N/A C:\Program Files (x86)\Windows Media Player\it-IT\smss.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Windows Media Player\it-IT\smss.exe N/A
N/A N/A C:\Program Files (x86)\Windows Media Player\it-IT\smss.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Windows Media Player\it-IT\smss.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\chainbrowserSession - Copie.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows Media Player\it-IT\smss.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Windows Media Player\de-DE\audiodg.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\sppsvc.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1952 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\chainbrowserSession - Copie.exe C:\Windows\System32\cmd.exe
PID 1952 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\chainbrowserSession - Copie.exe C:\Windows\System32\cmd.exe
PID 1952 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\chainbrowserSession - Copie.exe C:\Windows\System32\cmd.exe
PID 900 wrote to memory of 780 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 900 wrote to memory of 780 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 900 wrote to memory of 780 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 900 wrote to memory of 396 N/A C:\Windows\System32\cmd.exe C:\Program Files (x86)\Windows Media Player\it-IT\smss.exe
PID 900 wrote to memory of 396 N/A C:\Windows\System32\cmd.exe C:\Program Files (x86)\Windows Media Player\it-IT\smss.exe
PID 900 wrote to memory of 396 N/A C:\Windows\System32\cmd.exe C:\Program Files (x86)\Windows Media Player\it-IT\smss.exe
PID 396 wrote to memory of 2608 N/A C:\Program Files (x86)\Windows Media Player\it-IT\smss.exe C:\Windows\explorer.exe
PID 396 wrote to memory of 2608 N/A C:\Program Files (x86)\Windows Media Player\it-IT\smss.exe C:\Windows\explorer.exe
PID 396 wrote to memory of 2608 N/A C:\Program Files (x86)\Windows Media Player\it-IT\smss.exe C:\Windows\explorer.exe
PID 2608 wrote to memory of 1300 N/A C:\Windows\explorer.exe C:\Windows\system32\ctfmon.exe
PID 2608 wrote to memory of 1300 N/A C:\Windows\explorer.exe C:\Windows\system32\ctfmon.exe
PID 2608 wrote to memory of 1300 N/A C:\Windows\explorer.exe C:\Windows\system32\ctfmon.exe
PID 2172 wrote to memory of 2868 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 2868 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 2868 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 1312 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 1312 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 1312 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 1312 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 1312 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 1312 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 1312 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 1312 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 1312 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 1312 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 1312 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 1312 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 1312 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 1312 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 1312 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 1312 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 1312 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 1312 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 1312 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 1312 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 1312 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 1312 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 1312 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 1312 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 1312 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 1312 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 1312 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 1312 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 1312 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 1312 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 1312 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 1312 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 1312 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 1312 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 1312 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 1312 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 1312 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 1312 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 1312 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 2416 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 2416 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 2416 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 2124 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 2124 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 2124 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2172 wrote to memory of 2124 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\chainbrowserSession - Copie.exe

"C:\Users\Admin\AppData\Local\Temp\chainbrowserSession - Copie.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files\VideoLAN\VLC\hrtfs\dllhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\hrtfs\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files\VideoLAN\VLC\hrtfs\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Media Player\it-IT\smss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\it-IT\smss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Media Player\it-IT\smss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\spoolsv.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\MSOCache\All Users\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\sppsvc.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\wininit.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\audiodg.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\audiodg.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\audiodg.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows NT\smss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Windows NT\smss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows NT\smss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\spoolsv.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\MSOCache\All Users\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Program Files\VideoLAN\VLC\wininit.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Program Files\VideoLAN\VLC\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Windows\AppPatch\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\AppPatch\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Windows\AppPatch\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Photo Viewer\wininit.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\lsass.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Media Player\de-DE\audiodg.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\de-DE\audiodg.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Media Player\de-DE\audiodg.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Users\Public\services.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Public\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Users\Public\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "chainbrowserSession - Copiec" /sc MINUTE /mo 10 /tr "'C:\Windows\Resources\Ease of Access Themes\chainbrowserSession - Copie.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "chainbrowserSession - Copie" /sc ONLOGON /tr "'C:\Windows\Resources\Ease of Access Themes\chainbrowserSession - Copie.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "chainbrowserSession - Copiec" /sc MINUTE /mo 9 /tr "'C:\Windows\Resources\Ease of Access Themes\chainbrowserSession - Copie.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\spoolsv.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AOqmDTrE2c.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Program Files (x86)\Windows Media Player\it-IT\smss.exe

"C:\Program Files (x86)\Windows Media Player\it-IT\smss.exe"

C:\Windows\explorer.exe

"explorer.exe"

C:\Windows\system32\ctfmon.exe

ctfmon.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7feef789758,0x7feef789768,0x7feef789778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1168 --field-trial-handle=1196,i,9266261351708623689,10427811648092045695,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1500 --field-trial-handle=1196,i,9266261351708623689,10427811648092045695,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1616 --field-trial-handle=1196,i,9266261351708623689,10427811648092045695,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2260 --field-trial-handle=1196,i,9266261351708623689,10427811648092045695,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2292 --field-trial-handle=1196,i,9266261351708623689,10427811648092045695,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1468 --field-trial-handle=1196,i,9266261351708623689,10427811648092045695,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1348 --field-trial-handle=1196,i,9266261351708623689,10427811648092045695,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3432 --field-trial-handle=1196,i,9266261351708623689,10427811648092045695,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3488 --field-trial-handle=1196,i,9266261351708623689,10427811648092045695,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3596 --field-trial-handle=1196,i,9266261351708623689,10427811648092045695,131072 /prefetch:8

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\taskeng.exe

taskeng.exe {DFB24C81-D18B-4232-984E-30E30195EC69} S-1-5-21-268080393-3149932598-1824759070-1000:UHRQKJCP\Admin:Interactive:[1]

C:\Program Files\Windows Media Player\de-DE\audiodg.exe

"C:\Program Files\Windows Media Player\de-DE\audiodg.exe"

C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\sppsvc.exe

C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\sppsvc.exe

C:\Windows\explorer.exe

"explorer.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7feef789758,0x7feef789768,0x7feef789778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1132 --field-trial-handle=1224,i,3092909232118028512,12718005480719644557,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1504 --field-trial-handle=1224,i,3092909232118028512,12718005480719644557,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1596 --field-trial-handle=1224,i,3092909232118028512,12718005480719644557,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2260 --field-trial-handle=1224,i,3092909232118028512,12718005480719644557,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2288 --field-trial-handle=1224,i,3092909232118028512,12718005480719644557,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1008 --field-trial-handle=1224,i,3092909232118028512,12718005480719644557,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2216 --field-trial-handle=1224,i,3092909232118028512,12718005480719644557,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3412 --field-trial-handle=1224,i,3092909232118028512,12718005480719644557,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3532 --field-trial-handle=1224,i,3092909232118028512,12718005480719644557,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3632 --field-trial-handle=1224,i,3092909232118028512,12718005480719644557,131072 /prefetch:8

C:\Program Files\VideoLAN\VLC\hrtfs\dllhost.exe

"C:\Program Files\VideoLAN\VLC\hrtfs\dllhost.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7feef789758,0x7feef789768,0x7feef789778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1168 --field-trial-handle=1332,i,403328025971201747,12146059467613334376,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1468 --field-trial-handle=1332,i,403328025971201747,12146059467613334376,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7feef789758,0x7feef789768,0x7feef789778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1140 --field-trial-handle=1156,i,15466574507084383365,6084254902843087375,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1488 --field-trial-handle=1156,i,15466574507084383365,6084254902843087375,131072 /prefetch:8

C:\Windows\explorer.exe

explorer.exe

C:\Windows\Resources\Ease of Access Themes\chainbrowserSession - Copie.exe

"C:\Windows\Resources\Ease of Access Themes\chainbrowserSession - Copie.exe"

C:\Windows\AppPatch\csrss.exe

C:\Windows\AppPatch\csrss.exe

C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\spoolsv.exe

"C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\spoolsv.exe"

C:\Users\Public\services.exe

C:\Users\Public\services.exe

C:\Program Files\Windows Media Player\de-DE\audiodg.exe

"C:\Program Files\Windows Media Player\de-DE\audiodg.exe"

C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\sppsvc.exe

C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\sppsvc.exe

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\lsass.exe

"C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\lsass.exe"

C:\Program Files\Windows NT\smss.exe

"C:\Program Files\Windows NT\smss.exe"

C:\Program Files (x86)\Windows Photo Viewer\wininit.exe

"C:\Program Files (x86)\Windows Photo Viewer\wininit.exe"

C:\Program Files\VideoLAN\VLC\hrtfs\dllhost.exe

"C:\Program Files\VideoLAN\VLC\hrtfs\dllhost.exe"

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

C:\Program Files\Windows Media Player\de-DE\audiodg.exe

"C:\Program Files\Windows Media Player\de-DE\audiodg.exe"

C:\DCRat-HRDUserModeLauncher.exe

"C:\DCRat-HRDUserModeLauncher.exe" chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" -safe-mode --disable-3d-apis --disable-gpu

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7feef789758,0x7feef789768,0x7feef789778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1156 --field-trial-handle=1176,i,11961540624154870974,8021886941679477667,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1428 --field-trial-handle=1176,i,11961540624154870974,8021886941679477667,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1516 --field-trial-handle=1176,i,11961540624154870974,8021886941679477667,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-3d-apis --display-capture-permissions-policy-allowed --first-renderer-process --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2208 --field-trial-handle=1176,i,11961540624154870974,8021886941679477667,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-3d-apis --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2220 --field-trial-handle=1176,i,11961540624154870974,8021886941679477667,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-3d-apis --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2904 --field-trial-handle=1176,i,11961540624154870974,8021886941679477667,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3472 --field-trial-handle=1176,i,11961540624154870974,8021886941679477667,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3604 --field-trial-handle=1176,i,11961540624154870974,8021886941679477667,131072 /prefetch:8

C:\DCRat-HRDUserModeLauncher.exe

"C:\DCRat-HRDUserModeLauncher.exe" chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" -safe-mode --disable-3d-apis --disable-gpu

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7feef789758,0x7feef789768,0x7feef789778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1148 --field-trial-handle=1184,i,6161478731841294854,6141866342007550353,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1420 --field-trial-handle=1184,i,6161478731841294854,6141866342007550353,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3796 --field-trial-handle=1176,i,11961540624154870974,8021886941679477667,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3776 --field-trial-handle=1176,i,11961540624154870974,8021886941679477667,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-3d-apis --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3920 --field-trial-handle=1176,i,11961540624154870974,8021886941679477667,131072 /prefetch:1

C:\DCRat-HRDUserModeLauncher.exe

"C:\DCRat-HRDUserModeLauncher.exe" chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" -safe-mode --disable-3d-apis --disable-gpu

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7feef789758,0x7feef789768,0x7feef789778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1168 --field-trial-handle=1128,i,17383054582813391585,15751075485548292293,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1408 --field-trial-handle=1128,i,17383054582813391585,15751075485548292293,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1528 --field-trial-handle=1128,i,17383054582813391585,15751075485548292293,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-3d-apis --display-capture-permissions-policy-allowed --first-renderer-process --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2236 --field-trial-handle=1128,i,17383054582813391585,15751075485548292293,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-3d-apis --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2260 --field-trial-handle=1128,i,17383054582813391585,15751075485548292293,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-3d-apis --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3288 --field-trial-handle=1128,i,17383054582813391585,15751075485548292293,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3268 --field-trial-handle=1128,i,17383054582813391585,15751075485548292293,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3276 --field-trial-handle=1128,i,17383054582813391585,15751075485548292293,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3644 --field-trial-handle=1128,i,17383054582813391585,15751075485548292293,131072 /prefetch:8

C:\DCRat-HRDUserModeLauncher.exe

"C:\DCRat-HRDUserModeLauncher.exe" chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" -safe-mode --disable-3d-apis --disable-gpu

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7feef789758,0x7feef789768,0x7feef789778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1176 --field-trial-handle=1272,i,4586226591454131610,17312156603197817960,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1448 --field-trial-handle=1272,i,4586226591454131610,17312156603197817960,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1500 --field-trial-handle=1272,i,4586226591454131610,17312156603197817960,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-3d-apis --display-capture-permissions-policy-allowed --first-renderer-process --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2172 --field-trial-handle=1272,i,4586226591454131610,17312156603197817960,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-3d-apis --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2180 --field-trial-handle=1272,i,4586226591454131610,17312156603197817960,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-3d-apis --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3124 --field-trial-handle=1272,i,4586226591454131610,17312156603197817960,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3228 --field-trial-handle=1272,i,4586226591454131610,17312156603197817960,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3440 --field-trial-handle=1272,i,4586226591454131610,17312156603197817960,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3484 --field-trial-handle=1272,i,4586226591454131610,17312156603197817960,131072 /prefetch:8

C:\Windows\explorer.exe

"explorer.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7feef789758,0x7feef789768,0x7feef789778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1104 --field-trial-handle=1280,i,8039790638229364007,5574669213450970206,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1496 --field-trial-handle=1280,i,8039790638229364007,5574669213450970206,131072 /prefetch:8

C:\Windows\Resources\Ease of Access Themes\chainbrowserSession - Copie.exe

"C:\Windows\Resources\Ease of Access Themes\chainbrowserSession - Copie.exe"

C:\Windows\AppPatch\csrss.exe

C:\Windows\AppPatch\csrss.exe

C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\spoolsv.exe

"C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\spoolsv.exe"

C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\sppsvc.exe

C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\sppsvc.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7feef789758,0x7feef789768,0x7feef789778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7feef789758,0x7feef789768,0x7feef789778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7feef789758,0x7feef789768,0x7feef789778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1072 --field-trial-handle=1228,i,14043132874501920050,415606823268142775,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1488 --field-trial-handle=1228,i,14043132874501920050,415606823268142775,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1584 --field-trial-handle=1228,i,14043132874501920050,415606823268142775,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2256 --field-trial-handle=1228,i,14043132874501920050,415606823268142775,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2264 --field-trial-handle=1228,i,14043132874501920050,415606823268142775,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1144 --field-trial-handle=1308,i,13448183565205851653,7549653354325410390,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1432 --field-trial-handle=1308,i,13448183565205851653,7549653354325410390,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1136 --field-trial-handle=1304,i,18053150618324477069,12885697856468658036,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1444 --field-trial-handle=1304,i,18053150618324477069,12885697856468658036,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3268 --field-trial-handle=1228,i,14043132874501920050,415606823268142775,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1348 --field-trial-handle=1228,i,14043132874501920050,415606823268142775,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3484 --field-trial-handle=1228,i,14043132874501920050,415606823268142775,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3588 --field-trial-handle=1228,i,14043132874501920050,415606823268142775,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3704 --field-trial-handle=1228,i,14043132874501920050,415606823268142775,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3720 --field-trial-handle=1228,i,14043132874501920050,415606823268142775,131072 /prefetch:8

C:\Windows\explorer.exe

explorer.exe

C:\Users\Public\services.exe

C:\Users\Public\services.exe

C:\Program Files\Windows Media Player\de-DE\audiodg.exe

"C:\Program Files\Windows Media Player\de-DE\audiodg.exe"

C:\Program Files\VideoLAN\VLC\hrtfs\dllhost.exe

"C:\Program Files\VideoLAN\VLC\hrtfs\dllhost.exe"

C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\sppsvc.exe

C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\sppsvc.exe

C:\Program Files\Windows Media Player\de-DE\audiodg.exe

"C:\Program Files\Windows Media Player\de-DE\audiodg.exe"

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\lsass.exe

"C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\lsass.exe"

C:\Program Files\Windows NT\smss.exe

"C:\Program Files\Windows NT\smss.exe"

C:\Windows\Resources\Ease of Access Themes\chainbrowserSession - Copie.exe

"C:\Windows\Resources\Ease of Access Themes\chainbrowserSession - Copie.exe"

C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\spoolsv.exe

"C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\spoolsv.exe"

C:\Windows\AppPatch\csrss.exe

C:\Windows\AppPatch\csrss.exe

C:\Program Files (x86)\Windows Photo Viewer\wininit.exe

"C:\Program Files (x86)\Windows Photo Viewer\wininit.exe"

C:\Program Files\VideoLAN\VLC\hrtfs\dllhost.exe

"C:\Program Files\VideoLAN\VLC\hrtfs\dllhost.exe"

C:\Users\Public\services.exe

C:\Users\Public\services.exe

C:\Program Files\Windows Media Player\de-DE\audiodg.exe

"C:\Program Files\Windows Media Player\de-DE\audiodg.exe"

C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\sppsvc.exe

C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\sppsvc.exe

C:\Windows\explorer.exe

"explorer.exe"

C:\Windows\explorer.exe

explorer.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 a0982800.xsph.ru udp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
US 8.8.8.8:53 ipinfo.io udp
US 34.117.186.192:443 ipinfo.io tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
US 8.8.8.8:53 www.google.com udp
FR 142.250.178.132:443 www.google.com udp
FR 142.250.178.132:443 www.google.com tcp
US 8.8.8.8:53 play.google.com udp
FR 142.250.179.78:443 play.google.com udp
FR 142.250.179.78:443 play.google.com tcp
N/A 224.0.0.251:5353 udp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
US 8.8.8.8:53 www.google.com udp
FR 142.250.178.132:443 www.google.com udp
FR 142.250.178.132:443 www.google.com tcp
US 8.8.8.8:53 play.google.com udp
FR 142.250.179.78:443 play.google.com udp
FR 142.250.179.78:443 play.google.com tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
FR 142.250.201.163:443 beacons.gcp.gvt2.com tcp
US 8.8.8.8:53 e2c32.gcp.gvt2.com udp
HK 35.215.129.230:443 e2c32.gcp.gvt2.com tcp
HK 35.215.129.230:443 e2c32.gcp.gvt2.com tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
US 8.8.8.8:53 www.google.com udp
FR 142.250.178.132:443 www.google.com udp
FR 142.250.178.132:443 www.google.com tcp
US 8.8.8.8:53 play.google.com udp
FR 142.250.179.78:443 play.google.com udp
FR 142.250.179.78:443 play.google.com tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
US 8.8.8.8:53 ogs.google.com udp
FR 142.250.201.174:443 ogs.google.com tcp
US 8.8.8.8:53 ssl.gstatic.com udp
FR 172.217.20.195:443 ssl.gstatic.com tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
FR 142.250.178.132:443 www.google.com udp
FR 142.250.178.132:443 www.google.com tcp
FR 142.250.179.78:443 play.google.com udp
FR 142.250.179.78:443 play.google.com tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
FR 142.250.178.132:443 www.google.com udp
FR 142.250.178.132:443 www.google.com tcp
FR 142.250.179.78:443 play.google.com udp
FR 142.250.179.78:443 play.google.com tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
US 8.8.8.8:53 www.google.com udp
FR 142.250.178.132:443 www.google.com udp
FR 142.250.178.132:443 www.google.com tcp
US 8.8.8.8:53 play.google.com udp
FR 142.250.179.78:443 play.google.com udp
FR 142.250.179.78:443 play.google.com tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
FR 142.250.201.163:443 beacons.gcp.gvt2.com udp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp
RU 141.8.192.126:80 a0982800.xsph.ru tcp

Files

memory/1952-0-0x000007FEF5483000-0x000007FEF5484000-memory.dmp

memory/1952-1-0x0000000000090000-0x0000000000166000-memory.dmp

memory/1952-2-0x000007FEF5480000-0x000007FEF5E6C000-memory.dmp

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\wininit.exe

MD5 dcd1dbdf7c8bfb9263e5dda02b1bfa79
SHA1 0912a5fa7ac74c5e49d72a8a4d6957b063b1d31b
SHA256 3fe6c89a0fdadaf3172be13af4fad92f5f3e08c3bde723c8b6957ac68a3503ae
SHA512 d368e5f91365af67e46514425e13323f0ad2181d5fc1e790b2b5d17e9cf8c91f46bdf582550517f703b8232f6bd59598b37a41cd637f2d9c192317e8f0134ccc

C:\Users\Admin\AppData\Local\Temp\AOqmDTrE2c.bat

MD5 539202e8ea48b7cdfd13f4569f1e2b50
SHA1 cbc7b36f8663f0d3fb23d7babbd275254bc2539d
SHA256 7c40647fb04cb26fac0d7db9446fc0810dae4ff2fb07c0e25a2fbf66862e5844
SHA512 f0cee1b97fb01cc480e3ab2b876987825e999ddc0d094ab097dcb07334b9e6aae9803184549f0ec3d242a1c057dc055862428bfffc9b693e067e570f04618d9a

memory/1952-42-0x000007FEF5480000-0x000007FEF5E6C000-memory.dmp

memory/396-45-0x0000000000D00000-0x0000000000DD6000-memory.dmp

memory/396-46-0x0000000000CB0000-0x0000000000CC6000-memory.dmp

\??\pipe\crashpad_2172_XWCELMERHJJPALCM

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

MD5 18e723571b00fb1694a3bad6c78e4054
SHA1 afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA256 8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA512 43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\249f670d-419f-4c3c-b0cd-39f888d90cde.tmp

MD5 4ad4894dcf10df26dc1766b76c233b3c
SHA1 1b0939fa0d3758339cc3a753f40c4dcf763849b8
SHA256 15c6cb8ac041c4c3b2eb136f2807fc04713ea767c1bf83cbe14e06902c5185e0
SHA512 60f20f350d5cfc499386bea9559356e4be8d41927762e0ad454e131a05c84a6fa27e07480a4cc2ade38c2890e254eab1c376edfe31de8de3dcc072643831ee0b

memory/1152-203-0x0000000000970000-0x0000000000A46000-memory.dmp

memory/876-206-0x0000000000C90000-0x0000000000D66000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

MD5 567d4dac6846f22069dcc585af122992
SHA1 a84d24ab0a730a84b54407a63c9d537b4a226399
SHA256 00e69b7f06d44379c68754af3bdc46a5f2919272586618957da47a3cb8a6378c
SHA512 ca40410254bf5abf1f82d7959cf234bd96196dfdc66e4b178631abc23072b8b28f41e31779acc4ebbd366634f62fbf92a677ff7b15343c34b0ba7489ef061860

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 f3ed0d98c19c5ecfa0c4dd40c0c18674
SHA1 280f010e1519c0411faeb4c6076bb97e8052fa90
SHA256 aa6672bbdf7e9547dd996181c7993a9f52afad61fd9070678612fb09c4e12175
SHA512 0895c8d3332ff1506f88deeefa600a028efc1aad6ec6b63f5ef1a4d54322851c19ad62c9324e69fbaadbdb3fcda1d3a63040b37506699dde99ff1206aaff873b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

MD5 9eae63c7a967fc314dd311d9f46a45b7
SHA1 caba9c2c93acfe0b9ceb9ab19b992b0fc19c71cf
SHA256 4288925b0cf871c7458c22c46936efb0e903802feb991a0e1803be94ca6c251d
SHA512 bed924bff236bf5b6ce1df1db82e86c935e5830a20d9d24697efd82ca331e30604db8d04b0d692ec8541ec6deb2225bcc7d805b79f2db5726642198ecf6348b8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000008.ldb

MD5 9f4cf2e4e3d8d29509a36cc0531a3bb4
SHA1 76cb01eef540aeac0f2b2b011d26dc41ceb00066
SHA256 3ede558a6bd17849d8ab3f84d2d763d3bc9e34e714bd9117012a96ec2d875461
SHA512 f3b05d90801bb697b91aa1ce19533d1ca8ffdeaafdaf5e4d624701a40e631f67c6688d96b82dd8aa00a5bb574a04d9cd322443423f84cfeda8765a1017fef8fd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\MANIFEST-000007

MD5 22b937965712bdbc90f3c4e5cd2a8950
SHA1 25a5df32156e12134996410c5f7d9e59b1d6c155
SHA256 cad3bbec41899ea5205612fc1494fa7ba88847fb75437a2def22211a4003e2eb
SHA512 931427ad4609ab4ca12b2ee852d4965680f58602b00c182a2d340acf3163d888be6cfad87ca089f2b47929ddfa66be03ab13a6d24922397334d6997d4c8ede3b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG

MD5 9225d8eb96e5f3062817e187565fc078
SHA1 9cc910ca89bfe0de2e9fd049ed41466cbf1e6d2e
SHA256 f7f138b81a4c3704e0779c02c6ef6d27fa574ede19ecf34616a0d00a6b4514d7
SHA512 f414596b88dffd27c3d7fb707a18581c232967f30747d45cb4fee2255ed45a2841272f2c6cef55c05151b2f5e2f706af12bd307dc9b30c6b3f80e088a1ab48d3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000009.log

MD5 cda9cd884ff40c39e4f3a8128b3e3073
SHA1 371c378dbaccd68f8094d6ecaa07e97000ae8c77
SHA256 8ffcecadb8ea6d3ad39e243ce3b59f3b4944f09f2685ac17e96881234ac468e3
SHA512 76cdb753417bebd4530202d742478def74405d185b39136c6fa36c323cbe4ac769b09f0f246be1c5539a4b34ac7cc4da122c4c67b99c60fc4cf0e1c215648d8e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\MANIFEST-000007

MD5 03d881fc5a4ab4013bd1b30988abb179
SHA1 9ad861569715575d7b676e5683b14dd3cffec304
SHA256 5da7b30f55f920166ad821f532fb95bd11546bf63a228fc41357aa122fcaf5e8
SHA512 29ab8ac2c642a83086266f88ffde8d71c96cd0d98812fac526e0a0adc58d8bc7f99760ad19a71cc38c3ef5edb9ab9d642ef6b665bf4ce336260b0171411e26f6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG

MD5 45d3bff1504467da1da8f00dab5ae709
SHA1 1f74948e584519b82e6b84c521e596918d85a2fe
SHA256 ff8ded4b4f96aaf5982b26e029bb8cccac096b89d1c7753d2399b82700c38af1
SHA512 ac5b7c2817560920edd35f72553111a3a5def502f5247310a750b48fedf404ab2a2b81cc4b0655406ccd87808ef1e606ce026f20bf524ddfd460814b1267a243

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG

MD5 9d1db7af6e04a41e33fc1ca966459fa2
SHA1 507adb0ab9a19e66447ae28520156fab51df5944
SHA256 0ce7538b5e8271ad33e7da6054869c0ec0944ed3f22dc25ae61098a44df874e6
SHA512 2dd643cb726ce42ec3fc5b5d63c343a73a2d8f8e8de63ed97ef5356ca7b7cb40e96b1b3fc56139ba5aa59f484e8a6c2b3141589f3a7eb88c800643d23a1ef0b2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000009.log

MD5 12275f46db968e27e4edb23a4517904d
SHA1 1bd41f5f55dc8532c45c5ed91bd0823deabe3d3a
SHA256 0b9769e63620205002586d7dbefa19d6c3573ffa65bc86eb49113ec271feea4a
SHA512 084364c331be5c6b8c537a6c56b732ccdbb45f0d74a1e0ed89ac195e9ae43e15f15c953e3ed188990f0abb7e0e6456fa4b6b34562a02c180f7c061a7728c8b66

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000006

MD5 78c55e45e9d1dc2e44283cf45c66728a
SHA1 88e234d9f7a513c4806845ce5c07e0016cf13352
SHA256 7b69a2bee12703825dc20e7d07292125180b86685d2d1b9fd097df76fc6791ec
SHA512 f2ad4594024871286b98a94223b8e7155c7934ef4ebb55f25a4a485a059f75b572d21bc96e9b48ed394be8a41fe0208f7bfb6e28a79d75640c5b684f0c848fe3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\MANIFEST-000007

MD5 1c2107d4e3c80dadb6b349e42a419049
SHA1 b38b68088655a66e4b2111ca3728182fa63f9d04
SHA256 6c8a27990ff1de53260117dd8a16297f7412a238b2e508336745f3c051daedbe
SHA512 66d8dcce40e3dc33ef7a9a5d79ecd299ad598bf411a038425a1ab526742d154cc48285bd530e99a6b79ed9fe4f296a1c829891992bb350161642d40d3f6ddde5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\MANIFEST-000007

MD5 1be22f40a06c4e7348f4e7eaf40634a9
SHA1 8205ec74cd32ef63b1cc274181a74b95eedf86df
SHA256 45a28788cde0d2a0232d19c391eae45777fe640790ac0674d6daa5672c444691
SHA512 b8f6f42d375e3ad8015d744fa2814994fa6e588b41cce0131fca48194dd40146b08169a8ce0da350525ff32a59a16edb503c72e0f07254955c82a0d38074856e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000009.log

MD5 ec7cbfb7c7ebdf29ebb83ebb9e5707de
SHA1 c9e81f3fddfa0014b85bd3301fa4992700906271
SHA256 6de23353470a8265cc38c7de5591f89372aa9b79dfc3c81ce434b93705cd6fb7
SHA512 5245afa15f6a204c196935d3816a5811e5e27b4cc75e2e98f59bf74c51bf2b6119dc2866c60b38aedfd5c25d01e5e842af702e4851b4122a87e757f14969f898

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\MANIFEST-000007

MD5 bf5d2f12989c73855d34e9a23495f99c
SHA1 a60a6d01e549282c42f6b37b876b3eae373703dd
SHA256 ee67aea9e57a78d79308e5962b28ed026862916577883b97de65dfe26df7cebc
SHA512 a79aa5fd0b516be55d12b0a94e61a9d121cb2fbf43e8c761a108bdd6c52cc1e69674ee4720451020cc8081e7554bfbce43ce66971d07bb78c8993ec6bc5c19db

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG

MD5 b33add2887730ceb3a099bc75ab55989
SHA1 d1fd221cda656579bbb7251c79edd31b01ffec96
SHA256 3f18da63221e6136d9ad61f6187d78f7fd87d9fd164fb6ef0c12e5d2c3d656d9
SHA512 62e861ff13c0735f0eb872445884a9c55cd9b49835ee3dc9bfa36aa56b5dea509aea0ab448a35e0243d00c01ba4f56448cb0722b896ff227f3260ac44b1cc032

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG

MD5 dfd544c01d962c60f8af7a3e023c01a7
SHA1 27736ecba873a1f2f1516b1bf2977bac3979ed25
SHA256 8461fcb9c1ef12c592d5f1d2f19625fbaec74743c9cf53ba0642f638f554f9d2
SHA512 7935f85d9e783b3c40c101567e7515196061808c16bc92a1f3131dd94cf40d94d9c956a8441639a846c692033f62796e623e238bfc43a6785e5a1f84a24f70fd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000010.dbtmp

MD5 60e3f691077715586b918375dd23c6b0
SHA1 476d3eab15649c40c6aebfb6ac2366db50283d1b
SHA256 e91d13722e31f9b06c5df3582cad1ea5b73547ce3dc08b12ed461f095aad48ee
SHA512 d1c146d27bbf19362d6571e2865bb472ce4fe43dc535305615d92d6a2366f98533747a8a70a578d1f00199f716a61ce39fac5cab9dd67e9c044bc49e7343130e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG

MD5 0d4e5a5cd0dcf90de14d58c7812e8a0e
SHA1 35df8c943d03c3425260ae74a9206ea121d9afcb
SHA256 431c9ea56cdd315879f044daf83e6a55c5dadbc71469423d493fda8531023f26
SHA512 d96564ee230e95aed127f0ee160fe042816d260ead1c0900a8440b24131b4986d7aa7425da5f27b6a89b6f1b6c95358a83781604de81af9a895b31aa289a414c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG

MD5 8915c3339003aa861eb7a26acdfe12f9
SHA1 98c095fe475650d424a8f5ca60578b765a7d7f31
SHA256 31c73e072090f4e71084bddd2957ebb34a8a4e853ee83be99acd13600533420a
SHA512 a080cbbcb0a634ee64345feda49486372dd2f297465fee92623a928b99ecbb794c567cab6aedfcc36ffee9732fa545d1f43592c87d00fec7cf02651294ca3ce8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT

MD5 aefd77f47fb84fae5ea194496b44c67a
SHA1 dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA256 4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512 b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000009.dbtmp

MD5 979c29c2917bed63ccf520ece1d18cda
SHA1 65cd81cdce0be04c74222b54d0881d3fdfe4736c
SHA256 b3524365a633ee6d1fa9953638d2867946c515218c497a5ec2dbef7dc44a7c53
SHA512 e38f694fd6ab9f678ae156528230d7a8bfb7b59a13b227f59f9c38ab5617db11ebb6be1276323a905d09c4066a3fe820cf58077ab48bf201f3c467a98516ee7a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\MANIFEST-000007

MD5 b6d5d86412551e2d21c97af6f00d20c3
SHA1 543302ae0c758954e222399987bb5e364be89029
SHA256 e0b2fdc217d9c571a35f41c21ed2596309f3f00a7297a8d1ded05f54f0e68191
SHA512 5b56ae73a61add9e26f77d95c9b823f82a7fcdc75eed64b388fb4967f5c6c42cb0796b0b99dc25c89f38952786176c10d173dec7862a8a5ce5f820280f72d665

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000008.ldb

MD5 53816bf9fc087b795bb6e6d575bd803f
SHA1 3948e9e9dfb36b4b2c3d3079a26eceb5bc561a10
SHA256 c789333291d3208753f2671468693b73677b4349b2ab3fbadbb0dae91a0d45f2
SHA512 25b0d4bd64bc6e052d61e88166079e92d4d365dabde33248fc731633aa67b03b0d876d2b0be820b2ebee2d99e036e516b9f28145c57171615c26f659e337e356

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000009.log

MD5 e9c694b34731bf91073cf432768a9c44
SHA1 861f5a99ad9ef017106ca6826efe42413cda1a0e
SHA256 01c766e2c0228436212045fa98d970a0ad1f1f73abaa6a26e97c6639a4950d85
SHA512 2a359571c4326559459c881cba4ff4fa9f312f6a7c2955b120b907430b700ea6fd42a48fbb3cc9f0ca2950d114df036d1bb3b0618d137a36ebaaa17092fe5f01

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000008.ldb

MD5 eb417771a149ca6a930091222e34d5ed
SHA1 740a4e44bcfc8e3c509fb082df455a2241b577eb
SHA256 e6b13d3dec3c7cfb78736d3ea2db05b0bd278f717af11eecd87876bddabf142f
SHA512 0e895919abb5a7d012f9ceb6d4335c0c575ec5f0e91792d9cc7b7004b25be0591c31ce3a5e58258fbb70ab40237b7a6ff7e5847edb09d1befaf1f7e8c3609c3f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0

MD5 15cf72981908f21de9a409a6cf438465
SHA1 9cc0d30c4fb44abebcdd8437a3fbb209173ebcba
SHA256 48b913914e1eef8d7f4625122334afe8b644a77ad33f9fc9f6fc3735d1dec467
SHA512 2386381be94be4bb9a360b0a76b91148da29bde2d75af57aa899cd9a157e84433430ef614bb516cc19b9319b799effc0f6846ca010fbbfa26f1dfbfcc5436a4d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 aedef421926b1d71cb90e149e66f9885
SHA1 c6eb21231c87f7e611e4175acce932ef19227540
SHA256 ff66f403c633b5fb2a878043c0e4e9f165570b9ffe045167bc9c0aa862d1cad2
SHA512 df6591ae3ee0afcbf29f2b41fb8d66f87c7ba358a228f6d6a2f0258879f271ad17c2e8c00952c34027bfe22ced4ab19e846802f649dc7be47188caa5378147da

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 f18916519520fbcc6b668849c799101a
SHA1 303874ab8a86617bb14de65295106b2709f9e599
SHA256 e594f67d5f1dbaa0a6887b72769a3648db3d3d4b6c4d250e75b36f4fbe3f9364
SHA512 982d3e0b43e7844796c66b4f60b10a25e39bbab81e2aa32c482af80c356a527dfec9256608ad97dd6ab58a188385fd958171f9a72a97ee65079eece304b1dbbf

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1

MD5 b5b69eb48ed21f58e393e85292a053b5
SHA1 e7e0a25e1beae4c1d48f9e1df6b39c26d9f12f38
SHA256 ffddd92ece6c5c787bad7fd5195e7c6555252a9b62ae050e2404ceb3f9d9154d
SHA512 4a320913062dc001da56552e3656b68148306ea08f7d5645a778550bf0254c55993d747fcdacf084e99a06469068a239885c2e4f69293158e437e8da11d556d2

memory/1956-328-0x00000000002E0000-0x00000000003B6000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 eb3d316cdcfbd28d444c7e25486437cd
SHA1 9c9812a0640caebe1e61e7e3731fc9cd2a26f8c3
SHA256 628287e7e5e5dd5a2330522c4f8a8227ce931927c8e1cd23c620e1b059f1f59e
SHA512 9d48860d2d6be9c6fa693e86f2bb6be4d6979692536de0cd4af7662fe83050b842da12d2ce15a4b80d5b721b287591409d1686ed136cf8227f3c002da1ec1276

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\39a99ce5-9800-4c44-923e-18b3bcbe19ee.tmp

MD5 51656de279eb223376c7f0576371e3cd
SHA1 386fa0b48aeef6d06a203cce1e0205c82cee2c80
SHA256 69eb09d56dcb12d1e2475c2d464ca078ef25d02b80006ded2338affe739dced2
SHA512 276f68b3fdfe6e8537513edaf9807b8ed220a0a3d57733c673d080a4253fff40247b448ce5b23299cc8e38a0e9d4fb70ddd9559fdce5de644106cfece899b577

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\9c25e8de-3e62-4113-990f-fc520d7b80b1.tmp

MD5 1c821a4207930e3dfb2b5a1123c65047
SHA1 e10104ce75b12e784b47d12575580dca656239d1
SHA256 64973ce3b85a6097f7bb5ebadb21b7bcfa969e66ad899f99f350223e2d70d82f
SHA512 b8b12b39de5c03e8ceed89ec6927d21d32774a23679b39d67cce4c851424a391df566090d6c8851563ee23fe46ddece6da8766154eca2c4b404edc85def735cf

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\402b3752-14bb-4e43-8f5b-b83e46c88a29.tmp

MD5 9f226b8e4cbba48518ae62d3104dacce
SHA1 9ffc1b21890aed1bf95ac0bfea25a54181c0c9d7
SHA256 7d709c495efdc4a2b9d1726b898f40c6dc9f2e369d20da21df093f2507761432
SHA512 ae7fde066daac58a94b603d102d514147f439ae53211dcdfbbb413517e144169f918aa8173a2cd0233d70cbddee8b59b573fb7693663a57ba112a4163420144f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\bd7b0f50-bf27-4597-b188-912a5c8a4e28.tmp

MD5 d00d77c7dd479002fe89ed90f8332bfc
SHA1 e6f47fc6a075c9280cec2349d69f58c1514f7726
SHA256 08dbcecd50cc89e9cdf162f177507e95149364bd12b6002c8eba503a68e2315b
SHA512 27ac5a41bf9263ba24c79e8c23435e76e6f3efd730bf9102f095d6de3623039158ba6ad523bd1b2e0ddfbf028eb4ac838a01d3bff6cd0403ff2d5598c6d36eba

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 b93323991405e795883e50e50ba8f564
SHA1 392ba3f836c8bf8d3ce625580b63a9d85fd81acd
SHA256 8e67854fb8a3eb7705ea1e65cd850c45368a296995dd0c065d4366fdb6d259f1
SHA512 2e847163aa6f1a3deb1a3ed09de6e2a33a41ae31ac156f07e0c5b433fd90cebde6260543a611d90c0c5f9dd8c8973632d1740d91f76e47ce1d8f44a5c6ad52d6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 f8d75fe8a59124a1fabfdbfe0c417306
SHA1 c1d3f0d395e6f9ee455af9f0f82792e5d0206591
SHA256 8afb3945ea9d1a5debe7522f1eca59307c6a27bedb2cd89c6907dc7665f15970
SHA512 ecec9205d8b03e56a9454982928ec65121d9cbee67758f648d2726bb77b77dffa56f7dee06da8891445b5f7f86b891e1292905d00042dc08ff3a42a8c40825df

memory/408-491-0x0000000000130000-0x0000000000206000-memory.dmp

memory/1756-492-0x00000000000A0000-0x0000000000176000-memory.dmp

memory/1712-493-0x0000000000900000-0x00000000009D6000-memory.dmp

memory/2044-494-0x0000000000CD0000-0x0000000000DA6000-memory.dmp

memory/776-495-0x00000000011D0000-0x00000000012A6000-memory.dmp

memory/2800-496-0x0000000000A30000-0x0000000000B06000-memory.dmp

memory/2468-497-0x00000000009E0000-0x0000000000AB6000-memory.dmp

memory/1228-499-0x00000000002C0000-0x0000000000396000-memory.dmp

memory/1784-500-0x0000000001090000-0x0000000001166000-memory.dmp

memory/2332-502-0x0000000140000000-0x00000001405E8000-memory.dmp

memory/2332-501-0x0000000140000000-0x00000001405E8000-memory.dmp

memory/2332-503-0x0000000140000000-0x00000001405E8000-memory.dmp

memory/2288-506-0x0000000000C90000-0x0000000000C98000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2752c52f-192e-4da1-af04-5a421a91dce4.tmp

MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000013.dbtmp

MD5 a6813b63372959d9440379e29a2b2575
SHA1 394c17d11669e9cb7e2071422a2fd0c80e4cab76
SHA256 e6325e36f681074fccd2b1371dbf6f4535a6630e5b95c9ddff92c48ec11ce312
SHA512 3215a0b16c833b46e6be40fe8e3156e91ec0a5f5d570a5133b65c857237826053bf5d011de1fcc4a13304d7d641bcba931178f8b79ee163f97eb0db08829e711

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000011.dbtmp

MD5 6de46ed1e4e3a2ca9cf0c6d2c5bb98ca
SHA1 e45e85d3d91d58698f749c321a822bcccd2e5df7
SHA256 a197cc479c3bc03ef7b8d2b228f02a9bfc8c7cc6343719c5e26bebc0ca4ecf06
SHA512 710620a671c13935820ed0f3f78269f6975c05cf5f00542ebc855498ae9f12278da85feef14774206753771a4c876ae11946f341bb6c4d72ebcd99d7cff20dcd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000008.dbtmp

MD5 589c49f8a8e18ec6998a7a30b4958ebc
SHA1 cd4e0e2a5cb1fd5099ff88daf4f48bdba566332e
SHA256 26d067dbb5e448b16f93a1bb22a2541beb7134b1b3e39903346d10b96022b6b8
SHA512 e73566a037838d1f7db7e9b728eba07db08e079de471baca7c8f863c7af7beb36221e9ff77e0a898ce86d4ef4c36f83fb3af9c35e342061b7a5442ca3b9024d2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0ab308cb-392c-4e33-84e3-8c0c6fd58343.tmp

MD5 f7f04a5874030e613cd1a5dac13d4a07
SHA1 6ec349764b1431e94c8604a9f9e8612e1f1de795
SHA256 a76b2ffc12af6b6833f0b53ec0614ce4e9d2d365a98c3bb196c6c1b765939158
SHA512 9624cec033c0efb4328b5b08b4b5944546ac33e7fe22d02d10d748f79a01c3e2e6e56f5ed7bcf6baaf31a2529b1a255637a1c76d3b7f48dfaddacd515631eb85

memory/2332-611-0x0000000140000000-0x00000001405E8000-memory.dmp

memory/2332-612-0x0000000140000000-0x00000001405E8000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 94c562d09ac8e01c68b812e94fbfb430
SHA1 ebaa7653029623f3acf1c787354566cc62e10772
SHA256 fbb2ec0ce7e762ee3a00ad766cce627321709946c77dd2e2649d87a3466edb55
SHA512 cffe051cefcd8cb683564bb6ee42c786890e9a769182c1c8dbd6348cace55d0fa114d59088e5c480493196511839283ae65976b41128416030cce805e69fa461

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 fc2753e7db8b81978730a926965bda98
SHA1 2a9e942f69840ed1a3e9d90447c71522b2e5220b
SHA256 ebe1905e41b7a937b9b1b55d42bcaa30c6bc4aa58e8a688203c42e66c40353f3
SHA512 fad90da35f57a25b06b13368e2e6271e9d0ac9ed6d07ca3460988189c8a182d2c1a05e6517c857b73103a4af3cbeacb7f1603d8161362c2df0077e8643e8d8ca

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 599f151ee20d54920cf40fcd1b7d6dd0
SHA1 481fe65fbef1a05c236fc7c8651ee6a9a2a180e7
SHA256 56a6e64a08106d5171b33f233ab02e5443b538e6ee9d75452c1e60280f30422f
SHA512 da9d60220477e4ea5c97b5c40723f5042b16a385ef5ccfcde1d9f4fb0baa2c0326a2cf93e54a9a0f6eece16e3c2e425d6b26f2cf743f254cd1d2a7e1f35c7a5d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\9464758c-cfb7-4f07-a3b4-e50bfab224cd.tmp

MD5 c96d2491d149ec6f92b7c53db122a006
SHA1 75dadac04403c9ce1efc6984eb4a47dfd446ec73
SHA256 30b2a42565ddd3cde6c839e141d3d7ecb6fd2b06b79dce00989a5f508526615e
SHA512 24a412cef452941d75369fbf80d0923b9c959a9a983c334645a5cb908cf74823c19a77af9e5380e0046feab9bf41f2c38d5463c80b402cfc42fd0c41de463f24

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 414feabdb7a95a437ae1359c37975db4
SHA1 5297ade3fe31722b1fe2632eb4767ac822cd8940
SHA256 b83d6f2a8f3a632e37553ceea745d7a9b896461facf0670ace530263172ad39e
SHA512 ef3941b07714ab4952c258c0d6a494a05a1303f4db7d528ba32af85508d6ae9f1c775cdfc51bed83c659252b7242c31eeb19fd02b7c7004537381cd4a6cb2024

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000017.dbtmp

MD5 d8c7ce61e1a213429b1f937cae0f9d7c
SHA1 19bc3b7edcd81eace8bff4aa104720963d983341
SHA256 7d3d7c3b6e16591b894a5ce28f255cb136bb6c45f5038c3b120b44b413082e35
SHA512 ffc1854cccbd5a5c1740df9d3ba48994d48ef9a585bd513f00371c68086629d45ee293336af0f27ff350614f68ee660890920773f9ebdf1c327f20a620860a15

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000016.dbtmp

MD5 edd71dd3bade6cd69ff623e1ccf7012d
SHA1 ead82c5dd1d2025d4cd81ea0c859414fbd136c8d
SHA256 befea596b4676ccf7cc37ea8048044bfa0556c8931d76fdeeb693d20264e50d6
SHA512 7fa9b9ef95db0ce461de821f0dec1be8147095680b7879bad3c5752692294f94ebc202b85577b5abac9aeaf48371595dd61792786a43c0bd9b36c9fc3752669d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\1be3ff24-52be-4a9d-ad6e-82742177aa4f.tmp

MD5 5dc6a00dc85a87abf861921d51484585
SHA1 9f79e172592f2fd9c62fd4709b254b718843355f
SHA256 10e59c015bd4a1a8c778bb301f89bb3aaabba348c6c243616bde713d986258a0
SHA512 67859af979927c767b94d62d44f368cf8ee19125a6692d4d3afdea36da9f8e8c216ac3f3ec604730c83673199b558dfd998d44438d58994826ff22ac1b12606e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000020.dbtmp

MD5 a874f3e3462932a0c15ed8f780124fc5
SHA1 966f837f42bca5cac2357cff705b83d68245a2c2
SHA256 01bd196d6a114691ec642082ebf6591765c0168d4098a0cd834869bd11c8b87d
SHA512 382716d6fc0791ca0ccfa1efba318cff92532e04038e9b9aa4c27447ac2cac26c79da8ee7dbafae63278df240f0a8cab5efea2ee34eef2e54e884784147e6d00

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000015.dbtmp

MD5 d1625ab188e7c8f2838b317ba36efc69
SHA1 9352ce60916471b427e9f6d8f192ae2cd9c1ecdb
SHA256 f6a28e2e41d451b4de8597a14916d7a3058ebdd8046a89109658321142660d69
SHA512 50bf78dece37f946a6229d81cb61f0cc647b78220205ebd7f265582e6b228666c6229c219c480556257a135ef5f26600a497dc66494b40779c71ec62a2fb5e42

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser

MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000012.dbtmp

MD5 ab6ab31fbc80601ffb8ed2de18f4e3d3
SHA1 983df2e897edf98f32988ea814e1b97adfc01a01
SHA256 eaab30ed3bde0318e208d83e6b0701b3ee9eb6b11da2d9fbab1552e8e4ce88f8
SHA512 41b42e6ab664319d68d86ce94a6db73789b2e34cba9b0c02d55dfb0816af654b02284aa3bfd9ae4f1a10e920087615b750fb2c54e9b3f646f721afb9a0d1aea3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\cd2bbb14-5640-4acc-8849-b49fe0a7f9a0.tmp

MD5 06c11339beb0f6960121c7b3ec354080
SHA1 8a5673be26b7dc25f8c5314b310e459d3dda0726
SHA256 2436db44f066a3094f01cc1950b76935ba48eb61d32395bd685bd8c92d783fcd
SHA512 3c9111fdb1773ddd4f5730aae5d072c3d436bc87a7e5e4ee67c3d7391d6c87340b90eceb108c4dea679e86d98d7332d7cbaa43e991d9a4e4700beb47ba8e7172

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

MD5 bc6142469cd7dadf107be9ad87ea4753
SHA1 72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c
SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
SHA512 47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 b6fa06eee58128ff4069e0eba597c1d5
SHA1 9493b8aca993b443c9c1df92250ab522941b74f3
SHA256 93dd7291653544d3758ef962e6fedea481659be37d27ee99968e8d47bd73a0e9
SHA512 12abf6e37222a15531572c696b5ab685c2ae1069e2d6548ff4c91ab740611e22de510ffaecd0cfc075906a0634069ba0f35caf664a6c64286c849ce023e8c0a9

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0

MD5 4230d831b53cc662e4d9e6129ee80913
SHA1 b0bdf6095c5e73b6127074738370c7875e557c75
SHA256 c1fdd6b9958786797ce302904bd246e7d3168941281bb910ad353fff06b11c61
SHA512 2dae49b54532abfd07588bfba6f071787b712ad1d7ecc0cf0f289aa5404bdd3cccb44bd6105bf3218fa3d47633cd28704fb150811c2833664f2e3538aa43aaff

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\38a99532-cb38-45f6-a02f-d0398c5a7482.tmp

MD5 41d491e10f980d5e08d113d6412beb09
SHA1 e9a371912bd2b0526bd40153b21d4879f6e82caa
SHA256 4ef277e001ddf4ce9101d583821bc3e9d517b6fb69acb0dff3bd2fc892e9bf4f
SHA512 0b6bfd174ab0e87ff605c34896c6124916596fe75a0a50fd06739cb5935449b91a4e2eb8d811cf628c4eba06faad5b96c32ecd914303efed8c0b205a9442a218

memory/3608-1071-0x0000000001290000-0x0000000001366000-memory.dmp

memory/3580-1072-0x0000000001130000-0x0000000001206000-memory.dmp

memory/3596-1073-0x0000000000F60000-0x0000000001036000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000023.dbtmp

MD5 2091e7af40368b8a9183a08a62efc8f9
SHA1 c552e8726cfab57eeb03d5e176cedd0771382530
SHA256 368b5cdab2ff128767296bb4f19bfcd39baa627eaaf43cafba54fc223feec47f
SHA512 c4d0d89ab6ca7ed48f10c8bc3211a3a1a8776a54ff58bf79940921d6e1b06fdccb9b593ac8d4b7cc2cb80f320f72cbd3104fe2ed67b1462b9d59356c75b4b4e6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\9e36a9d6-e9ba-4aa4-a480-f38ce453d6f6.tmp

MD5 e1113a8d71d6e6dc49d655594c227e89
SHA1 aa8f4289fd162c8c8fb8ec96d3c442168225fa26
SHA256 1673a4d10cf3f21420ed89993d2a7c0166a0f97caf141db7f9aa49de1adb75ae
SHA512 d4a979808d8e4f3e2dec22a90b0042c56fb57161b379e50d9088663725867537738a1c1273ae71b117c22caebf634b572d7522f163c86a69e79fe4d76ab77ce7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\231f5805-df05-4a11-80f5-d0d89cb89101.tmp

MD5 2175af24eef7bdc40d8187814cc22dc5
SHA1 d1244d9dee382d1ab8ce60db223a3b74221f2808
SHA256 7eed7710fd812e1e3bc69e6f40a97eac1a277925d0c1e51b9a0a3e36cd33f5de
SHA512 94e3256e740c9cda8c921dd01686b0262da718cd7e094960e5b11930728b3894461a33e9d4b8ada8b2993094cea212a355bd8833fcb94bd9ba447abcc4d952cb

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000014.dbtmp

MD5 ebc863bd1c035289fe8190da28b400bc
SHA1 1e63d5bda5f389ce1692da89776e8a51fa12be13
SHA256 61657118abc562d70c10cbea1e8c92fab3a92739f5445033e813c3511688c625
SHA512 f21506feeed984486121a09c1d43d4825ec1ec87f8977fa8c9cd4ff7fe15a49f74dc1b874293409bd309006c7bbc81e1c4bcba8d297c5875ca009b02e6d2b7be

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 9ad499b15c7146f1646371aa3524b6c4
SHA1 436584bfd53fb1883af54d5a6c9c4bfc3f4dd5c5
SHA256 85b4bd062f5ad3d5658f15bdb3e4740909b9f104e4fe53a23bb48cbbd58d76a4
SHA512 3e1e1c71f513d26dd8e978915d2abcae8ec33eecbffaa429104ff836bee9bd0419aec848085a788ea6157876c169b40576bca30599b05ce9a795e7135b9e8d3f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3

MD5 56a4d01d26c9dbde9df4b3859103a09d
SHA1 44a1cca5db54f4f17df50832d50485a3d1ce2f0d
SHA256 bbd0f0861c313032c93a5e477a5e590d7e997159f6744e5f6693bc28b31c6124
SHA512 07f6b110565bf30a4de6e5227fcf969546800a2ba78801bec5c7b53c3a48f6695b2d66fca10342ef04df0196f481f7ed249bca24784265667a6a0a5177e88e00

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\faaea7a8-5ee5-4e9d-9707-972f29688a25.tmp

MD5 756c24821ad8d51485b3a7d35bd4b954
SHA1 4eca782040f0add4b706fc059c1a67e9e8b419d8
SHA256 21ee151122154a9a131e23f40212f410c806dc1c223287c85929aad356fe52ce
SHA512 73449532833081be680f33f869f54cfac241cc9d43a4af8037ea9751dc31016434a1c43d9c0c2f1b978c084ecb1c1e14a01d321ff14874a8e3fd02409f00c5b6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 042db672ab3eaba3d7c37de4801339db
SHA1 b6334a1d7efb894b4d185d5eafb6541b5d17982e
SHA256 e5af5ac352e3682c423df03d2bf967f238ab558a07ef2cb8aaec5982aa711a2c
SHA512 6334dd08f8d6dd77d4c8f3f4b8ceb0170ee67e2a0592b94a68dcfd1bf98ca19debafe9edc5539bdae1e741ef9a152cda80f402976a18cde2511654b21cc841e2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 0ca8dfbba363c05650d30e165ce62106
SHA1 4577c0c4b455444adb2f4f3a3c229e39b9bdd5d1
SHA256 6432e2465b0dfbd63a297519e5d7f4824521509b4028b3e49631255f1adbe81a
SHA512 0987edaa6386fc2f034a735ffda95f0feb14469476c8cb11f1ada449017567586817c0d42e82bd373e783b0e15187c251e0b09717c0e925b196553ddca42539f

memory/3644-1306-0x0000000000060000-0x0000000000136000-memory.dmp

memory/1924-1307-0x0000000000FD0000-0x00000000010A6000-memory.dmp

memory/1668-1308-0x0000000001320000-0x00000000013F6000-memory.dmp

memory/2816-1309-0x0000000000E30000-0x0000000000F06000-memory.dmp

memory/3416-1310-0x0000000000040000-0x0000000000116000-memory.dmp

memory/3360-1311-0x0000000000960000-0x0000000000A36000-memory.dmp