72294439ea999709ae9574292116846bf946d640fde793e49deec4a2b3a23bb9

Analysis

max time kernel
1800s
max time network
1805s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

first_party_sets.db
Size

48KB
MD5

e52d9864a92d73cabb391df745e79d60
SHA1

acca54c8968c914d08821d88b3ef925ad084f8e3
SHA256

72294439ea999709ae9574292116846bf946d640fde793e49deec4a2b3a23bb9
SHA512

fe4ed62a668ee3be1a9208e9d17a9b57b784c8f63ed47b6da6282de71c8415788b65a869f5938c3bd18ad945ae49feb32e45d38059b17f00296f8ab2330a2065
SSDEEP

24:TLizU4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwBgfxnY:Te/IHRH34kWqB1kQnjhHmr6ITmUrxY

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

bdcam.exebdcam.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	bdcam.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	bdcam.exe

Executes dropped EXE 11 IoCs

Processes:

bdcamsetup.exebdcamsetup.exeBDMPEG1SETUP.EXEbdcam.exebdcam.exebdcam.exebdcam.exebdcam.exebdcam.exebdcam.exebdfix.exe

pid	process
2380	bdcamsetup.exe
5168	bdcamsetup.exe
2920	BDMPEG1SETUP.EXE
4836	bdcam.exe
5680	bdcam.exe
2704	bdcam.exe
1668	bdcam.exe
5576	bdcam.exe
852	bdcam.exe
1148	bdcam.exe
1600	bdfix.exe

Loads dropped DLL 64 IoCs

Processes:

bdcamsetup.exebdcamsetup.exeBDMPEG1SETUP.EXEregsvr32.exeregsvr32.exerundll32.exerundll32.exerundll32.exerundll32.exeLithium Nuker V2.exe

pid	process
2380	bdcamsetup.exe
5168	bdcamsetup.exe
5168	bdcamsetup.exe
5168	bdcamsetup.exe
5168	bdcamsetup.exe
5168	bdcamsetup.exe
5168	bdcamsetup.exe
5168	bdcamsetup.exe
5168	bdcamsetup.exe
5168	bdcamsetup.exe
2380	bdcamsetup.exe
2380	bdcamsetup.exe
2380	bdcamsetup.exe
2380	bdcamsetup.exe
2380	bdcamsetup.exe
2380	bdcamsetup.exe
2380	bdcamsetup.exe
2380	bdcamsetup.exe
2920	BDMPEG1SETUP.EXE
1492	regsvr32.exe
1656	regsvr32.exe
2920	BDMPEG1SETUP.EXE
3904	rundll32.exe
5284	rundll32.exe
2380	bdcamsetup.exe
2380	bdcamsetup.exe
2380	bdcamsetup.exe
4444	rundll32.exe
3752	rundll32.exe
3156	Lithium Nuker V2.exe
3156	Lithium Nuker V2.exe
3156	Lithium Nuker V2.exe
3156	Lithium Nuker V2.exe
3156	Lithium Nuker V2.exe
3156	Lithium Nuker V2.exe
3156	Lithium Nuker V2.exe
3156	Lithium Nuker V2.exe
3156	Lithium Nuker V2.exe
3156	Lithium Nuker V2.exe
3156	Lithium Nuker V2.exe
3156	Lithium Nuker V2.exe
3156	Lithium Nuker V2.exe
3156	Lithium Nuker V2.exe
3156	Lithium Nuker V2.exe
3156	Lithium Nuker V2.exe
3156	Lithium Nuker V2.exe
3156	Lithium Nuker V2.exe
3156	Lithium Nuker V2.exe
3156	Lithium Nuker V2.exe
3156	Lithium Nuker V2.exe
3156	Lithium Nuker V2.exe
3156	Lithium Nuker V2.exe
3156	Lithium Nuker V2.exe
3156	Lithium Nuker V2.exe
3156	Lithium Nuker V2.exe
3156	Lithium Nuker V2.exe
3156	Lithium Nuker V2.exe
3156	Lithium Nuker V2.exe
3156	Lithium Nuker V2.exe
3156	Lithium Nuker V2.exe
3156	Lithium Nuker V2.exe
3156	Lithium Nuker V2.exe
3156	Lithium Nuker V2.exe
3156	Lithium Nuker V2.exe

Registers COM server for autorun 1 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1C6833E-A3EC-4397-9FA9-151792F3408F}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E2E7539A-CECF-4A6A-B187-939943ECEF05}\InprocServer32\ = "C:\\Program Files (x86)\\BandiMPEG1\\bdfilters64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F4F5C9E9-CFCC-4C65-A8BD-0423A338F188}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F4F5C9E9-CFCC-4C65-A8BD-0423A338F188}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{89C4B786-A490-4A3E-AA70-E6A8C61D3689}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{89C4B786-A490-4A3E-AA70-E6A8C61D3689}\InprocServer32\ = "C:\\Program Files (x86)\\BandiMPEG1\\bdfilters64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1C6833E-A3EC-4397-9FA9-151792F3408F}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1C6833E-A3EC-4397-9FA9-151792F3408F}\InprocServer32\ = "C:\\Program Files (x86)\\BandiMPEG1\\bdfilters64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{89C4B786-A490-4A3E-AA70-E6A8C61D3689}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E2E7539A-CECF-4A6A-B187-939943ECEF05}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E2E7539A-CECF-4A6A-B187-939943ECEF05}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F4F5C9E9-CFCC-4C65-A8BD-0423A338F188}\InprocServer32\ = "C:\\Program Files (x86)\\BandiMPEG1\\bdfilters64.dll"	regsvr32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service
T1102

Processes:

flow ioc

150 discord.com
151 discord.com
331 discord.com
455 discord.com
483 discord.com
149 discord.com

flow	ioc
150	discord.com
151	discord.com
331	discord.com
455	discord.com
483	discord.com
149	discord.com

Drops file in System32 directory 14 IoCs

Processes:

BDMPEG1SETUP.EXEbdcamsetup.exe

description	ioc	process
File created	C:\Windows\SysWOW64\bdmjpeg.dll	BDMPEG1SETUP.EXE
File created	C:\Windows\SysWOW64\msvcr110.dll	bdcamsetup.exe
File created	C:\Windows\system32\vcomp140.dll	bdcamsetup.exe
File created	C:\Windows\system32\D3DCompiler_47.dll	bdcamsetup.exe
File created	C:\Windows\system32\msvcp110.dll	bdcamsetup.exe
File created	C:\Windows\system32\bdmpega64.acm	BDMPEG1SETUP.EXE
File created	C:\Windows\SysWOW64\D3DCompiler_47.dll	bdcamsetup.exe
File created	C:\Windows\system32\msvcr110.dll	bdcamsetup.exe
File created	C:\Windows\SysWOW64\bdmpegv.dll	BDMPEG1SETUP.EXE
File created	C:\Windows\SysWOW64\bdmpega.acm	BDMPEG1SETUP.EXE
File created	C:\Windows\SysWOW64\vcomp140.dll	bdcamsetup.exe
File created	C:\Windows\SysWOW64\msvcp110.dll	bdcamsetup.exe
File created	C:\Windows\system32\bdmjpeg64.dll	BDMPEG1SETUP.EXE
File created	C:\Windows\system32\bdmpegv64.dll	BDMPEG1SETUP.EXE

Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs

Processes:

bdcam.exebdcam.exebdcam.exebdcam.exebdcam.exebdcam.exe

pid	process
5680	bdcam.exe
5680	bdcam.exe
2704	bdcam.exe
2704	bdcam.exe
1668	bdcam.exe
1668	bdcam.exe
5576	bdcam.exe
5576	bdcam.exe
852	bdcam.exe
852	bdcam.exe
1148	bdcam.exe
1148	bdcam.exe

Drops file in Program Files directory 64 IoCs

Processes:

bdcamsetup.exeBDMPEG1SETUP.EXE

description	ioc	process
File created	C:\Program Files\Bandicam\lang\Arabic.ini	bdcamsetup.exe
File created	C:\Program Files\Bandicam\lang\Traditional_Chinese.ini	bdcamsetup.exe
File created	C:\Program Files\Bandicam\lang\Urdu.ini	bdcamsetup.exe
File opened for modification	C:\Program Files\Bandicam\lang\Slovenian.ini	bdcamsetup.exe
File opened for modification	C:\Program Files\Bandicam\data\rclick.wav	bdcamsetup.exe
File created	C:\Program Files\Bandicam\lang\Armenian.ini	bdcamsetup.exe
File created	C:\Program Files\Bandicam\bdcamvk32.dll	bdcamsetup.exe
File created	C:\Program Files\Bandicam\lang\Luxembourgish.ini	bdcamsetup.exe
File opened for modification	C:\Program Files\Bandicam\lang\Farsi.ini	bdcamsetup.exe
File opened for modification	C:\Program Files\Bandicam\lang\Indonesian.ini	bdcamsetup.exe
File opened for modification	C:\Program Files\Bandicam\lang\Luxembourgish.ini	bdcamsetup.exe
File opened for modification	C:\Program Files\Bandicam\data\effects\effects15.dat	bdcamsetup.exe
File created	C:\Program Files (x86)\BandiMPEG1\uninstall.exe	BDMPEG1SETUP.EXE
File created	C:\Program Files\Bandicam\lang\Farsi.ini	bdcamsetup.exe
File created	C:\Program Files\Bandicam\lang\Greek.ini	bdcamsetup.exe
File opened for modification	C:\Program Files\Bandicam\lang\Hungarian.ini	bdcamsetup.exe
File opened for modification	C:\Program Files\Bandicam\lang\Serbian.ini	bdcamsetup.exe
File opened for modification	C:\Program Files\Bandicam\lang\Sinhala.ini	bdcamsetup.exe
File created	C:\Program Files\Bandicam\lang\Czech.ini	bdcamsetup.exe
File opened for modification	C:\Program Files\Bandicam\data\effects\highlight10.dat	bdcamsetup.exe
File created	C:\Program Files\Bandicam\lang\Japanese.ini	bdcamsetup.exe
File created	C:\Program Files\Bandicam\lang\Kazakh.ini	bdcamsetup.exe
File created	C:\Program Files\Bandicam\lang\Serbian(Cyrillic).ini	bdcamsetup.exe
File created	C:\Program Files\Bandicam\data\skin.dat	bdcamsetup.exe
File opened for modification	C:\Program Files\Bandicam\lang\Armenian.ini	bdcamsetup.exe
File opened for modification	C:\Program Files\Bandicam\data\stop.wav	bdcamsetup.exe
File created	C:\Program Files\Bandicam\lang\Azerbaijani.ini	bdcamsetup.exe
File opened for modification	C:\Program Files\Bandicam\lang\Uzbek.ini	bdcamsetup.exe
File created	C:\Program Files\Bandicam\data\effects\effects20.dat	bdcamsetup.exe
File created	C:\Program Files\Bandicam\lang\Belarusian.ini	bdcamsetup.exe
File created	C:\Program Files\Bandicam\lang\Simplified_Chinese.ini	bdcamsetup.exe
File created	C:\Program Files\Bandicam\data\language.dat	bdcamsetup.exe
File opened for modification	C:\Program Files\Bandicam\data\camera.wav	bdcamsetup.exe
File created	C:\Program Files\Bandicam\bdcam_safemode.lnk	bdcamsetup.exe
File created	C:\Program Files\Bandicam\lang\Bulgarian.ini	bdcamsetup.exe
File created	C:\Program Files\Bandicam\lang\Dutch.ini	bdcamsetup.exe
File created	C:\Program Files\Bandicam\lang\English.ini	bdcamsetup.exe
File created	C:\Program Files\Bandicam\lang\Romanian.ini	bdcamsetup.exe
File created	C:\Program Files\Bandicam\data\stop.wav	bdcamsetup.exe
File created	C:\Program Files\Bandicam\data\effects\highlight20.dat	bdcamsetup.exe
File created	C:\Program Files\Bandicam\bdfix.exe	bdcamsetup.exe
File created	C:\Program Files\Bandicam\lang\Vietnamese.ini	bdcamsetup.exe
File created	C:\Program Files\Bandicam\uninstall.exe	bdcamsetup.exe
File opened for modification	C:\Program Files\Bandicam\lang\Bulgarian.ini	bdcamsetup.exe
File opened for modification	C:\Program Files\Bandicam\data\effects\effects10.dat	bdcamsetup.exe
File created	C:\Program Files\Bandicam\lang\Serbian.ini	bdcamsetup.exe
File opened for modification	C:\Program Files\Bandicam\lang\Georgian.ini	bdcamsetup.exe
File opened for modification	C:\Program Files\Bandicam\lang\Hebrew.ini	bdcamsetup.exe
File opened for modification	C:\Program Files\Bandicam\lang\Italian.ini	bdcamsetup.exe
File opened for modification	C:\Program Files\Bandicam\data\start.wav	bdcamsetup.exe
File opened for modification	C:\Program Files\Bandicam\uninstall.exe	bdcamsetup.exe
File opened for modification	C:\Program Files\Bandicam\lang\Burmese.ini	bdcamsetup.exe
File created	C:\Program Files\Bandicam\lang\Polish.ini	bdcamsetup.exe
File opened for modification	C:\Program Files\Bandicam\lang\Dutch.ini	bdcamsetup.exe
File opened for modification	C:\Program Files\Bandicam\lang\Latvian.ini	bdcamsetup.exe
File opened for modification	C:\Program Files\Bandicam\lang\Norwegian.ini	bdcamsetup.exe
File opened for modification	C:\Program Files\Bandicam\lang\Traditional_Chinese.ini	bdcamsetup.exe
File opened for modification	C:\Program Files\Bandicam\lang\Vietnamese.ini	bdcamsetup.exe
File created	C:\Program Files\Bandicam\translators.txt	bdcamsetup.exe
File created	C:\Program Files\Bandicam\lang\Croatian.ini	bdcamsetup.exe
File created	C:\Program Files\Bandicam\bdcamvk64.dll	bdcamsetup.exe
File created	C:\Program Files\Bandicam\lang\Thai.ini	bdcamsetup.exe
File created	C:\Program Files\Bandicam\data\start.wav	bdcamsetup.exe
File opened for modification	C:\Program Files\Bandicam\lang\Azerbaijani.ini	bdcamsetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exemsedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

bdcamsetup.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	bdcamsetup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\bdcam.exe = "11000"	bdcamsetup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_SCRIPTURL_MITIGATION	bdcamsetup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION\bdcam.exe = "1"	bdcamsetup.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133609012725566734"	chrome.exe

Modifies registry class 64 IoCs

Processes:

regsvr32.exebdfix.exeBDMPEG1SETUP.EXEbdcam.exebdcam.exechrome.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E2E7539A-CECF-4A6A-B187-939943ECEF05}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	bdfix.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	bdfix.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	bdfix.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F4F5C9E9-CFCC-4C65-A8BD-0423A338F188}\ = "Bandicam MPEG-1 Audio Property"	BDMPEG1SETUP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1C6833E-A3EC-4397-9FA9-151792F3408F}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	bdfix.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89C4B786-A490-4A3E-AA70-E6A8C61D3689}\ = "Bandicam MPEG-1 Video Decoder"	BDMPEG1SETUP.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	bdfix.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0400000003000000000000000200000001000000ffffffff	bdfix.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\4\NodeSlot = "5"	bdfix.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	bdfix.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F4F5C9E9-CFCC-4C65-A8BD-0423A338F188}\ = "Bandicam MPEG-1 Audio Property"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89C4B786-A490-4A3E-AA70-E6A8C61D3689}\InprocServer32	BDMPEG1SETUP.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	bdfix.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	bdfix.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	bdfix.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	bdfix.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2E7539A-CECF-4A6A-B187-939943ECEF05}	BDMPEG1SETUP.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\BANDICAM.bfix\DefaultIcon\ = "C:\\Program Files\\Bandicam\\bdfix.exe"	bdcam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3\NodeSlot = "4"	bdfix.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{89C4B786-A490-4A3E-AA70-E6A8C61D3689}	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Documents"	bdfix.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff	bdfix.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	bdfix.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	bdfix.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{89C4B786-A490-4A3E-AA70-E6A8C61D3689}\CLSID = "{89C4B786-A490-4A3E-AA70-E6A8C61D3689}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\BANDICAM.bfix\Shell\Open\Command	bdcam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\BANDICAM.bfix\Shell\Open\Command\ = "\"C:\\Program Files\\Bandicam\\bdfix.exe\"\"%1\""	bdcam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	bdfix.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Videos"	bdfix.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89C4B786-A490-4A3E-AA70-E6A8C61D3689}	BDMPEG1SETUP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E2E7539A-CECF-4A6A-B187-939943ECEF05}\CLSID = "{E2E7539A-CECF-4A6A-B187-939943ECEF05}"	BDMPEG1SETUP.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E2E7539A-CECF-4A6A-B187-939943ECEF05}	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	bdfix.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\BANDICAM.bfix\Shell	bdcam.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	bdfix.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	bdfix.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	bdfix.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\4	bdfix.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3808065738-1666277613-1125846146-1000\{0ECE962D-E528-4234-9232-C0A8C6786F05}	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A1C6833E-A3EC-4397-9FA9-151792F3408F}	BDMPEG1SETUP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F4F5C9E9-CFCC-4C65-A8BD-0423A338F188}\InprocServer32\ = "C:\\Program Files (x86)\\BandiMPEG1\\bdfilters64.dll"	regsvr32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	bdfix.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	bdfix.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	bdfix.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	bdfix.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E2E7539A-CECF-4A6A-B187-939943ECEF05}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	bdfix.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	bdfix.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	bdfix.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	bdfix.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\BANDICAM.bfix\DefaultIcon	bdcam.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	bdfix.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	bdfix.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\BANDICAM.bfix\Shell\Open\Command\ = "\"C:\\Program Files\\Bandicam\\bdfix.exe\"\"%1\""	bdcam.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	bdfix.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 03000000000000000200000001000000ffffffff	bdfix.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	bdfix.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	bdfix.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2E7539A-CECF-4A6A-B187-939943ECEF05}\ = "Bandicam MPEG-1 Audio Decoder"	BDMPEG1SETUP.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	bdfix.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	bdfix.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	bdfix.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

chrome.exechrome.exebdcam.exebdcam.exebdcam.exemsedge.exebdcam.exebdcam.exebdcam.exemsedge.exe

pid	process
1844	chrome.exe
1844	chrome.exe
4444	chrome.exe
4444	chrome.exe
5680	bdcam.exe
5680	bdcam.exe
5680	bdcam.exe
5680	bdcam.exe
2704	bdcam.exe
2704	bdcam.exe
1668	bdcam.exe
1668	bdcam.exe
1668	bdcam.exe
1668	bdcam.exe
2872	msedge.exe
2872	msedge.exe
5576	bdcam.exe
5576	bdcam.exe
5576	bdcam.exe
5576	bdcam.exe
852	bdcam.exe
852	bdcam.exe
852	bdcam.exe
852	bdcam.exe
1148	bdcam.exe
1148	bdcam.exe
1148	bdcam.exe
1148	bdcam.exe
5564	msedge.exe
5564	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

bdfix.exe

pid process

1600 bdfix.exe
Suspicious behavior: LoadsDriver 2 IoCs

Processes:

pid process

652
652

pid	process
1600	bdfix.exe

pid	process
652
652

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

Processes:

chrome.exe

pid	process
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeCreatePagefilePrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeCreatePagefilePrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeCreatePagefilePrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeCreatePagefilePrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeCreatePagefilePrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeCreatePagefilePrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeCreatePagefilePrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeCreatePagefilePrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeCreatePagefilePrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeCreatePagefilePrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeCreatePagefilePrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeCreatePagefilePrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeCreatePagefilePrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeCreatePagefilePrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeCreatePagefilePrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeCreatePagefilePrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeCreatePagefilePrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeCreatePagefilePrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeCreatePagefilePrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeCreatePagefilePrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeCreatePagefilePrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeCreatePagefilePrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeCreatePagefilePrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeCreatePagefilePrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeCreatePagefilePrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeCreatePagefilePrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeCreatePagefilePrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeCreatePagefilePrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeCreatePagefilePrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeCreatePagefilePrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeCreatePagefilePrivilege	1844	chrome.exe
Token: SeShutdownPrivilege	1844	chrome.exe
Token: SeCreatePagefilePrivilege	1844	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exebdcamsetup.exebdcam.exebdcam.exebdcam.exebdcam.exe

pid	process
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
2380	bdcamsetup.exe
1668	bdcam.exe
5576	bdcam.exe
852	bdcam.exe
1148	bdcam.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

chrome.exebdcam.exebdcam.exebdcam.exebdcam.exe

pid	process
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1668	bdcam.exe
5576	bdcam.exe
852	bdcam.exe
1148	bdcam.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe

Suspicious use of SetWindowsHookEx 32 IoCs

Processes:

bdcamsetup.exebdcam.exebdcam.exebdcam.exebdcam.exebdcam.exebdcam.exebdfix.exechrome.exe

pid	process
5168	bdcamsetup.exe
5680	bdcam.exe
5680	bdcam.exe
5680	bdcam.exe
5680	bdcam.exe
2704	bdcam.exe
1668	bdcam.exe
1668	bdcam.exe
1668	bdcam.exe
1668	bdcam.exe
5576	bdcam.exe
5576	bdcam.exe
5576	bdcam.exe
5576	bdcam.exe
852	bdcam.exe
852	bdcam.exe
852	bdcam.exe
852	bdcam.exe
1148	bdcam.exe
1148	bdcam.exe
1148	bdcam.exe
1148	bdcam.exe
1600	bdfix.exe
1600	bdfix.exe
1600	bdfix.exe
1600	bdfix.exe
1600	bdfix.exe
1600	bdfix.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 1844 wrote to memory of 1704	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 1704	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4320	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4320	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4320	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4320	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4320	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4320	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4320	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4320	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4320	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4320	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4320	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4320	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4320	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4320	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4320	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4320	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4320	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4320	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4320	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4320	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4320	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4320	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4320	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4320	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4320	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4320	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4320	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4320	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4320	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4320	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4320	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4320	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4320	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4320	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4320	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4320	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4320	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4320	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4676	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4676	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4324	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4324	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4324	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4324	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4324	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4324	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4324	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4324	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4324	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4324	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4324	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4324	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4324	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4324	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4324	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4324	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4324	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4324	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4324	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4324	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4324	1844	chrome.exe	chrome.exe
PID 1844 wrote to memory of 4324	1844	chrome.exe	chrome.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\first_party_sets.db
1⤵
PID:4888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3872 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:4340

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaulte30cf16eh789fh4e51h8916hce735ee15595
1⤵
PID:3548

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1844

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff987969758,0x7ff987969768,0x7ff987969778
2⤵
PID:1704

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1772 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:2
2⤵
PID:4320

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:8
2⤵
PID:4676

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:8
2⤵
PID:4324

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3120 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:1
2⤵
PID:5048

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3148 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:1
2⤵
PID:4216

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4724 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:8
2⤵
PID:5268

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4832 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:8
2⤵
PID:5316

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4800 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:1
2⤵
PID:5400

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5012 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:8
2⤵
PID:5448

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5128 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:8
2⤵
PID:5456

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:8
2⤵
PID:5672

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:8
2⤵
PID:5756

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4924 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:1
2⤵
PID:5908

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2424 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:1
2⤵
PID:5360

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=1048 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:1
2⤵
PID:5412

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1696 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:8
2⤵
PID:5844

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4952 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:8
2⤵
PID:5732

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:8
2⤵
- Modifies registry class
PID:5744

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=4688 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:1
2⤵
PID:3836

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4964 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4444

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=4636 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:1
2⤵
PID:920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6064 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:8
2⤵
PID:1160

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=1552 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:1
2⤵
PID:5452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5252 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:8
2⤵
PID:3960

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=3276 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:1
2⤵
PID:620

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5156 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:8
2⤵
PID:3580

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1048 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:8
2⤵
PID:5112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3364 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:8
2⤵
PID:1904

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=6080 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:1
2⤵
PID:6060

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=4808 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:1
2⤵
PID:4844

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=4480 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:1
2⤵
PID:3844

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=4800 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:1
2⤵
PID:4152

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6000 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:8
2⤵
PID:852

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6352 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:8
2⤵
PID:5516

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6372 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:8
2⤵
PID:1720

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:8
2⤵
PID:1288

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4964 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:8
2⤵
PID:5696

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5332 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:8
2⤵
PID:4996

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6868 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:8
2⤵
PID:5108

C:\Users\Admin\Downloads\bdcamsetup.exe
"C:\Users\Admin\Downloads\bdcamsetup.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
PID:2380

C:\Users\Admin\AppData\Local\Temp\BDMPEG1SETUP.EXE
"C:\Users\Admin\AppData\Local\Temp\BDMPEG1SETUP.EXE" /S
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:2920

C:\Windows\SysWOW64\regsvr32.exe
"regsvr32" /s "C:\Program Files (x86)\BandiMPEG1\bdfilters64.dll"
4⤵
- Loads dropped DLL
PID:1492

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\BandiMPEG1\bdfilters64.dll"
5⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:1656

C:\Program Files\Bandicam\bdcam.exe
"C:\Program Files\Bandicam\bdcam.exe" /install
3⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:4836

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Program Files\Bandicam\bdcamvk64.dll",RegDll
4⤵
- Loads dropped DLL
PID:3904

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe" "C:\Program Files\Bandicam\bdcamvk32.dll",RegDll
4⤵
- Loads dropped DLL
PID:5284

C:\Program Files\Bandicam\bdcam.exe
"C:\Program Files\Bandicam\bdcam.exe" /install
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2704

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Program Files\Bandicam\bdcamvk64.dll",RegDll
4⤵
- Loads dropped DLL
PID:4444

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe" "C:\Program Files\Bandicam\bdcamvk32.dll",RegDll
4⤵
- Loads dropped DLL
PID:3752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.bandicam.com/f.php?id=eng_app_complete_install&v=2&lang=ar
3⤵
PID:4632

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=3136 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:1
2⤵
PID:1216

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6628 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:8
2⤵
PID:1608

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:8
2⤵
PID:5020

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6236 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:8
2⤵
PID:5620

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --mojo-platform-channel-handle=4784 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:1
2⤵
PID:1812

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4736 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:8
2⤵
PID:5380

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --mojo-platform-channel-handle=1256 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:1
2⤵
PID:4976

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6632 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:8
2⤵
PID:5712

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7108 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:8
2⤵
PID:2528

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7256 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:8
2⤵
PID:4656

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --mojo-platform-channel-handle=5328 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:1
2⤵
PID:1232

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --mojo-platform-channel-handle=7344 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:1
2⤵
PID:2920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --mojo-platform-channel-handle=3136 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:1
2⤵
PID:1760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5628 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:8
2⤵
PID:5188

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --mojo-platform-channel-handle=7252 --field-trial-handle=1888,i,18266883140575032432,6336045161005923071,131072 /prefetch:1
2⤵
PID:5800

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4944 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:2316

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2cc 0x4e0
1⤵
PID:6036

C:\Users\Admin\Downloads\bdcamsetup.exe
"C:\Users\Admin\Downloads\bdcamsetup.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:5168

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\86474f8545194ac28875862e5ed97b5f /t 5020 /p 2380
1⤵
PID:3040

C:\Program Files\Bandicam\bdcam.exe
"C:\Program Files\Bandicam\bdcam.exe" 0x0001A519
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --mojo-platform-channel-handle=4880 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:1
1⤵
PID:1808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=4048 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:1
1⤵
PID:5708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1036 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:3612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --mojo-platform-channel-handle=4704 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:1
1⤵
PID:2788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5276 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:4868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3324 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:5260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:2872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ff980c42e98,0x7ff980c42ea4,0x7ff980c42eb0
2⤵
PID:4440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2212 --field-trial-handle=2216,i,11293197918181715851,18128849041693701694,262144 --variations-seed-version /prefetch:2
2⤵
PID:5912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2424 --field-trial-handle=2216,i,11293197918181715851,18128849041693701694,262144 --variations-seed-version /prefetch:3
2⤵
PID:1168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2220 --field-trial-handle=2216,i,11293197918181715851,18128849041693701694,262144 --variations-seed-version /prefetch:8
2⤵
PID:732

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4484 --field-trial-handle=2216,i,11293197918181715851,18128849041693701694,262144 --variations-seed-version /prefetch:8
2⤵
PID:528

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4484 --field-trial-handle=2216,i,11293197918181715851,18128849041693701694,262144 --variations-seed-version /prefetch:8
2⤵
PID:5648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4464 --field-trial-handle=2216,i,11293197918181715851,18128849041693701694,262144 --variations-seed-version /prefetch:8
2⤵
PID:5940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4604 --field-trial-handle=2216,i,11293197918181715851,18128849041693701694,262144 --variations-seed-version /prefetch:8
2⤵
PID:3076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4612 --field-trial-handle=2216,i,11293197918181715851,18128849041693701694,262144 --variations-seed-version /prefetch:8
2⤵
PID:3656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4828 --field-trial-handle=2216,i,11293197918181715851,18128849041693701694,262144 --variations-seed-version /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3968 --field-trial-handle=2216,i,11293197918181715851,18128849041693701694,262144 --variations-seed-version /prefetch:8
2⤵
PID:5272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3816 --field-trial-handle=2216,i,11293197918181715851,18128849041693701694,262144 --variations-seed-version /prefetch:8
2⤵
PID:2752

C:\Program Files\Bandicam\bdcam.exe
"C:\Program Files\Bandicam\bdcam.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1668

C:\Program Files\Bandicam\bdcam.exe
"C:\Program Files\Bandicam\bdcam.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5576

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2cc 0x4e0
1⤵
PID:6048

C:\Program Files\Bandicam\bdcam.exe
"C:\Program Files\Bandicam\bdcam.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:852

C:\Program Files\Bandicam\bdcam.exe
"C:\Program Files\Bandicam\bdcam.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault3e1e2225hfef2h485bhb267h2a09e44f0c57
1⤵
PID:4524

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:5328

C:\Program Files\Bandicam\bdfix.exe
"C:\Program Files\Bandicam\bdfix.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1600

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2cc 0x4e0
1⤵
PID:5064

C:\Users\Admin\AppData\Local\Temp\Temp1_Lithium-Nuker-V2-main.zip\Lithium-Nuker-V2-main\Lithium Nuker V2.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Lithium-Nuker-V2-main.zip\Lithium-Nuker-V2-main\Lithium Nuker V2.exe"
1⤵
PID:2396

C:\Users\Admin\AppData\Local\Temp\Temp1_Lithium-Nuker-V2-main.zip\Lithium-Nuker-V2-main\Lithium Nuker V2.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Lithium-Nuker-V2-main.zip\Lithium-Nuker-V2-main\Lithium Nuker V2.exe"
2⤵
- Loads dropped DLL
PID:3156

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
3⤵
PID:4088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\BandiMPEG1\bdfilters.dll

Filesize
4.1MB

MD5
ed730387fdcd684b756601b863c47417

SHA1
c49ed6d0d46facf4ceaeb21f5d6bfdf9e3587fde

SHA256
9cbc29696ad2d582e251bf9c4be5cce618753fa43551d2474e1ae5cc5e1245e5

SHA512
e32df727799d33922c6e92f94a7bdb0bc2772d6a6636d15e285d94d3ae4661062e5bc89ec3546b76ec853398f88d972f461327ef687f89093acf1096560d5c3f

Download Submit
C:\Program Files\Bandicam\UnregVulkanLayer.bat

Filesize
122B

MD5
13e241026906e9c49e8dcc436313dc55

SHA1
3d2c1fdb2e0166f915796569c6e4c04167aba9d3

SHA256
ec319ae952e4ffac8ff5edede7029050d53452a4df9bc026de3375ecfa983a44

SHA512
338fd96cad17b7f73328b9361a9a23da5c184c39a0fb185d772719daa2eb7abc268834fcba5cc2f0d6e6adf1b6364d3f7e59f9b330dba1ce769674cad295b0c7

Download Submit
C:\Program Files\Bandicam\bdcam.exe

Filesize
13.3MB

MD5
d9b55c88134adeb2ce3ecf12dbf255cc

SHA1
18e189c417fbb4fb3c8622c222481cf24b768ecc

SHA256
8b37afb00f007d14a78ad8ddd6fb456a5e3a7d7305e777be5d3c3e004fddbef2

SHA512
9dc291e3d651bebe61abfd996dcc818b3b38f9a5b495830c6049a181017938c6198a5807bb201793f19ca59bc19cb2cfbd747b216ccb4c96058eddbff5ad4685

Download Submit
C:\Program Files\Bandicam\bdfix.exe

Filesize
3.5MB

MD5
663d6d584f0bfc3f658c5d51a1b04a2a

SHA1
9567058bb223c759267cfe349a7954954d568eae

SHA256
0a2b6d661962cb9f51b501a93eefa630d6d964e5a428d670414a052e35001a3d

SHA512
8a21152ca463d8f4bfaf197e3cd37a9f45fe9a1007bbacde211ad28e3b3359a082534c0390c7a04d654f4444c8bf683eaa5f0e0528e45c12a2404249802bd304

Download Submit
C:\Program Files\Bandicam\data\camera.wav

Filesize
65KB

MD5
f35feb61a16e6ddf1f29d4548735c517

SHA1
b0cc0cfd46f88cc3c0de837a2bb281f5274c97f1

SHA256
366e5a005d4be5afa7d49ec7778edc67a52c67e1903b44e861aa620e287762b4

SHA512
e9641f4c49f0ea6621a61f0d2792528ae9e7ce3113bc1267fa0c3f130f599317a985f3a88c31749410d7d54652ab832aa52650a6be82c8969232f99344553da1

Download Submit
C:\Program Files\Bandicam\data\effects\effects10.dat

Filesize
58KB

MD5
fe3d7459d1e60f1a3a9f4de092e46ba7

SHA1
c8545c0873e896d9549c9a66f099b67f36ba461e

SHA256
184bd469a52b67c553fb934bf4122334449f6b6bff86c07ba193eab2ee617427

SHA512
77eba3abacf6db565dbe8dd6f9107cabcb390c40512aca9c09d7d1d590f522cbfa97940d4f06cec71022053af4b13176183997fa14c7a10531cc5511709c8d86

Download Submit
C:\Program Files\Bandicam\data\effects\effects15.dat

Filesize
129KB

MD5
9158134ace4961296a4ee8baf326d23e

SHA1
931f9a24186052b424bb19f99065db161c9c48d5

SHA256
b45c1839d5895b00c06a1ef41dca3cd24a68e0f340ae45922d654dda3cfec5ff

SHA512
310c0aa541f3b2d4ed0213254e33f1f3a56bddf34d8ce61c18ead819df8a6b2bae19b14bbe049582061bf006e0948f35298fb59fc1734b77df218ae5888e5cdc

Download Submit
C:\Program Files\Bandicam\data\effects\effects20.dat

Filesize
228KB

MD5
4a22264f25cdac2709796db7a0b67d39

SHA1
dee39792e1a7ddae4ee2d083ea293a5205bdbb75

SHA256
42652ca47e2abf81efd93270364edd72e663faf184fe26b20a88946cc29935d7

SHA512
896035afd0fddd5dd08f42d79a22eabf102dfc797ce80c605eb9a3a2411f278172388c009d2d64d01dadf03a70a9b799a74b6e71bf3c22b0c768553b5d42e4ff

Download Submit
C:\Program Files\Bandicam\data\effects\highlight10.dat

Filesize
3KB

MD5
e734e8f933a0f60adcc30c465bbe1c4c

SHA1
d7722aafbf6a2aacec2c1740e99a23af7d01b966

SHA256
a2b6a948b305d71bb8cf7bde3a79a3194ee29562e5c447a46b7efac831aee5c7

SHA512
802c993816d3e6aa868f67c384f3702af636415560f10de8336eb226639b180da4b2211b922bcfbb0d4accb3111a450603f20437f46436a067f05356f0752d2a

Download Submit
C:\Program Files\Bandicam\data\effects\highlight15.dat

Filesize
8KB

MD5
06cb42d354f7c1e783cdaf23e27ce126

SHA1
b51cb8b3dca12cb8814e5a6d16afc72b79cad73a

SHA256
d572987969d0d96852cfef48b5b77062439645e31b27385186a9eac027298495

SHA512
2643b245f2103a58ec69c81912992315c48bdc4767c05f8ef6df4c44dae49a2357c1b45d169a0e395e51dfda4575490fb3527be8015421a05fc34a4d8bd0b100

Download Submit
C:\Program Files\Bandicam\data\effects\highlight20.dat

Filesize
14KB

MD5
4de77d9a4cb12e283120889d52369b99

SHA1
4f334bcd99c0c894b12bf4daa14049593094777d

SHA256
01b95c2702168da675e04a6d9e460361e870d520f52a22c893857fb6c9244663

SHA512
0e14465a37908e46a424e6a6303752d44011f30afb8fee5b2bf24b750a9e0053ba77ba6291f7c5ad7fec57bf4f9652fbf9b2d630a590cc8d7ba9643b9be7ab24

Download Submit
C:\Program Files\Bandicam\data\language.dat

Filesize
97KB

MD5
ab366ccaa4cd08378aaf6ce88f60bf29

SHA1
73459ce403eef0fb437ce85a9c37ca415eeb2fcc

SHA256
b58d6408b07adae2f1f8372415781e71a9eec3a8626b3c8413d854e76f31782e

SHA512
80adff65f316453add1e20453fedc8b3646f73c267d87626dcf76058bf47d6ddd5a1a01eedf64d86a642ed97f5e036b73224e60b84e989b01f44163477e52f8e

Download Submit
C:\Program Files\Bandicam\data\language_bdfix.dat

Filesize
1KB

MD5
0eab7a9587fed4adb36eeefe9a53ea49

SHA1
61dc3199922b9a6a66466abafb652315db431c50

SHA256
1a9f30d40beda174fadf0fa409554154939bc1d8c449d06e49e97942ce0a5bc9

SHA512
a57903a270f266d49fa5edaa1debb71ebe611d84ffc06fe59372823d3dc31d3275b2f1eefe11e3b6543a8aa422fca424a172ae6c109f043d11dbcb164ce6bbc1

Download Submit
C:\Program Files\Bandicam\data\lclick.wav

Filesize
69KB

MD5
edc287a54e68f13033dd06a688574cde

SHA1
4d20d2d093de6d0b3a2521bfbe2d29afd8b16dcc

SHA256
5c03d7d2366592d9e35264b957131ddea2676fe505680de70f5e0878f70ce0c5

SHA512
0fafd1e1041d89362bc66b1fcc07ed7b16db578d2b531fd6093c4eb267438db78d26bf5b5a2f5f102137d4935957215ac00451915a200cbf82c5ef5a8aaca2a4

Download Submit
C:\Program Files\Bandicam\data\rclick.wav

Filesize
68KB

MD5
302e0e3b92e3443f60bdbad8d59efed3

SHA1
cf317e9f9d6973efe590525525994ea6bc87563a

SHA256
81cad36978281837c3ba3abc26d782fe51591ea923bf31fbf3130ff86cd5f752

SHA512
5a0a5f11f1726a09dec53933a032e28506539a99c55e34aac6d93ace1c8f19c7566268ce4e8483f54ba99287305455ec1ddbcf56ae53a5a3f5140f834f637e13

Download Submit
C:\Program Files\Bandicam\data\sample.png

Filesize
6KB

MD5
b15920eb69ff277893df1d6a5aa07653

SHA1
2c3821163ed97471db7f9555792bbd721fe33cbb

SHA256
a6609b23e0389a124c2d59f05a89e31287b68ae85f2fe5ea89defcdb6b94d1f0

SHA512
8cc1a95f65926f3cd9ffb157a38c1a617f89153447e2ed2d1b1dc7ca75b4276a4d0203aa583c49b0ce75220cbd9988cdeccf30986c3dc9136bce6794ac6d0a67

Download Submit
C:\Program Files\Bandicam\data\skin.dat

Filesize
884KB

MD5
9dfc0bfce4ca653c7b2058d503008d96

SHA1
aed430fd6c140f4db75064faff7a6e614feba5e0

SHA256
c0e513b40f9514dee75c0b048029ccefe610219848ea96b5e5d4ef11a6102625

SHA512
abb166743cfe1eb16a86bc7c42632a53f47d62d5a16a88695dda8a950b08ec460fba0476cad9fbe543689e0e0d7bb6386fe36a4d7e6238bbb2457465d2cb1e50

Download Submit
C:\Program Files\Bandicam\data\start.wav

Filesize
14KB

MD5
6828c136e31a5d49e775fb83c890b092

SHA1
6e1cb4844bdecf7f18b15b90178f6364a18de0fc

SHA256
3cc24811b0e9bd9809017018643d1bb8ffed0b712d11134779a7119acb785b1f

SHA512
ccd379d53f9d5472980b3fd799edea7155c6a15ceb9e094db31d501c7fce914c8b0026e1f4487c3785350d7b980b78cd266e5c8dc93bf10188d06d02eea966af

Download Submit
C:\Program Files\Bandicam\data\stop.wav

Filesize
44KB

MD5
18326866256e514224f4a26de285cd5a

SHA1
fdfddafc3d08b13e90cff3f3e84725541cd41e08

SHA256
bad2191be9c1ce31faa7cc354fb0b8359337f17c1190c03eaaa5ed1308b6793c

SHA512
9f97baae1fe72f6093ed77b320dcedbafbc489c4cc5f1be58ed8d7582e8cf914b54905a5a41dba01f4574f9d4865103e3d239e255d3408f84b91949d4f475de9

Download Submit
C:\Program Files\Bandicam\lang\Armenian.ini

Filesize
137KB

MD5
079dfc8fd66dc2a5fd1231a66d9641d6

SHA1
9e28ad1ad9878406f876a37d5d1e884e0dbf6349

SHA256
a99936f13313b74d73fc6ceccf185b8a037f3b87202c984b5905a4b8eb4389bb

SHA512
1a1efa3cc0400a8159bf88fa151444404e115c40b920fa4416ee7c77d1c9dcb161b391248941e4e3884c6e36357becd2d3029ee2dabf87a702eea9bcdc9a2ae5

Download Submit
C:\Program Files\Bandicam\lang\Azerbaijani.ini

Filesize
136KB

MD5
40224633179f077bd23acb39a8ad61d1

SHA1
5538b9e3b243d84cab8f763bce232b846ac8ee82

SHA256
473055169044fdb30aa5092d039b4ae79389f99dc684ddcea061158dea699792

SHA512
3c25a04442b6f6b59cb749d59c439a2c54def008b13eb8c9917232a4beb4ab41018a8102c4302d7a7f135773aff37c2e218c3b2c66808b1cd90abc8ad24d8d85

Download Submit
C:\Program Files\Bandicam\lang\Belarusian.ini

Filesize
138KB

MD5
889b28e8b2f8190efc71ea87c76efd40

SHA1
5e729e90de1fda30554c3b4dabfc7f2763087bbf

SHA256
ab642f409da777adea20883f92ae1a75ac9cfb258856d6c4efaaea4e868bb75f

SHA512
03a2db6d1433472da00229843f76d3872cf3061367a36c3af2860f1921c91b2a929fa4531a3b7cfa455650caa0d6ccd4a790612e65e20fd6bcbe08443dbf61a9

Download Submit
C:\Program Files\Bandicam\lang\Bosnian.ini

Filesize
136KB

MD5
39e2627f3051dacfe66fa90163e7474e

SHA1
401d375c47da6a0e6639ebc633af01657013a27e

SHA256
500ba5b5649d35336a339185755e4d697a1cbdb9e1468c1704c232944501a414

SHA512
c156e8616441cefe74509a7feae5698def2299e803ae23ddbb4d132c64de64a39fb9f6bb70ab3d10404c650fc03a9ce5b73cd9def96fcb46bc18c83dbb67beaa

Download Submit
C:\Program Files\Bandicam\lang\Bulgarian.ini

Filesize
139KB

MD5
30a0f1ce8465918864a98f8edfdcf747

SHA1
e77ba1b5af043d7b7ea0be366a2f31ae51a0c407

SHA256
2a4acb0c7af1ecc47db8032ce2799f0b78f524e25a2fa4018ce1c313a9ab04e6

SHA512
983333ae33b04925dad408945a2df10de9b20b3c9cb2c609f00fa578e6acf6cf1035ca66b3593696461b91afff82f936c054e8bdea6c96ebf79e28488b1a49c5

Download Submit
C:\Program Files\Bandicam\lang\Burmese.ini

Filesize
143KB

MD5
2bd794699c5747392ac68fe0926959f4

SHA1
a263d8e732be559ddfbb3f19593dd853540101fd

SHA256
2827e809fef0db14aedcb2c81765e100b8d6eaf89f07241142857a7743d01858

SHA512
b8cbac204ea182d80bea69380b93e8c5b82a97ae39a0eab4b8a7076cd8831cbaecb0b9a4cf3679b94f61b6925fb331d32e08915105df3d2c448c1d0b6ea9dd28

Download Submit
C:\Program Files\Bandicam\lang\Croatian.ini

Filesize
136KB

MD5
c4fd146ff0e7d35322d56b3673b21e61

SHA1
740b8fb04ba9ebf884774cfd47d756e7334ccb09

SHA256
2d6255082b47ff8e2bbdc3ebdbb3397b39b26239f336d6a231512bedd3717e17

SHA512
2d6590a4b3a1a863480c8b0f265167438e95d287bec4f35a0f1ca17eebecfcfc12f7372b5900f7bc8cf9a32dc015f8ccd68de439b352f4bb4e100d10884f8f21

Download Submit
C:\Program Files\Bandicam\lang\Czech.ini

Filesize
137KB

MD5
21aab813cdfcb73df66f4d9467ceefb8

SHA1
19015c36baa93e51403bdeb58f2302dc740f51d3

SHA256
e826e8eeabe711905a51de3f9a7ed81df6c4569286a9f2f1f0cb41fec1bbbb2d

SHA512
2b73f540dd0a2a6627adc8608ca177e3f093fffb50e5d65061f8527df04b111882134b1baf3bf1aa7dbcbd26d6735831c513eb3bcf68209f1f746bc3878491b6

Download Submit
C:\Program Files\Bandicam\lang\Danish.ini

Filesize
137KB

MD5
f5368c6321f97702cc34e053c3886a5b

SHA1
a41da9341065a5d2c2a5b2390c220c734765d532

SHA256
d6a9e70f04f53f856a6768f80157f4d44a2544a96ddf73a644e379f202e98594

SHA512
56719dc2ee1db66591f3753d471d16730b7e50e91a32c7a1d7a700eae985797295ca239470000ccffe6496d3c02f528ecf6f7c06dae3a2a4abade313eff30016

Download Submit
C:\Program Files\Bandicam\lang\Dutch.ini

Filesize
138KB

MD5
4aab84803ebb8b1f96d7dd2280c9a383

SHA1
95b51871e197b8ed1760f1bb7895f37db70b1464

SHA256
b90920c24c9c7bd14f358e001434cb64b2b2a997bf80876b6664c51054b86a10

SHA512
f3cef26232fb49f172ff5c6ce2aeb534584fca2ebe38d576a2a51484c59cd82c79729d3e88bc3020181a24da1f125ca90de7b80be536f96e2f18592958bdce22

Download Submit
C:\Program Files\Bandicam\lang\Farsi.ini

Filesize
132KB

MD5
403852f99ad502cd79d281b2eb487532

SHA1
11927d2cc87ccba008dc4f6f4f8efd564b8b1d9e

SHA256
ed271bc226bab10117c09e53089cb1ec55ec634dc94abbc8833447df9f65dd4c

SHA512
a4fdff36940c2e501b3ccc149855fecef8df03d3a931aea74279e536e059591fe203fa0119a6ec2a0d0b982c224145458532a8f7e3ed10747887711f762cefa4

Download Submit
C:\Program Files\Bandicam\lang\Finnish.ini

Filesize
136KB

MD5
eb1363387ee3855738a015fb77ea24e7

SHA1
40d88f1dc1826babc44df16ebc30130133bbdb15

SHA256
21c864c030515e1a472553afa7ca51485849fc77c847f8c5d94931cb84b5672c

SHA512
8edc767e47ac2cbb6f835d29381f903d75445780041edbebd71802dd684df83eccce8e772def8554fb9a3523be9cacae76d5446aadb3d8fb6d337ad552c15147

Download Submit
C:\Program Files\Bandicam\lang\French.ini

Filesize
147KB

MD5
a19de258e42f12c03512436757391df1

SHA1
983c4ae0eeab7d0168bf3304737dbe3c4dc67179

SHA256
eac9b015c6c15c4dfc4255ffe0c1cac935cd94599a589b23c2cbc4745caf1eca

SHA512
bd001e3b944e2a16094ed8f274a46ca06e2f0b204db17fa1130ea81dbc6e249a13be92516e8dbb5b176cd8e3ed77f2bd460d38adc8d8c179fb5449afad33aab0

Download Submit
C:\Program Files\Bandicam\lang\Georgian.ini

Filesize
136KB

MD5
65b0d4c2d7e1b7f963bdf454992cd084

SHA1
08914b7abb7b2b88d003ecd5b622cd93b3543e20

SHA256
c6d80a47d82edb7c77062825c1e13c34e3c50b916b1d86859d0906991627f7a8

SHA512
9371f5894050b661567453893ad0d9f648e85be97e40828f91d7611c77fe6db9fb8ab043051880b4fd5e83d389e0d5baa557755389cb0a9232e94099c0080099

Download Submit
C:\Program Files\Bandicam\lang\German.ini

Filesize
140KB

MD5
9f9f34b6419bee01479c2f36f5a65cc3

SHA1
e649a2a2ca7fee145e186e7c5cc2199fe3062365

SHA256
5d570fa52d19a0f9e74830fac7ab5dae087850b81a7e00db9e9e09cea6603932

SHA512
594d0ef49a9fbc1cd351e7ac1f90eaadd5e8fa105138adc52efba89bd7457b6260fd0c6f9770bd2cb6f23ae35538759e80cf3fb7bbb62bfd79ff81fb89ef4ec0

Download Submit
C:\Program Files\Bandicam\lang\Greek.ini

Filesize
137KB

MD5
b71b299983c757acd21c5dd89a27aece

SHA1
d49befcb3117ab4202789d67fb595649e8a7daa5

SHA256
4bfc8c97f9176316ba1a71cebf5ddaf0d1c0cdfaec499220780ab35e6a76ca63

SHA512
964148eff95c89410fbb663a34be14d8489f1c06ed8ab0499282d626d76ecdbf17d98b4639adf336cca43da40f40f4ceadffad5ec22670b5ea54cc07403c52f7

Download Submit
C:\Program Files\Bandicam\lang\Hebrew.ini

Filesize
125KB

MD5
d6b9764b0a1f3d27f6d3d62e1e6393f8

SHA1
2b09415314390ce4abf3fa2a74eae373199bd329

SHA256
aed54b889f985f1e406b2e9b9c2dd6aebd3397f5bac0c680d0f6d5b3de68585e

SHA512
36648e5418e45086cbb457920493e93ff5990cee3f223accade5a27ad7b05d2a4e3602840560aad3714ce8273952de68612bc327181c081d4209cfeea93216ab

Download Submit
C:\Program Files\Bandicam\lang\Hungarian.ini

Filesize
142KB

MD5
49a0ef9dd08d4e9feccb181112fa3443

SHA1
ebea0be4f7cbedee590cab01fed58de61c82c406

SHA256
ebb33cd20a8358a88aac68a17d3f37f34a3ce8a33540904e4fab00174879e5b1

SHA512
6aa739c15a48126514b33524993bb9a9b8013faf90aee0080f34fcc4288b374b963f493e925546d219cb3ed24e741f982174352e27c38629ad276bd45c74854f

Download Submit
C:\Program Files\Bandicam\lang\Indonesian.ini

Filesize
134KB

MD5
5af3129ffe777d86d4e7c47751334ba0

SHA1
06626135d22cb015ce8cb8df345dd4235aa9c60e

SHA256
17c0c3647bc38e859b68e997f41e8905a41c96eac5e8ce0cc240da64c8cd359e

SHA512
4ecd0e6c2ec60bbab46b9beee57982ee7fbb2856f80ba792f46811dacd3a2e3c1c1f1b01b8e33dc56e8b95a69d79f41eea666f0a6254e60bccb24d6891ec6dfa

Download Submit
C:\Program Files\Bandicam\lang\Italian.ini

Filesize
143KB

MD5
870e9b2d20d6a7562a631118e0c886b4

SHA1
90e14431c5ee51df455ab3fd31122e3fa67a8c71

SHA256
ce65c5c0fd7a3c5f0fddda49e88a8a0562273e823a4693ab4379d5a07609c20a

SHA512
08a6a3dc2ff2fcb04a59eb0e165bb0956120ae1603c7d2ff39ec513311b02d405a4ec7cdbcdd39e360402bfc4d7a22a7a0ba70ca43735f7633dbc179c3fa512f

Download Submit
C:\Program Files\Bandicam\lang\Japanese.ini

Filesize
114KB

MD5
97964fe532923e44ede6622fad92c7ec

SHA1
578d8c40e1b83b03b69f2981c0eb4363e25f252b

SHA256
5a1f7803f43acbf8fbbdec8ca1c9cf7faade765e94db8e6f136e7a5396b218a1

SHA512
0d277cea67fcb9db1975b58780eb2e98e866deddffaff6e674b227dc441711fce67bf15b9bdbc49b00969e79accf37d0c62b124f0dd7e8db022b3b12f27afd74

Download Submit
C:\Program Files\Bandicam\lang\Kazakh.ini

Filesize
136KB

MD5
bdea1ae8cde4322bb3cf50c45d3ccd9e

SHA1
6f87754105e1129afce14bb56374ed95f8286b0e

SHA256
21a4d7f74fe1190b180f0915097269b4ad9cae0cbd9d8659f0192437dbd21d44

SHA512
af7970dce330735a5611cd3eec7c5a07481f379a0c98307a8c8fdd25bfa09808e345df265f83f3780022bb8a94b85efceafaefc684db5d09604cb9694d83513c

Download Submit
C:\Program Files\Bandicam\lang\Kurdish.ini

Filesize
137KB

MD5
719aa3f7ebea68b02706d6bac40972f1

SHA1
106390568906c2781a0e13055c37e3f6be190449

SHA256
f87a36c79f3c6272216b37f6197f6b0effbae24d0589ee8749d3237ca86929e0

SHA512
cceb97810e726c022e351b6bc2306d8c4bfcdf8411b79bcdb17144daa97a6ae6aa6e5a475ef072fb1c59a19b486053b4eb7bde13da2f596220e32fb8a6387d95

Download Submit
C:\Program Files\Bandicam\lang\Latvian.ini

Filesize
135KB

MD5
9bbe66fa84f872283333323f67a7e877

SHA1
62812aee04437cbf118e2dc58291153c4e800504

SHA256
c69361d31f85569482793d9de6f76e499a572eb11285c9b64505c9fd5e319e83

SHA512
9ccccba84b3a9273439368e7202dd059c6263598e64d0d41d49fbb0c10cf9279d427647a9bfd69ef67c9fa6b3a8e94c9043efd3860b48b63ea8ade65cbf3bf69

Download Submit
C:\Program Files\Bandicam\lang\Lithuanian.ini

Filesize
141KB

MD5
5606996e488c53c7eca908403b5a7cdf

SHA1
f6cc5f4f5b9147ee100b1806ac67d5517a85bc70

SHA256
01d6108bc18f8a525ecb225d58966e6b3b524eb465df9c7571dd5d35c5f85cad

SHA512
ec005bdad72d8809feaa4654e4166a0760343aa3ad03434139a5684de32386ec9d455bd9b2cf73ba75490ece943655fef69bfb9126e6417094a42d08b56466de

Download Submit
C:\Program Files\Bandicam\lang\Luxembourgish.ini

Filesize
137KB

MD5
fc84588c641978fb92640a97c63953c7

SHA1
1c9f920e15ad07a62204064861fcb5f4a61d96d0

SHA256
4f107f2d3dbb2ddf8bd1baf77b665a7573166742d3e24095a96526d8e7e456a7

SHA512
ae86436d0b831956995eadcf72f7aec7ee275bf6c1e466e4cbc250ca6b36cf5e1c7a259582d7648601285a05b1c21ea76b2ec8d1c81e5542549ddb3ba44ed784

Download Submit
C:\Program Files\Bandicam\lang\Malay.ini

Filesize
135KB

MD5
486284059a73f28291cff893952832eb

SHA1
0ddc0569b4100a13359e1ca54cc34d59c8db11b6

SHA256
ca92d155d83958ea2dcf0ff559022717ecac3a567fc4c0563c494b60050fdda6

SHA512
9061ea59a8510510f3ed229f0bdf1ccf0a68aeeaeeee68becbf162ca71fb5ab1dc8b82c1c58c81e8876bb4cc90eea2bdae0d3f52122746ec964776afb0a3add9

Download Submit
C:\Program Files\Bandicam\lang\Norwegian.ini

Filesize
137KB

MD5
03996aaa3869648e3b363517768fcc18

SHA1
da4ea5ec855e026a98480ff561e173de9a43419d

SHA256
4098072b808b5ce0d8be57c9bf1da2e2f796d21326939356b29866be14cda510

SHA512
6145f74c1c261210dddb7131124cf1b7af17ac4e5987ec6a7c5d1869ee6b4f36f4a763646683606e561de5ff45b3536d8b586c43ec610aa5f7712d0d94a6c9cc

Download Submit
C:\Program Files\Bandicam\lang\Portuguese(BR).ini

Filesize
143KB

MD5
54d9a4c46a207cd3749ff07eb510666f

SHA1
59f83f957ff40cbe05b9eb085ef12167f52240fa

SHA256
6a02d3df9aba5b20ac00d50975a6e68c12dd798ae6cfaa351cc894b26953a79f

SHA512
1a6fcb66f6452f25397e9606946b2122e772442a469b35bddf4e81d02fb961241d9920e1284c2d9706d9f83082540f525525aa523bd2d6c8a1a922541f74b49e

Download Submit
C:\Program Files\Bandicam\lang\Sinhala.ini

Filesize
139KB

MD5
c4076fc2c05c214d33cd488faedde531

SHA1
8532fe3c48d80984a6b622f678fcfa9266227356

SHA256
ee1396b1f3aa01e9ec84750e29f577be0410b27aff82dc1ea2cf98c3eafe3a52

SHA512
655242363180a197e5545528f883cde09b28e12b33d358d731babd2284e8e5f0c2c7cd2685649c4152e4ba43dd75649ec3e3ee6fe6167bc1f408f49a920898ec

Download Submit
C:\Program Files\Bandicam\lang\Slovenian.ini

Filesize
174KB

MD5
4356896792c856e313967e94872b1f33

SHA1
47220bec7f124a3e966bd626c6d28993c2964e74

SHA256
46a2e77c6a8772448bdf31b329ddecd8b09db8fcf5100fe8a5e4d904ef6fa49e

SHA512
6b6b38b8e156c8eb6f5b294d8b4a39b037f3872dedb874589393ca91d4058ff6449d6e09d555bdcc34a07bb370b7bcb3ed577768cd45d21326aad12e79425f72

Download Submit
C:\Program Files\Bandicam\lang\Spanish.ini

Filesize
193KB

MD5
3109dfa4caeccfd6585175f010e00c61

SHA1
0a4534803641314adc3d511680015fa6f0253747

SHA256
97f33d2a2d7a971fd6793119a13c8e05ca07ef4e0b5b73e974105ce7732d9d0f

SHA512
5612c145a899d2cbdfb2df4ed58f2c45dec3e0dc152a141c175ded17bd09371a9ead3e14a84bf1bcea6aaaa2834ce13bc9098b4bcab711e770554784961fe49a

Download Submit
C:\Program Files\Bandicam\lang\Swedish.ini

Filesize
137KB

MD5
dd72b0c00bd0840f19e1a3e163154388

SHA1
f19945f4add401acc5b903ce0b8f026d5e3105c7

SHA256
4ff749cede636c9a689069984924e6bcb37e190e42fedd8c0abd0d820c4c70e9

SHA512
23b197c3f0cf66ab251bb6c42941c7c671f0a54f5ac3193e500b445efbe0ca48633efeb18b0379b350be3ee59d921c8c7633f0aa27935ae59ed656340ef02b39

Download Submit
C:\Program Files\Bandicam\lang\Traditional_Chinese.ini

Filesize
105KB

MD5
07de78abb42532e26c54cf867376ef0a

SHA1
3e0d190ef7dd6b1a703d0b1923e1055969dd050e

SHA256
12d375d17b8f7eaee0f2d52e2367babb9d1a189e6db6e2cbd51713e000a9f1ad

SHA512
09eddcf3809a91d37d7405a27d683724eb1c32f12487d024d1f58e809ca552047cee0b7479ea753b880b27b8dbc25a7a344f2dc143f20508d7dc3ca80444c261

Download Submit
C:\Program Files\Bandicam\lang\Ukrainian.ini

Filesize
137KB

MD5
a20fc163dae68b45384e08b1eacab15a

SHA1
515bb0cc8e4d841c96b21b8b7ad122ab74d8c8fd

SHA256
7904f335c8dd88e3918314de18d2e53f7a2707760eb7eadafa59219337a7b9d6

SHA512
c83ee96c894deb06541882830045264abcfe51db7fb390b96c67b7f0ea801cb199c7c3634642c59d224b38f8d34535bb3ce8b6639a39f3bc16aa748cbba54944

Download Submit
C:\Program Files\Bandicam\lang\Urdu.ini

Filesize
134KB

MD5
9c474b67604ed9f69b7f8ee0f7dfa256

SHA1
b0fed991a0c5013ca568df136f7c50a1cd715991

SHA256
b823feb1a324cdffda924e620ce6ea92e6eb4b07b6a512f936e53bfa7a18be8a

SHA512
a02c6f9ae15ded4fae5567e866b43cb35d96fd4fe5ed425f2051703a45d8b8ffa60fb9880d930aab373b56f9903ecb6716dd7f5f4bcdb8fff5af10dde9b1a9eb

Download Submit
C:\Program Files\Bandicam\lang\khmer.ini

Filesize
134KB

MD5
33b20d6381b32ccc0e9332fee117e925

SHA1
29dfa19914a96cc6a1d95987372313c7766eb2fc

SHA256
b0c086af456e132f7a360b01a81cd81fa5d4d529bdfec55a88e7bc896df6a66c

SHA512
9b407af4e881394947ac4d1325e3532ae5836c5b0022068b1e9411bb51849a0f5265de11f880bd60414e3a01aed82abbff669295f98ee9268c88c00ae4803054

Download Submit
C:\Program Files\Bandicam\translators.txt

Filesize
4KB

MD5
ec2038b8d210bb125d48e58ba3717983

SHA1
0785e40e5df3c3e8de83408f0cd080a6ae365ba2

SHA256
1ffe6ce4abf264a6ea4cf24d18ecc030827390de21567c2217ffcbfa315e95ee

SHA512
5bf6559c610af6c9767910b024b1122d7de399d6985208bd0e7d2939e6a25b6a2c98b16e5ee359b2802ceb05258e27fb75d78d95866e6527b18bd875006e882d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
85cfc13b6779a099d53221876df3b9e0

SHA1
08becf601c986c2e9f979f9143bbbcb7b48540ed

SHA256
bd34434d117b9572216229cb2ab703b5e98d588f5f6dfe072188bd3d6b3022f3

SHA512
b248162930702450893a112987e96ea70569ac35e14ef5eb6973238e426428272d1c930ce30552f19dd2d8d7754dc1f7f667ecd18f2c857b165b7873f4c03a48

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000003

Filesize
59KB

MD5
7626aade5004330bfb65f1e1f790df0c

SHA1
97dca3e04f19cfe55b010c13f10a81ffe8b8374b

SHA256
cdeaef4fa58a99edcdd3c26ced28e6d512704d3a326a03a61d072d3a287fd60e

SHA512
f7b1b34430546788a7451e723a78186c4738b3906cb2bca2a6ae94b1a70f9f863b2bfa7947cc897dfb88b6a3fe98030aa58101f5f656812ff10837e7585e3f74

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004

Filesize
40KB

MD5
5ce7bdeeea547dc5e395554f1de0b179

SHA1
3dba53fa4da7c828a468d17abc09b265b664078a

SHA256
675cd5fdfe3c14504b7af2d1012c921ab0b5af2ab93bf4dfbfe6505cae8b79a9

SHA512
0bf3e39c11cfefbd4de7ec60f2adaacfba14eac0a4bf8e4d2bc80c4cf1e9d173035c068d8488436c4cf9840ae5c7cfccbefddf9d184e60cab78d1043dc3b9c4e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

Filesize
24KB

MD5
87c2b09a983584b04a63f3ff44064d64

SHA1
8796d5ef1ad1196309ef582cecef3ab95db27043

SHA256
d4a4a801c412a8324a19f21511a7880815b373628e66016bc1785a5a85e0afb0

SHA512
df1f0d6f5f53306887b0b16364651bda9cdc28b8ea74b2d46b2530c6772a724422b33bbdcd7c33d724d2fd4a973e1e9dbc4b654c9c53981386c341620c337067

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

Filesize
69KB

MD5
0ed8278b11742681d994e5f5b44b8d3d

SHA1
28711624d01da8dbd0aa4aad8629d5b0f703441e

SHA256
354730711c3ca9845bf98ec5dfb58a16e50984f9edcf0e8f432742326334f8a2

SHA512
d296ab1f1b418b125f09598ca6645d984a1cf67092a914956b8879d285ee35521b408363b47da195de79086e3be3ed9b1709bc8f9cd2e32d5dccb720a010bc8c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008

Filesize
326KB

MD5
c013ebb87c777410bd998d10f1361d73

SHA1
f14c782ccbb66422015203b2e2a1c5eb90c789cd

SHA256
1fa728b781ed5e78ecf86ca4ed7a84662c06d33fb35229a064fcbb627993a06a

SHA512
7aa661eb4b62245c2e1335f3a78d84c8a475817cf5ad9f093938d71bced0b8b14e6f46bf0c45e728d24f25aa2f674bd24ce5c5df80249c14f4910ad0ed9ece45

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009

Filesize
133KB

MD5
b005ab857a4c8113b945f5a8d98ba824

SHA1
ca4c9ff2c295ce1d652ba4dc15b7cf181cfd1fac

SHA256
b313e5cf38a635cabd8fb4c783eb594f506b4e48340264a424a8b423c8cf6af1

SHA512
a2b32ff872a06341446f91db592998f970d5fd578b4fe225666b64aa5fb34415dc3c1b92e119490f1ce39f74e8465e95da759435da3443ed6d9b6da234801cf0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003f

Filesize
106KB

MD5
cde7bd9fb78450bc3e5a07a461f8d738

SHA1
0129a6ded5cab7beebf7fed978920998afee378d

SHA256
07794f23f60ba74529b1a57ac90112679635d311924a6731f80c5c8570728f13

SHA512
e9b9eb8a45d01ffb91f3ed8093d856ab4f5796c4a99d08f89e8646da7127314678f43a6da288bcc428f8dc1539590f637043af4ede40d7cf8fb017bd369e2bc1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005c

Filesize
229KB

MD5
1e4be5d18e998503949eef043d8be4ab

SHA1
6f818b7b58ec2e2d9d2ccf3821602f19d3ae98b5

SHA256
52ff5087ef3e5ffe020fee4f35623ba0f18f76232e842cc464772371e4860bac

SHA512
564fbc63b2b1ee50504f4d39544752565e7aebc7ba46affead23b4fb9918587de7e0f193e441404f78fde344e533b604adb400a786ff44586a49ed002adea13d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000063

Filesize
17KB

MD5
c9ff1e96c2cf7487a9cf4b4f82fa5cbf

SHA1
1adf9a98eb03ee2071409aa76252406dfde578cf

SHA256
5367a848de92589f525d1cf2b9192d1fd2f5f2933a9d6ff6752541c73ab8bdcf

SHA512
0fe7c94b34b5eaae5bbd6eb67a4dee829afb312bf20daf36e182f9cec8dc9f4104888302c621b965b4fe543a888d6ac3a15db503e4896e3e8fe26ccf44f7752b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00007d

Filesize
171KB

MD5
c923ca17b1607262022e1631e59e2fd5

SHA1
8173a718e4b2bf489ac829749d8abbe7ff41a9fe

SHA256
ce86d29bc3668f4f2236530eb39003f5503e6feed3eb600e3ba080c1cefd4505

SHA512
70193a5ca29fd999b4eeb19dc88582ba1e6106bf3c0ca70d27d86dda5d777536ea285cd03733335db56759dea4582a2f9b0c28b619c3a2fe2844916b3fee74a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
ffc651e5b996f95f4cea9a166ea7ada6

SHA1
db80cd4108d3ab7f20c9aaaf90578e88eb842050

SHA256
e07f6fb17e001fdffa3c27173a1253b4953f34be080a4231b9702ba2fcd713c2

SHA512
3b5722e460d19447dc9002e73041f4417197096a23240d98c6749614d6a4bd4630fb9aa6e2257d6be29d192557a3379950e4dd5f2f9f4461e4a944123921764c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
743888b5d42d38393fb6a973fad66390

SHA1
3432ad5ee3d87bd0e03fab95246f859fee2dae84

SHA256
3062885a05ff917b288d10735a932616ace5f6569d69c1bc1a99bf6bd81a9b46

SHA512
2063f6019b3a3de577908b8f15be66391ccd2a0df95f340c7ef012688e987f6fd1df4737d550a2638ec4b0c5be38341920c7d833fe90d770bd6cd641322529c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
fc6c56fae3e6a714f06364d093a64ae7

SHA1
09ada5f5e8e3d60a2620b6ac37cbeb74c26ef9ca

SHA256
4f822c3f49d4278e582c0543de3ab60377acf6c2cbb6d4d2324810fe68ac6b7f

SHA512
8aed4e2fcff2edba9a069e8a0f174e822dff9ba326e32a0f12636880aa2eb3fc94c8ae3f0256d69243cef40165e83053919e649df3dc18ab3c5b8c8534777a95

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
136248de8a2b07a9db9dc41a2cef36dc

SHA1
4026bec9d06f7a9337c7439b6b7a3cf35bf65835

SHA256
c17bc130ef89633080b705daebdc7c4b6bbc4f014d7c97a3e104a4497d851185

SHA512
7f5fb4126bede42080d2bb6a4235598561bfabcff5601dd95116e74ea077cda3cca6f6e0f0cb9b568539e9158997df8a69dd2614dad1c9bbe2cb5226c33588c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
7a339410a6a2a3b86de24749171b9cd2

SHA1
9517840da3a5d4606a47c67f07b84f1a87356ee9

SHA256
34f23f468422c63d3a2d2b79270c3bae4d7e47a13b1ce68c610931a8addb6f7e

SHA512
a9d57ae3b3fde3964f3ea708c1e1a1be8c0d1548a82e125990f8b32b1b75541ff52386e4f7b7c22d7ea6993c5dadeba57df5250f27fb74204d85b8c80d702190

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
ceb320aa003decb4a1c5590147266c04

SHA1
01bfa6a387aa76a0d64c2b194146a28bf6e221f1

SHA256
85222315953f6db5c82c5ab7161187bc84f587ca748970c3a2a5dc06f545a728

SHA512
e9a26b9d4b2ecd6419f087f3ee7de5cb222b028333dd7252ef155f3d075ba94f7cdee478c1d913b64506c341ff5a3bc7e37e3f9a75b0d6c1499462114b6e7177

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
54d3600a8c44c21e10b662e866552513

SHA1
72070ddb32947075e3daadccf13cfeddafc91a40

SHA256
0949dc4ff19b9f7c0881791a8de1c444a97c044079cdbe29c552a32b0c04eb2e

SHA512
31aaf3c4300a28c1a44e1b6258a947e4d97bf10fa02fb536e3a7f180bf01824752a1decb4402123843e493e37450d5f4fb725becc7159d7d83d229670de89e2e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
e7bba1068997c3f1958750f6738dd2c7

SHA1
b0ac45a96fd587a85921e20894ddad11ecc55d95

SHA256
9babfd90a1137087e832bdcaa6ec57b81282102208a15804664551bb77f42260

SHA512
4de240ae940958cfd3b675769751ce1fea6a74a96fa077186a06d571cf46b3a2ebe382ee2f1d4a994cbecb96221b9cb69813d8b436d7268ec33fb3609c30a79c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ea5918994d1f30b6619377bf7b804904

SHA1
75d0c64ba7a78f6c5eacbc43ff13229c74b3a111

SHA256
b6c1545f281f84022047d7bce73d52a3648dead89964b585dabb46ab14e6e0bc

SHA512
55fad5de02b5c1ccb719988712b92b111b0db384039eead689c0d677fcf093d3e6f0ff1e7f4eadf2f70d41c2a24d33218e92617570ac596169c5df9da7776485

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
627ba0901cb6589686b37f4e3bebe341

SHA1
3c4f4771a5e0ff4c2485c6cb97501b77e714f324

SHA256
184909694031812fb1e9050e376db78e6628a6b2fc00c90e99c61b4f1a0623c6

SHA512
c456df88a551fab57519315c66bb486b2b76bf25c1d9a51e1bc949f4fe0f8f97b7fd5b45222495c0a8e95c3fec56d06869dc2cf68708186e14f4dc6768fbcfe1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\5e76fcb9-331a-4613-b0d5-4f3e65248b1a.tmp

Filesize
2KB

MD5
9e42fa801e907816ba09ce99ad83b62a

SHA1
5d1bc159fff86af1df9c5ca6a497a1ad2dc8855f

SHA256
4f4dd03502ceb7244391d86fbfc8a81de548a29c4cb43da3af85d6d92495341c

SHA512
bf21058bb1147600e1f6aca602a420b826378a52ee139444e09b971c36623b5807aebc42082d66291df31c757e90abb13edb7992efa1b858e1d5cc776493fca4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\666abca2-71e2-47ad-8295-159d2a9ac692.tmp

Filesize
2KB

MD5
714b41f6aa803939d798781ef4e4868e

SHA1
70f0679ba2c81d63fa4e8e42a179b5d84898835c

SHA256
2c8880688eb7d9de15466a43952f75757694b9fad16cf6a4c5b7809fd822d7fd

SHA512
576cded025109c861413b52006a9feee3000497467a6122611ecd497f7816794cd9292abdc07dc6f51946d5e6a0a054902f0227ba5053b21ed39c9348d493a19

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
2e1f32827ec5a9d1f7d513f3f00648de

SHA1
43b31fc5225af0c04722290d16e86f452c029d79

SHA256
1e7879304ef03d586b8dbd57cfd8da4d48c88312258477c2d4769d94a14f761a

SHA512
be86c7caf3f8eb90a782a9c34f1dab33aedfd8cbe0b94fa2a2730f5deaeb974c594adf3b3e11d87b9c6c566218b08858b7234263d692bc6308782785b670d840

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
aa58deaab79e6006c11a3078837ae1c3

SHA1
c09f71421fcb3dceb4ad16c4f015b2a782a6c4a8

SHA256
cbb44c0a3ecdc3811e4448a824493064b30d850275cc538100896cff27ab833d

SHA512
3546018fa2759a4a3bdfc9bd4cec3784a25f6730ad144f74e344ef93bdf45437aff0c20143533adbd38c90bd207b5eeae6613d880743f03664343190810f17c9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
bd15fc3806ed30ab30692af318aa1802

SHA1
a8a5781f588bc870b6fc1700711f35a3b2ddd9c0

SHA256
f67bc9ed38f989d5ac8b0e12bb4d25e5a47d4b0d0ba749cec509fc322db488a2

SHA512
9343bfec2843712d31193a457f4f6ca88e0924b829b30932490734898a917619ee58c0c1ae5d52955af86deeb0989075d6fa1224d7b4e6714c34bc71238ffac2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
9KB

MD5
b028036ca33d7e29321f189d4c64cbf7

SHA1
6dabcd49e84b7c2a53eb96e755444a6063fe0b0a

SHA256
19ed45cd2fde5a533c966d7d1577a480a71e006f219177f22d396e79a00f5416

SHA512
65c496dd2c1bfcea0032146b571fc009a2a78f7a6415f0b1bdf7f8104ced131cbb9205cf8d5fb51096f01aea9baae98a9621ce69f461a475580367863a033715

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
f0d52191f41701af0cd0ca4d2d2dcbd7

SHA1
3e51c198e9dd5aa1ed89c70295345a541b4f66c4

SHA256
727f56b1b4291b650433839a57d4c992dffb630fb0b4fdd5c3bb92de6f4612df

SHA512
54569ad189b0a5db66e89eb48f5299008a98111d58bab519aac3d0f4b0f24d22077fafb3ee09f78aa0191ad4b853191231d8de61723296ab45feeeb11b7b550f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
8KB

MD5
c8b3ed3ba1faef4326db2c38ef5646e9

SHA1
932ee2fc7e110e569896f3050259829f4da446be

SHA256
f7b0fd3a52631f44eb5e1996656ff493b8cdd385a3070475f5a84688706488d6

SHA512
51efa09f9f828859087e6771c34bbd105ac699df9f14ea9fb4c6910e00efcba9196f27d5f2dfaf4ff06b4a8c64fd53051de31f615077f19c3e93c3b80e120b0e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
8KB

MD5
4501e7055a95f49090097740e0eb5b78

SHA1
a62543b0f4fb0eb6fd360be7786bad7070e5f55e

SHA256
880f007d2884daa2cf5afa360d3c053d127512d011ae42a450b7f5370a5f6887

SHA512
0058b78819100c930fc6de0c630187ec1868d78c8e9defc1e8aaf349afb127779b300e693f439df714e1c37c8ab3cf695ce17d1c7330ce89d2144e93ed0492a7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
44a9cbfd4f9e43cfb61070eb414d6542

SHA1
f1bab7d34231a364456aa17160b3da195e77553e

SHA256
87e50d86ff57db7ad38ca61aa1c37417673dd4e7547240bd8cfd7a563e9d46ec

SHA512
f6011e5a5b7e4e723de5e244ec11dd902266fd848200636e6572adf9efec65635467b0a717d6a1d3902942e83dff3777136003188ad11f3661bae423d837189f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
d7d4621b3457510030dd2ab0615fe63c

SHA1
a7b86b8c5cbbbabba049f9a81ec39f78aa80c8e8

SHA256
272a42281b2af0fab5ab00d8c4c2ef9480c3aa348c77c71a29ad6507a713e8fb

SHA512
8524769f58acc6151071659e342ce4493d4fe6bc9e7cd11fc043a9dba875776837bb84a928c77af94616af91406896acc054be8235e7d12596ea35ed1f2581ea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
dfc7d2abce400f467718ee3a828f8c6a

SHA1
eab77ce48a7d77446cdd049e80449b17444f46a9

SHA256
9f1e5f8b364981b95ab4cb4a3507a5a5ca26550befad08ff6d22cc3b86c2f9af

SHA512
79f511a3320e2f1415431033b081b3bb5e17914081d10b807ed8ccca27492d75b87a488b3dcf81e3e99b02eb1a63fb3a292d846054818de80f8e2d18e6db5df9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
367B

MD5
87608c73ac2a5f07f50b8219aab88068

SHA1
392c7a09710ea3e317d2a3610f0bc3fe843c6b71

SHA256
595ee0b5b2413ec4e80d7b5a680ef695e2fc7c49421301c687931d5e92ec8e4d

SHA512
398c5b7d2f5410aa8dd6c088b308f41e06cce90543bfc48cc224d0df90022f40ce6ab4fe0d5ab532823bf8ceb62607e689a284fbe0be778938e38ed945bd7b72

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
698B

MD5
7588a246cab3f3b9aa44e2afa9b620c7

SHA1
e3bf81601f62fe005b8b3a826d196379a55f1660

SHA256
6dcce373127587def503af9a3e253e542d51c35be86ee2d23320833d89a3fbea

SHA512
28e5e5ecc733ec84ba47d03d45fbc39cde1a235116439103b3db9e611e67ad83401d4d0a05495c9bfb9a50101653489a00dda887a85c2634abcac47da0919a10

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
0b7d5bd6f4f9a49f0918fa68f72f84bb

SHA1
4c64baa4d9b4fac8a02f4640e814d6348301a4ad

SHA256
52fa24319c3413d35b4f471a603681a256807602b7bff800af506ff4379828a2

SHA512
b487322c4d1fc357a753c3885c463c0a64e9fe168d40cae39b5a979a2d8cadc3c1dd3ee6a9c276b41357d7fb52dd384646e00e3a3b495748f7a4a189dc9afe20

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
c9099976cac0b5bb658f6350e400b53a

SHA1
5c03fed3d4d84e5e070b7c4a216b25bd0a55efc2

SHA256
34513fce64f9431d9b09644269f6a066d784acf44c2882f42a48b8124629809d

SHA512
ffd2a60ddab215add0e2c60beedd7d9e0386c76fc0ec82083287932b06b2e538f67947d374e36ed87c3ede2d2dff7970ece74e6624ac0a90c127095de6baaf1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
4c7a3fdf8d6ac94e322d103ecbbb326f

SHA1
174e0d7de1e67bd54abea31f0152a2da4f58ca57

SHA256
cd6f97b2340832d7f84710e6686aac9ef8caff6778c13abee59a081efe1652b7

SHA512
76cb2d3edee38e3d2ce61bf5dfeb2afd0ab783ea15d2f00d659f2c073e52bcb76a85c08bf141d2a0faf50577cd4d8451d1c8972eb56e0826602af5cb73aebb6d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
b68d9a7ed6c8050714d141cc27303c08

SHA1
c471676d974a84714f0c88a9855cdfb5e5cc9949

SHA256
f3da5ea6ae131ac7bf3a9a091e02877e2566c95ce3439b945e2d370efdcc7e28

SHA512
32e76c158c9f72c0c7a8c0b353a5476a25c9a6db9c0be7a688955d34f0294ef1a21c08905ff5b1c1e1c83d1e6a88d0ec1d7ffe0fb8d207244e6f01135219c6b9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
d80fa92e2e8441e8895cbf6d557de4ab

SHA1
8382d603444fc993cc760f28d456abe0c553c895

SHA256
aa8e98c9ce29654edc628da7f915c351bfe8da265f24ef950514ff0092535785

SHA512
52e5fddbe596ae601121ca11fcb36535481e0515160cf9c234c9e22a962cf2f0a4e698982d98bf233136f1d181e877cf369689f50e75f9643ea4e5db023c5391

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
9023342e5eb6b40536431b19dfecfddb

SHA1
190f968475969f22a92c5f0390fbf4321af91db1

SHA256
6d2e616576061ff6673f67a4105a28515f795e4cc4c1a57bb48a9ae6477d341d

SHA512
a13d85a924799834df50b5054f09c3b8dca15462d2cc46da40b1aefcd6309ac133eb02e293ae158f5564b57c0e39411697d5a2be9077bf665c0e5ab51551e1b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
631ec627339c31215adc748c514d5180

SHA1
a975104954361157be7eaaf4f982d44777e5adc2

SHA256
65ff2e039accb3188b6428ef1ec1138d8ab046a78d56c4ec97865525af680f22

SHA512
fa151207dd0807e399f9ed413fc81e1945f49c88325fcb248f55db3cdb8f5503a564b10bda9b1b4b7f60b2d60089a932d269d93b0ce3a784f2bf3c6c497cb261

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
59fad17ca46a45ff9090dcb543d1e2f8

SHA1
71ad2bd974b76ef5ba9c7d7c2ef88952792c5ff2

SHA256
b6eceadba5f31398f9d712068c31814aabe84d33b16b78464a6432f4cb1c46cc

SHA512
ce542bfa0f5f6423f5e0e607f2e18a22e0b5a5cbf86c5036f066af728e78336040926b6e3b12407b746a8d514662b6c437600124bdabaed2ca569e8f81e08f10

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
61bb3d45e13cde09a12a46247ab53b74

SHA1
4fad75248aa796a665735edb36bf95512234cf6e

SHA256
7aaeadea761d0e51d3a558580517583fe05f72e1b8047f56096ee0d266deed10

SHA512
141611e0681ee7cdca672970a2058046306a38693aa60312588f0b410e1bdeb387f01b6ed2391fee64fe8a47c996c52a3057100ee9dbc09f08398b90b13b8c65

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
b4ea3a2bb5226b5b813557a7e0272e39

SHA1
aff10e30430a13e898288142d34bc6c618769d49

SHA256
f65aa6231b2e423efa922b48d96bf1ed66cb19a46e6f9d0e564d8eb7dee6405a

SHA512
6530865bfbf62b0c56d56a2a7d886ac0caab308fb07e77a82c76e0f4df5986744a175289bace61fa04cfde184cee17fcdef84f92499cd1776ea0bdd0513d18ae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
5339fbe7bb66a7c8618e112f6b86632f

SHA1
36b3c11afe1e8424f4daa9f7814346945a8bdb46

SHA256
02251f8ff87b5f91f86c426d98ebdcf71907239b2e69824554c1e39c3b2ad727

SHA512
cc0621656695b6b97c445476fe644a14966686a1cff1d334005e195d735d6f1a8c0ee5e2a0d986fef6d4f2e9a28372dde5e22002ede7ec81abeab8c2b5b2eb56

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
f5220a1d4837f2daf1a80cbe8a9b2c9e

SHA1
e32190707f3002bdaf2ac0bbe76e4179f6ca34ca

SHA256
b98c26212c1324eacf5cdad6009d48344d4185f887954daba2b8b99a37f16c11

SHA512
36e712b75f44888cafa38da43dcc3b387c248f04f4477ecb39f2bda2aa91c219f9d5a88b3d39fd6c6abff00c885a5eacc109f17f224058ec2fc74aae80670220

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
2357e5db3bcd9ff18fb569f73b2676aa

SHA1
0453bcd78df154409e433e7f6307a535a9ca054c

SHA256
bd253d60cf7e786af86991fbbe0ca332b6910112f0d45878f56cbff8bfab493b

SHA512
8232c41c58e6f031cd77ebd00a1efcbbe5f616af0d02f1e4e6af9be7f6785c8e2bd08e74b0be3bba7c2381bfef1352949594d64a826bdcef66393497278f3723

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
5f81fb0740b537dc3e3fc53a8235c0d3

SHA1
dd247da4b18372f5ab0d89487fbfa22af43ad100

SHA256
022670ca23016bfd318f79ca96fe03f7b544825862ecb69800bcf2c578ed41d1

SHA512
9df6274213c43ba72c5561f3032dfb4d4e17d5f2d261fe6e059266d0258bbd61e461e47f7c7a50340b837e01b5b69d8878a8e92c586046c18891e8dd7c6a7b52

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
75ef802763af244c6996ae5a56dd44e9

SHA1
0c4352ddc071988e07c7390b7d9b1431f14ab840

SHA256
2be92093d03cc6444c94a263677221a232a6f4fc206ca48a84a8da14b269467e

SHA512
ea8b9c4f6404ea88a2ef809daa2952e35c6946de9249d5f5e083492dfe4b35891dfed023f3c9fc7adca119a941a77ee4cea3d1c61d64f5af75f7c33c55c8f2b3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
7cf9d083f78e037742f9b7ea18f08cf2

SHA1
83558a638b0cb8871cee7eb14d8694043b7897ad

SHA256
a9d1a96c4b735ad7468f3184026369676f49208b98dcfd31f65bb85b588fa831

SHA512
2df831f801d5fe8aa28131849d542f4c24c82a2ca85425d9ffbdef375ca0cae07a2f4a3af59abda5519f5aed9fbc9442ca7ed18d41206178c97e0d0f2afb60c2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
9eb7425ce14dcab7949be4fc5d7a67ac

SHA1
c1c29f8dc9d0fb0fdcc4f9c664eee2c9aebbcca9

SHA256
a5a174badb017f2d972d7ff245756a5766a3ad0e0852fb3e7f730f478a91f747

SHA512
0752ed65e3d11387086be4cdd333d14bdd9ecc3a49186d2e98606a5ce4c034a8a6dd1310fd9644a756d6b802986822df535b51bdd317ba722392b97da0260ce8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
3dda8518f49b58a062feeea19482cf00

SHA1
b4bd3d93dd19ab1e191e1afe46f12d1baf82fb78

SHA256
62b753e4cb8944d7ee9a0729f0f7829cd277ce6da5cb4e57879eb895ff82b723

SHA512
9575deaa9941de06692e232530234149e77dcc50b30782558792be855068632ddeb8bee6eae46a4ca12d461fa13885e36f34751f8661758c990a646fca878e2a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
367B

MD5
179be44f55f5cfcfeb0c9a7e07d70cb2

SHA1
be5d9b44e86fa81dfda790aac0b618eaaf3bf835

SHA256
a403cd764bbd8204d1258138ec51d75bbd54ab933c8090944642c68bf0fc8f68

SHA512
44356db248d220d9de23c0bf075018b8babbc91e1bdae3c29314a7d4a5a923854c179890d357d11a108fc5f99bea1b4da09b0501494cecdc7dc2398617425d82

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
b7f055e6ab466fbe0b65e623e7a5f414

SHA1
185cdae3230678b2471d19fb1cb2f3f0eea9a65b

SHA256
b25e5f48419c0c3b7174fce1ee68c46171d56bf8018a6db1e4ed6fd50f88962c

SHA512
5369ac9d3ffba31e39a34293cf2d8fdef5714ab82d0f455db3cc7ee44b71a228d70befbaf5af9beb466000871b023e9317106149ca43f20c28d2fc340ab9bb18

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
74b26d4b82cd67f50faf5c22bc58ca2e

SHA1
b9acac3c867f299e31854289d57c1f4bd9904d8b

SHA256
97cd64edc2977801cc6161c00f01c5573c2b8b629921fa75c53cd37e7437b628

SHA512
a8ff98262659d3fe24e335a824707aca8a4910a8af81cf73b5c37ebe30482346557609ec56b3514a5c3c05c1abdb2e26d705510f3c50ec2f9c980a777b7fd6e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
178917103c1fe5b00ba543e57682ff11

SHA1
9c91e59481b61adeaee8aadefd1e5bbcbd1ec05c

SHA256
b81d7924cf7f8cfd79fa987b5e60d6f515f01a363ab2fd89b116e3dcf05455bd

SHA512
9a991dcc7f1b61bb7f3ad3726ec16ca86f7bba3acaf176a2248d16e7d4e25b52344d5e3c9d23e82b9f8c37639581da74ff194c7013733008c66acde6b0bfc6e7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
c27a1d9e8ec4db711282dcd3f5198ebb

SHA1
d160a5bff2daa75128f2f87c04a9e38ad8439e5e

SHA256
c8acd3c3d5b45543b3c5dabdc2c0f97f41d4fba5c3865c2becc77848777b60c7

SHA512
69a9323ebd469f4678a65e567e95c16e6d2b6c59103434e64df659b42bbb57a4943d6dd6746cf1acdf6dcf4c8865580c8aca2ebb5194e0313f4fe641494d730a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
d60f57c7a7c3203e28c6901659ed2903

SHA1
030a959495b1dbaf03ef7b2e858c138607d4864d

SHA256
6ae2b5a3ac923dc2cda37ea3f3512b1af8cba9813297cea8cf009245d72bd0d5

SHA512
b884cae288d0697c3c91889461c1201d7a468c1cd1076661b02dab288032c825a50f343ad1956bcb6dcdff36b8e7c0c465bae6f815ce999467ef61d4b992e9f2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
e05f7cedc072e0b4465cf33e537dcf04

SHA1
70ad0986a83d9e938f922c3e87753968e9288e6e

SHA256
57a1de9b1a32020bdc8b65ba5feba5f4ef5551abc939d908662ede637234e353

SHA512
d9b01b4e5a2423fce2f61fd96a5c8c409e84d94b9c7834d95e2cb9105467a43101910ec1ff2351caf023ca2ecff570b76f72c2ef2ff465daadcd8e72a5b20e57

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
40f9be9ed680f340a5f04738f27aa670

SHA1
0e85713c378cf7829b5827e1e1c46474ab3cbf13

SHA256
a860e3403b5e6b12c52c2046fde3b54e8e811a86a26cdf36ccdbccdca82e61ca

SHA512
aed488cf1e411055d62abb9a51f6e09ca57d020ce2d5785b40b3c0356e7ace28a24164c55c5adc35b90b34d7089bfa75f1a9f84f5e2db70f75d52d9edccc9179

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
f5f735ef394f2e735cf6a9809ea5bed0

SHA1
5eaff2cc58d0a94f546dd34a521e3634eaeab77f

SHA256
a81daf026d6822933e99cdd8c178029e2385fc53aa5c573df00469b92bfee08b

SHA512
bb04d8998b98bd37731ac7663580a143ce4c8b6a9da6001a25c889341a7ba88211d6ecfd29854e13664a137cd0671b1ac24eb716c38a608eb69cf51fc2c111f3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
1ac55098dd8df0984fa1802af00c6203

SHA1
9174acf2f56312dd93b2edca622c396ee2431e43

SHA256
6c316574ce8c66a72b44412452d4b5edeadce96393719af9b63ec9597dc66d2b

SHA512
104b2daa2cc3d4e10d06433df00058965d0edaf365a2dbc9ad9036062c25768b52b21b3c7e8590ef99cb309cca88aa1ec05beadc08c829793226309da40c6ff2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
2b95ba60e951c2c3f52ac0be38415f9d

SHA1
5da6cd357bc4da8cf9449a1f8b726e7450773657

SHA256
96db2e3d29ae07494cf279ecdf058e81c5817961e5d990b0e971ca45070cd174

SHA512
8a79a43dfca38cb2d1f84ad45d4df49dc1019db7a1cf44b4ffd0a8e21a507d3d9d3ed542f86cb0eb778bf74ef2516881e0e478b0bca81bac7fd012a62bed1293

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
f4a35be45588a9019e479478fbc65a4f

SHA1
43838b6f31cc4bb647fcc7a4e3ec7c1358deacd1

SHA256
db3e4ba061fd79bb411b4d403b11e3e32df550c166e0729126ce98210612851d

SHA512
5f4c50895670d7eb9f0ea545864093f4692b1baac467c461d079452c5560ed0ffb6d7a02e3956ef91d15acafb10e2a2faf83efe0bc8443765f6389c2c301321a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
fcc68dc92ce65c327a177ec7d7f1146b

SHA1
ed32b0fa9b5f12d24655526f7d5f7a4db72cf377

SHA256
aaa0be615b03d721b3a62d9f810e75a5c8f657f10a13ba8cdb33c8689881576d

SHA512
dd7718a96fa371bd31895247351ac1f2a346f44f34a863081b155496bbbbc09f4b60b364cb19c6a06b95075b2de95af54f93ec670aa6a60f839c932ea7dead72

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
971c801f515e60496bad31aab5e052af

SHA1
68f736d48875524261c7488aad9293cee65349f5

SHA256
6e8fda50cd549767a955bfc3bf48c08d33bafb64de606da76209293b8f806200

SHA512
ec46168dc41ce4fb0b7e421bd94afdc48c8aa27f8cb4a9d99affe349cca4409fbd31faaeb563ca3fd8b8c35bad914dfd4cb67082d8ba280cc178e5eafb8caccb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
99c0422dff8a878589327ff3a8acac05

SHA1
42b45c2b70084735cdf2efeb626f35aa9486b973

SHA256
4d9c24e2cc73afb667bfbc429263eb332f06ec2bce3d28780fb6142b6d2db94d

SHA512
3021f2fb9a82555d79dbb091c68a14e591ec93923a2a99bb426546ba3bc022c09016719e276e672c717de9736be6d1f23d1fa94ae9a00cf9331551704c0043ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
221a451d6eab840af07e2911deee7d96

SHA1
1945e933e1a22e451e3fd8224af1fc3a1dd39b89

SHA256
ee2c99c81fa01773f6e0fc1ca8da69049ce39243c085c4a7672afa57dc349192

SHA512
9d54dd26436aaf98283bc1a5a4d52fb6ce041f6a6007a72f4758432730e963218e15a9b0bf8cfa9f149862b432ca409016249440e88640348f9d90b39f60f20a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
c0f86520834ec8f9b2c2c6932b5f736c

SHA1
cf740098b2fb1ebc4042e22046b5dc455d77a214

SHA256
5424c707ec6ca8cadead1e8df4dd503c3ad7bebee39ec3a2e2bb0c62ad4b9962

SHA512
bab38b788789f13983c8672c43fccdd04c50e820cf61ca17293a655276b537e7a1192dfca82e7207402bcaea1c57ab5569058af7a3733051d71563cf5a794750

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
89d8f2012fe50374063898d5dfc760b6

SHA1
f097f1ef8315b6e5563e406107a932677039e063

SHA256
1f632659cfb2fac0ae90517a493874e018a4e765301bca89ec194b446640685c

SHA512
794ac1a7f8f68b1afee930a4fa9a5b07d1c11a24302739aff0ce93bfef1939b0b667f36c070257b72cffc62054ec15735e73c5772763d40bc9b31cb645d7cc6e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
258ea917d2ddf099ee2d0490fdb9e02b

SHA1
b9fc4b2158916d4feb73acfe396b8ab6884d1646

SHA256
0aae6500c9e5b8d7b0cf516b193745fe55a9cb990628dea03a06158ad44a227f

SHA512
fdb41baf41d18fe4c9b04938fdf50c3c0380bc88bbd5f9529d1dc6971d741ba008d148d2c6910fd74821a0d0a5484134a5eeed920ce93f2ef0e96b50ea701094

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
beb6fc7124c750417913fa6c943ff721

SHA1
d00e8453703bebf35ee21a69d8e8c68cd5655883

SHA256
02a16f08a47fb7cd2f5cdf345d94241358c5a5b5312da5944c5a2837e874947c

SHA512
b9776b1035dfcca694e4ad75e2069fa0c8c790e76f03f26bc88e6f9d0601aa34573d59db2448d44999550dbb1d51e71920a512fbc4590c50c920a9ea301c9f3b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
11f9334d3ee028de66c75cbd872d12c7

SHA1
496fa76fba1c43aaff9604d4ac330e77d2112471

SHA256
d78191611267e43641ca8d0a9aca82b8718f4127e60a26a392d82b0abe838dfa

SHA512
e8fcc684f95c74ac2d2ab49e966f39a307ef4ba5100b4ea9117fa0304ae479d6fddc445a1320fdf81e3effaeffc7b85fcae606528612be0872bf2cc3af74290f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
6ee758c4ee1c52390395fa079dc10e15

SHA1
0527e6bb57160af7693cb57faacdd5a6c737eb62

SHA256
c25f366ce37db93b9200267339807e81f46caf62fee5ac32fce86b9e6d3f53cb

SHA512
8b0e7c9c909ae9c763d4dddb9ee5711946b8da51956ad21f7f74bc6ea40d8c3236db36ebf53bb44e45ac52a336b836d2dcbbaeb5c16cba213bf7346ca5eba960

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
1edd20add697b5d2e6af07707689c909

SHA1
362e26e0abb24919b600089a7576b8cdfb5c2a34

SHA256
5f677caaf72ae5bf0defb823dec2014b086465e26cba75001d1e0ebc9426166d

SHA512
2c08d86f5f4309c2b52c4d2cf18289cc2862b48c4a2bbf4bc5826ddab7399678aa93d8bdb735dbb2dea65bf4e52a6e22066a8504399baa60b986ba1d45bfc243

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
7839223cdbb8ce9764452c6f012b9222

SHA1
5caadd411d27cf03e3b89eeedabd1cfe5acb3cd1

SHA256
4fe59a1da3812ff1784ed46483b9da174e378a4c2d9676918dce4c3b1d808429

SHA512
c6b7b87d178ed906f50ce950259e3ac0f335ac2b20db9427ddb6f8f467483218e14cfeedf48d688a407c18a0b66acf8974d201894d490a2c524f60bbfbe6d167

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
54c1417048aa35965a618c983a1ab673

SHA1
f1e4c23544ac732f0a4b1bdccdee1f9c3b84e8d4

SHA256
95227b1cc5910a5d160d61e8a7e4efb9be6c5833d6e27347f8ff4850a3de2168

SHA512
e614105e8840ce31de47f089a3929ac73f1c1c01927f4227810c7bbe5e38e5189f20405b829fd04c98267672d537b31264e90893e844c4967e72ba3c8e8177b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\b0363acf-978d-4277-92b6-a8ac8d2d0cbd.tmp

Filesize
2KB

MD5
b4a227d60e60722e7435ee4268348b3b

SHA1
56764991522fa558a2d7b2ca5495edffb8769157

SHA256
66895c76552389d7f82fc0849cc388396efc74d3f0da6d872bbccb7a88429a5f

SHA512
5f4638c93f083a76d3a88e8402fd397644f8db95fa75a564e13c18001cbaaf475942aa9a37b3a66fed5ae44d351c2cc9af53e79ddbf5e9725208ba3b41f900d1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
92a8d908573f7b5dc5b3720b0645143e

SHA1
72b177fc603d3bad0e8c81240b5f2113cba59d2b

SHA256
6a3998b2c7cdd1a30794878c39bb3dd683447083f3d312452a649db22f37b1e1

SHA512
a65435c57e7c6d2a3bab5aa89e6a40d286695380fda37028cfde9d56406f611347472e1754b374b0fe31f486ff75908317fb25f96e39606360201a6c754f49ac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
48d9dbd7e8cfe1e224dc61872d1aec3d

SHA1
f9342d56504e2e049c5985aae2ec6d09750459a2

SHA256
c5ee0573125bcf036652fccb0ffaa1fb2afc03b8650ac6fa4f881d51a2b84ba9

SHA512
8d80a27c828bacc36516e8dbfe792650e653c2d3fd3609b86620054b08bc99a3e74d70de44a65d5f97bd9c04b21731dcf737075c4a4cd80fecc8504782b95692

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
946a7717f68f7f2cd31a2792abf83110

SHA1
56166e4892d66649db5f03f2a20fbdef7bcd3460

SHA256
537ac4a7a3b16c961eff9c54d71eba98624b4a77b60d019de7010178a7f08992

SHA512
7ae32811781b7fe3808aa5713dcc8bb824109170283836a79197448227bc5f25a200959877a5698177e0465987c2bf449079d197d4ec4db34d7b6c3da78740c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
d760f7e57596d3ff96a95b274a9e1f78

SHA1
dd7042e05bee39123557024f11bfc2a155a1e092

SHA256
508b386d8bf10d992e9b20c7090f3ae672c540eb00eb21df5f6052a80e6fa59c

SHA512
7d9a4e1a395bd2ad582d9750ab0be3d94fa48059581c8706cbf878018535b8853d16e027305e1d232b1ebf81c31f0b8dafb15aeac39f76f3a3fe363f3f3ead26

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
b9a8e1bdd6e1b4819127aff72e3d7821

SHA1
e793df027c0a87d81512fc82e1972bbf4ce51205

SHA256
a66c18dcff05960a165625966e5b7f996bcc59dbc0dae9bd987e3b3ffd30f7ea

SHA512
6b2d3433b43b2a6c5a767d0651c02ef05dfeeb0597c7b85c8c6bade5f77f1882ae76a01be530649bf45936482c465e06f0edc363caa2a4f3e674b7c3916abf78

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
464914fc0881c78d6f5c38c0b1bcc81e

SHA1
f9daa93087958d91ac84f0e161c347c861bcf260

SHA256
69fa401d1d23d518ea7c6312d035fb742efa0e9a298d9f1938fdb34c32994670

SHA512
603df9a6320432b4e75d0e1fffb8e2c1d9408da41d991acc5d5d5fc9d08558509656c53d074fe86e2923ced1d803fc419c73b500dd0d7669a9647458dccdea92

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
2a312eaee0dbe6caeee67224ed19f34c

SHA1
f80b6b94a05d764c9e7207e448ec557956209187

SHA256
ad2b6a26019e47c23dbf65674488664486f12aac46bef6ded3ec66e955901b49

SHA512
42602bdfe9a07d9d69246510d476d98795657fc350646aa603397e46bd601aad3a1f7aea3ee2d284abf60b7a5eb226215e32daf634c4d8b8b885ecdc5d92812e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
c7390a4fb5db4ff592ba873ef6800903

SHA1
45d455f0a4da35241e068dabe517d96a22c8b4b3

SHA256
390549d4d340fd307d34b8390e47dbe0411047c4bfe5172062d12ad5ad274cd2

SHA512
ec856b3d21451d85946ef6113ed4bb34a336137b1e01483f330d1c465b3866e0d8e30cc8432f07f23995f25ffa5963158ab885df15bb9dbbb2f09c7b1151c633

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
110d7133d878a14e867bcfe05620b63e

SHA1
2d9e30427a964c58abb9251f53fe68166988699b

SHA256
132f776475fa7c0beef31aca4ab88fd02652466eee3006d12b63d1828de3a84e

SHA512
f1a25be11eeee476b8b17fec1ddb2d925f71304c319427a4fc8414c1981a5e1cdc22d4999a7be1780e7f9ceaf70311ab257f69b63eebddde91292adb5baffc05

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
848da412754d65562d78f75253e00fe3

SHA1
977a15a8c2f6fc1c49f23532d8f28a1b10f8e702

SHA256
17ee71f6de70f0461cb3fbd258a987ade421947a0447b6e12c70d7d9eac28c61

SHA512
1689e5727398d94c189cff65d7c2bc91643cafc105caafc1bbca7c7bf13e611c5d4d3afe2fbb2e0d3a243b9894c50f42378cb2a0f7d7dba16b9d3a5e7fb3925c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
7765bd2d52b6f2abf11900da0b3eca1d

SHA1
3bd7803153ef8d4c4d3d698f4437668369f83733

SHA256
4bb6d9f0586238ac89aabe81b62ca58135ed62175ddb431cfd403dd8f74e1bd7

SHA512
27f08ba8ec55f337203b9d487da4f906fd13641e4399619b2af64030311847f2dc67b6c36b1e55e29a223429dbe6e58a23aa1b8ad5eeee2470df2d339eef0708

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
896f02104e7e2b8b600bd0578a666538

SHA1
d35a511e5555d96bbd68a337db22658380f0cc19

SHA256
4650dc24d1cfd9a524b6dc86e4900d505d81da128d7345479403564c2ed7d63b

SHA512
405cf4c7e0453ff704622b7723666c226496e0bbcdadfc6e26123a36e9a86428cfbae1dc6d9a455c65e5df01d4723c5e0e4b519c7e31dee6934b79230b67f39b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
b25061a139fc09c2611dc0a62a7a7e53

SHA1
9031e5d8b26a9989a11cc0e602f3ea41794bc9f4

SHA256
2329567b11acfbefe898cd47bd0dbd3bf4070c039309ff77f033ad2bf91d9cfe

SHA512
6c85d2875fd14095618c39b57546168f5b89435e601e2f1a465330013cac713558aea696debf840f9d7a7ff39e654e4c07d25ff9e4f606b492b15797fa94771a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
6363941921e61079323bd9eea57a3ef9

SHA1
60ae7ade1ce5aa7b397143382612070b372e6021

SHA256
12e07c8b915ed63d92b2dfaf3e609f00df1e2b7317a608f61ffbb0046d766e54

SHA512
f3bddbad31232661e80e32547a02601bfcd355d0e76ac6f50df70f465730e00ead29f274c234d56b626e1fee2020a67fa9c448a617967c239f5fdad273c3ffe5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
b6a2c55890762f3e2241de6a502188ca

SHA1
85ecedcf9356645815aa71907c3eff5be2994cc2

SHA256
644998d8336e3bc62e4f91ffae5bfc7e5f55dce4224b094f4e041de5cb4ea6db

SHA512
9b3c7969eba8251c267bc3246a49a363c12a296a7d9c73dac27f6a656feaca2f493debd33b03e693a9721604c2993bf7264bdbefec59625eff6da9db301c4b9b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
7b266b238572fa473239b6a0816c233d

SHA1
1ca7599daa3bb568d284e29cf6ea1eed9dcba571

SHA256
5dea4a86c4330b961adefaaab0a158b2c6d90efe3bf0e2ca94ead386fd48e58e

SHA512
e18793a1e7fd966d4f20fe0943a48d8436d0b88eadc4b7cf003cefaccb81b59f7e2452d47ba0f4b35e0f91a6c6ec94483223bc1d516658448f6756ac86f52c62

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
bf16d41b86444e67cec0ad4a925e035a

SHA1
a395c29a4a22d1601c5b5f7bc3a2f9bc633ed055

SHA256
5d08c9af8c94549250c4d0cff3e00502fa7297973993231cfc9b61e48ba69c87

SHA512
e0d6d8c6f62e840ad1830e43bc8bc224dcbf4a68fb27c0d6330c14d2ac4e33491e06a6bbcfb5d99053acb1c019257f32c906a27afe243e8728f9cf077ef200ce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
22d89f6dd39c77f1c8ca2d91e72db719

SHA1
1bb6b37bb44ed62d5a3b6c79348eefbb18c4e66f

SHA256
acc0fb1e955029a282848bcbf7eeeaa07e49e80b9a4e0a53d750104efc5c8dca

SHA512
eec16fc54d983a2c5117c941a68da52f6469df702c40b77d25c36004b4fa675d1cd5fa2efc8752f13b63253c212f6267ddb5404779196bdb4c2b580062feb880

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
7ca16280c71c600aad83fe4229f439bd

SHA1
832a64124ff37504ed72947bcd5bf1a5483fa7a9

SHA256
66666e1954117930b74e89822a3d79bbe82559333b93302cf3547111b73b963e

SHA512
97b961756746158c42d31a715578dec89268888ec409a48bab39c3885ac7387f3239392bf8352f9f9be78fbc39442e597e881605a1f4e4a9dcc15c1ed539b168

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
33f4f420de7c5fd6f9b6f6c3fd03e76a

SHA1
31d77f32343d7a93ccb24d8ca4c910137f39df40

SHA256
19c17a0f0ae6f6b18d0d962a2eb66e0e76ef5d18c8e109610aaf7352bd405d3f

SHA512
9daca0821f68cd55f233f15e1305f5ed7ba62d6db06a15a6e419d78bd82f396bd12daaab12ebd0179b1dfb63e18e54e93ca1dddf7c55a6d68f06055ef5f32151

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Search Logos\logo

Filesize
28KB

MD5
81f53eae8f4b48207238e7e8af7ee470

SHA1
b7bc98461358f99b07651ef50c4f6c783168178a

SHA256
6345279fcb0d69a5fc8b2a9eeb99f0961a9008cfee08d59304c1cc7525192e0d

SHA512
a92f6fbb51d03b49455b454346fd39b4e90b1360d29c4131404da67934330bd19d0f3a88868bb00ad2740df1605bc6573df00620b9964fc6c14933a640ad13e3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
56B

MD5
ae1bccd6831ebfe5ad03b482ee266e4f

SHA1
01f4179f48f1af383b275d7ee338dd160b6f558a

SHA256
1b11047e738f76c94c9d15ee981ec46b286a54def1a7852ca1ade7f908988649

SHA512
baf7ff6747f30e542c254f46a9678b9dbf42312933962c391b79eca6fcb615e4ba9283c00f554d6021e594f18c087899bc9b5362c41c0d6f862bba7fb9f83038

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
120B

MD5
196ae0e813acf371b17c6d01d7e62542

SHA1
c6831f3be895ed3828e1b9bd3859f5618663ddf9

SHA256
425f4317bae29cdc40cd9dc8763e30121dacec5bf885d2e7cd46e448241f5ffb

SHA512
f2ebe9b29d9f26b6459a6c0d21062be8f89d08720ba0049ab066097f02843f6a6a7007f6a296c341e15082446104c9ae15af570001539c9f120c5f29327e7de1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5ba7c6.TMP

Filesize
120B

MD5
2ed06363303daebcaf4cd606b52edadd

SHA1
221042f001abe7de765e9a2406fdfc64c3d04349

SHA256
d040411587edca0fb72bf1ffb8f37c571ec98485c3c8ec2d25638ecfdeb8f3f1

SHA512
4d4c08076fe503b834a3ef34b6db6cd2ed1b751511ddc5b671029be45ffec3951383069f5a076754385658b90169146850051af2197fac15470e0dc8b80be7c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
269KB

MD5
5cc672b1440bf8c81d15f3458e2a2b50

SHA1
375217501d662fe340f1e17b37d6fc93ec0d7f96

SHA256
003e891e26dd892c81d124609841648ffeea65fb7169bb576ac8895a740cda67

SHA512
7c5151e9586129e67df37b366d8fa830ff6181c3bef57ff73b562df6adb9d80e7188a547a9bbe7973a060235bf505bf90e912cce95100f5c5e48266c460cfe99

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
269KB

MD5
95984ba3f1fc13b4b93e243ce78267cc

SHA1
e411e36519941115e04024e006b50183fbdbbb30

SHA256
a523bd41a4e1ea4c4e7bcffbe67fd5b122d84bbb9250c72bc226f4019123419d

SHA512
b10dd5f04b8eb1045af76b1532e66dbe887b0bd901d480be0d2156c984e112eb716ba8d18e219fa3a9b343944f58a9f78ad117f64f469c8627afa7757da26ee6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
269KB

MD5
66d07666687bd3b648edcb5a3f7e2c91

SHA1
01e31757a8de3669f6d2a97fd7a13d26d35dc2a8

SHA256
133c6567f51e3047cf11e9358e032eafc748f803c1be636ef2dfd640ffbb9d98

SHA512
ebe8275f856cfa7545d222d39606c0913421a9324d50fd54dd52cc644080dd229dcb4fd7fa00e648a543e9e1b19a2f2c1a5723633f589b8a16153cfd3f2ae05b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
269KB

MD5
39c9891d1f4c71dced6402d38bb0fba7

SHA1
bc786e5443441536501d06c9dde772919fe98ee1

SHA256
a30ae126045261925904eb084399da0bd60e293c945ee53bf6fed24b4d7b4d2a

SHA512
ac4fa1260259f5b16713e0d27ecf69cf2b5d33cd60a45dac0f14dae212a688445b7a85d943145e14a6977f2f3f30a09a48b780b2a700a0eca6e35bf907bbdccc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
269KB

MD5
33a60ce755c0b4a01dd113ccd829e5d4

SHA1
4299730a8a4df8950a2a6fa7518635bab552fb78

SHA256
3e9cc64506d67a1a29636fe630086035c00f6e547066064b7422b225efea1faa

SHA512
7b70960d131fb8d892211568c379f76cd7ac8223e1fe02a996bb10b00497b53c17c212e240391acb46b97a3ada99d9e01fa6c4c4067b548427d2d00ba2f1cd92

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
269KB

MD5
dcbeb936b53c6009d7a2d025fbce72ca

SHA1
bc2de089924dbbc73b8823f97fdb55836f9eacd1

SHA256
70f841a1a633383b3a6867b001b047d237d4d3ac15813792615e6738eca57688

SHA512
08f0025f2b9c363924f2435e397c62f9c3ab3f57382fb988aef460140e2fb4b5ba3b548affb99c5f25e845fbd22708be1d64420a1b0117f18ea7c1f67008989f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
269KB

MD5
9561798bee0bf6a1f27b9305ed8d9a88

SHA1
489ffdcaed3dba5addd37ab25c0148ee2b28b349

SHA256
845ab00b7c4183510d4cd5d9aab8092ff16ad56c62e0d7663be72c43c24bd881

SHA512
0c91d83bf7522617ee78fc2e3cbc3c5ff73f230c16da1e4fa22431f10e6b13847b18d36160881bd6316fbb271d388273c8d5a3b3be9ca16845dc289825c55e3c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
116KB

MD5
677a57de0a17c138bd61f9fef91260c3

SHA1
c0fe2c8682a659507c2fc81e24cddbc2b4b85d51

SHA256
7cabf65e03aac273511ca0758de8e135786d1ddc122a3fc9e64a122a2453b4b0

SHA512
27909a551679d87af2e4440e4a055142a84229a306c3c60251f8cdeed43c7a7fe48b9aee16e0a003c6c5a930fb9d6d8198a10c9fc43d9f00b8c93fc95d958771

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
103KB

MD5
feca2135bc4696381ec669c4ecf23c88

SHA1
c38e54dcaf9d79a4dab60045e85eba7b7a4cef2d

SHA256
045ed4514e9800818841592a6fa69ee569a8f7cf433ae1e762a7d05958276f20

SHA512
68a5ed0e8066f4b780611ea5cbbdf978fd7ac7e370a9a2e186fcb6497946d3369f040489a2c39cb5796aeff2ab81ef2cab85df83e4e18fcd779a8c2f2c5ea1f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
105KB

MD5
aebfe81bccf57c96300ebeda19c99fa7

SHA1
aa0f0affc2c816f0360698d48d18e5d2bc82079a

SHA256
5027b79b1970c9bfb8da7fa0f5de4abce3f50c59e80d461b1d4d08bad3a39893

SHA512
fbf5c52236813e7c10639b07757c450e40ebdec213d04b30265a1bfec77c61243f4385c68c33dad58ccbbd2d8e14e2d8ec392634b69064bb883bdea69d5bd8fc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
110KB

MD5
a9c03b4a581814b9ae056ed22ac7c30d

SHA1
56c9679509f2a80090fce1f4a98a7b8e2359daff

SHA256
855aeaaeb9721813ebfe0fe3c42cf356802cdf914d60aaccfa42bcd8a0dddf0c

SHA512
29dae0e57f075fbc46d5408d154834ee77426643472741af7459265d1e718ec283574f9df5ae19c9e4d846e229c113004c8709dee0a52be8e73a061aeb9f83bd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
119KB

MD5
68cdcaae2fdaaa27718eb69b86aaa3c9

SHA1
ba51e27ff107e93cde8771ac02eb75f91beadd7f

SHA256
946deb413b3567d59b29b5cf2674919b5fc23d3b9206895642f098828c0bee05

SHA512
05720c12ccae20f5c3b5a372648339bdd08cd0de4ed9dd4c5ebdec9351dc0fd19fa00033df5d4b146c26292e85c0a65c178fc6f62fa0d0827b7bbfa53b663daf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
116KB

MD5
c652ba0d3b7f548697d7a6d58dbcb487

SHA1
edf5f8d40d4dcc66618351b7929d889e219db155

SHA256
cfc90234397175946ce60e149782e18f16cf3bb0104fd78d96b3cc5061034046

SHA512
2edcc0c6d47b91be96781abb1a4bc25897ecef71b22e14177c21ad1d088381ae4abe2d853f395d2eadd751941c4686b73761dcad2729c3cd45add780d7ea8d0f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
117KB

MD5
cfde1113c30291add1c7e4e2c87ccb2d

SHA1
751364d33d6b6e3a08db4d6643e5c3fac6a4456b

SHA256
303c62b955411ee8b56159f0157d517c0ea1d6f0e84697cb6af8cdddf05d5900

SHA512
37cf527eae6b08b316227b495df6d21730d08cfe99453a43b1a2985cff3269fbf336d5f909ec5cde226fa1823d383696756fe4ed42f324c4cfe71a95412292f8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5bfa5a.TMP

Filesize
97KB

MD5
7ac3d1e1f80fe468994761211071b5c7

SHA1
01b9864815cc7a81408892f9ed987c3aefb5aedf

SHA256
4e1024c24ad9c47e5fb70229e30fb53af06bb8462f15a210f68db154febc7b25

SHA512
576d0faaa78472e04456ebc474addcade1ae531524e88deec320edbaf23814efb3c54483e53b175e33c8ca5656bd49bda2bdfc3b5548765a8c7e1826c4b5aa44

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\43f0939c-6f04-4a98-a815-a0cd87528aa5.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
81b424416972c0291f120dfe2b23d2af

SHA1
85d15aeda896e2c5dcb0a0421c87922e8ca88e50

SHA256
c420eeda631675e7178ffef6960eaeedb3f4efc8bbb67ef0d3f4a58c48409bfe

SHA512
5fb95d7a854b6bc3d87551446e16066f6cd8b7dba2890a79433cc64b60bc8aee45cc5377404be190ec0bb612b62a6cdd7098b2467181bcd6c412f821aafea64d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
24cad8d033360fa74dd6e3ceb974a33c

SHA1
63fde0204ca24639afe35d97e96899f14626be08

SHA256
b097fcb2f3001d17154729d31d45650aa32d0dafd4a7b51ced7c7c4ec87b5534

SHA512
df15247d23666cdca5de2ecafd05a1c8cdbc95051a9ff10349b87112459536d31754e4439f31eca189599071180492dc645d52cfbf34e5dec9fd06858937a82e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
9798327bc28d9fdc58e9a4c8b20dfb2b

SHA1
6eca0b52bd728cc819a223bea4e95245e80ac0f8

SHA256
4897dda2c72756e4b0f29fa0dfeb7a7e0ba4e1d82d509b7dbec0a0aa149c8adb

SHA512
a2accdc7093b91226bb7b2d741805abaa005c27514699cba80874ecc89a69ef9b3722f95061d44d1a84199afc6ddd7425f8445763e5d526be1e94cf5d4d71677

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
6e5371f4f1fe5343be7dffbc64d200cb

SHA1
74dfc79ebeb36a6bd102eb8a00693f7a1271fadf

SHA256
47a42fc9e13af98b2e67778d822078219cb0d27ba44fe39013197dd33283352e

SHA512
0e40fbbc69ec704bda9962623276c5f8ee5d65237d1b2eccdd45894918cfe2e1e5b0a2054f496654d350080d1afcfda4a1326210311029a72a5aea6de01b8753

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
30KB

MD5
22dccea5afdf8882fc589f438f24c24e

SHA1
6ff40399dcf15582c21d3c41d03d1df44a0c735b

SHA256
63d18ace079ca1837ed4b20159ab5cc008334181b292c47a01177da85cdc281a

SHA512
e047ec816b6ddaa49bf81af41de5bf8669f5639706322c98d71ab1a09ddaf578fae205733c7cb6ed893e7f899ec86122faae0c77f964516504e82d21f5f2b114

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
65KB

MD5
81c3575cb04608af44ca0980f2ba53d4

SHA1
95107620d0dd07a0b13c4ece325b5fea88b06d14

SHA256
28c0c39164d2c8ef79a504f3a1972b7e1657d7196cb7e52128788cac6129544e

SHA512
d0217114a06d52a8691c903d6428233c35ed878b707ed778b55b46deea61d668e90e19b163d96b9c49409895687dfcd0e0e98214de2cdd61253dfba3f1327160

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
65KB

MD5
cd4c4c4932c337e68fff4a530a39e88c

SHA1
1f50963deee84b58c5e08cced4cb0d1e8cbb1cca

SHA256
ff0b8080f7b51f0884354504a5c15b753d66b5c8d46aba970394a3f4aa1669b6

SHA512
0ad04c34e28de4a1e2b42c4f89b5af5228dddec8342a249f4eaa4086bd0c5bc340db8908c7b331bc6015c5cb7b2dd4d06d9113bf1945e81c38225e8122ee7873

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BHC2O5WS\js[1].js

Filesize
318KB

MD5
2fdf8848b01e27c80f4a9b080487f38c

SHA1
07646ae9eddd78b224ce6ea8f5bd9e96a289efe7

SHA256
80d5b9da39f4a0cf5c42f1aaae847599778ee61335ab6357da4e84c07c95e0a9

SHA512
1c7411bea86550015b2600fb3e08daa54d9838b7b1cac2e95ebf447af9a43e1884596aa194edb2cd974b95b161a96b072c083006b1ddf5627f98e06452e0e29a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\index2[1].htm

Filesize
1KB

MD5
d6f1dcc79c1ba6f94042a5aa8eb68294

SHA1
934ede549222591e15bdd7568098073fc84f994d

SHA256
cfc7269770bf7bd090a9a698be783b176973b51fe27ca87e3485a77451e82074

SHA512
2f0f66434abd7780e69447ee373acbfc76af72d2cfb29d34390e31b414f42c56eb47734ac5315671a28534cddda5be0206121aaf1ac74d101b7023a515b50ddb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfD53D.tmp\Dialer.dll

Filesize
3KB

MD5
6e7e197ffa13cea15434b221b96b3202

SHA1
5fc93dca4a33d79d8601e888daa21a1d0e02eab3

SHA256
cb94aead070194af4d3b01f80ef85f227a70b5cfcfa305d26c3b42b8853ac6b4

SHA512
4d294929ba55e145027107aeef135d918f2d6ec4a7e3b9fc8fc028924019d1987c12202cf37e9adf18a70a02fb321de7f060c4977de874687fc8a4d924cfb19e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfD53D.tmp\ShellExecAsUser.dll

Filesize
43KB

MD5
552cba3c6c9987e01be178e1ee22d36b

SHA1
4c0ab0127453b0b53aeb27e407859bccb229ea1b

SHA256
1f17e4d5ffe7b2c9a396ee9932ac5198f0c050241e5f9ccd3a56e576613d8a29

SHA512
9bcf47b62ca8ffa578751008cae523d279cdb1699fd916754491899c31ace99f18007ed0e2cbe9902abf132d516259b5fb283379d2fead37c76b19e2e835e95a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfD53D.tmp\ioSpecial.ini

Filesize
1KB

MD5
bf7ea97ecfe751ab3f9b910b60008c79

SHA1
40741df9d4181fa0dc869577ac8ba488aa2842b8

SHA256
39b6644e6ff5727567e900bef575b2d9b2499f89a3ce6bbb96fc74735147961c

SHA512
7ab5ba4d23044cb73a446fc73ca2bb09d71c6f154ebe0bdcdf8edbf5b0282da62dfe0f918f675d751d01fa472a8ef78b051467ac5e8096c79913cc1131d1e24e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfD53D.tmp\ioSpecial.ini

Filesize
1KB

MD5
a268410ee39ded91918ac0c4ba95096f

SHA1
3b342b172846e0d74cee926e1e0346312487751b

SHA256
fe6f4970988dcbd6551a5fcf09fa7082d4c14a1aca7616777859612130b36fa1

SHA512
0caa1dfa41433080874a4f653ec67c9b7a4c3ea50449294c165d713f3e15518234eca26182b0f669b546a77b5e1b0ef8b4bfe815b39fd0c29120cd72b170e2d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfD53D.tmp\ioSpecial.ini

Filesize
1KB

MD5
2897ff52d86ce0a8790ce16f824a8c67

SHA1
cf2db4cd827cd5c5534d53a55a4bad355559dfbf

SHA256
77d39666348f124ad9530475b0d9aeb79ccd9dc9c8f42b8139e6670ef16b5b76

SHA512
aa3cb7d15f60c3aa7688f30ab1000ce8addb5bf31f864448e35b4c576ee89a96ad595d17a260bbddd29decb4cb277e484be9b5d6ad9de8daddceb4b20b0b0b94

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfD53D.tmp\modern-header.bmp

Filesize
31KB

MD5
e76a5505a53440c94705bbd6b81ee9da

SHA1
2e0fb8a3510d45418885d2a235a81d4d9726b19d

SHA256
d35892f125fc5b7af8eab35c5d92a02e310df2156f631a564598d04248f5d77f

SHA512
3965a6debd88afd921d7aa78685ce945aaf1bf4f1d0e615950b7dadb7a5543418d3fc95f344e71692d1ee967293e82365fc3953efb431ddefb27fbeddac5e1d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfD53D.tmp\modern-wizard.bmp

Filesize
190KB

MD5
df49e245eca7bb28691faf396c32b934

SHA1
1aaa48e74e8615fdcf24845f672e676acd47b88e

SHA256
b751fa1a1a2291ba1282d49936cd641c4e4340794f475294abd5e4817952a41e

SHA512
68aa752c5413eb36c3b1ed8a966cae9b3e3af266943c6482f5c5a18bb4cfb42f1c68f7c774eace0805ff277334437188bc0b5af20e96dc40502587d2798207e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh990A.tmp\InstallOptions.dll

Filesize
15KB

MD5
720304c57dcfa17751ed455b3bb9c10a

SHA1
59a1c3a746de10b8875229ff29006f1fd36b1e41

SHA256
6486029d3939231bd9f10457fd9a5ab2e44f30315af443197a3347df4e18c4e9

SHA512
c64c161290f5c21d642ecf16cc6ad3ee4a31bf5bab41c65c74907a5c158eaca429ef99cd8d2b55dc2ecb8478bb0b85c1576402389a07568f36c871b2772ead04

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh990A.tmp\LangDLL.dll

Filesize
5KB

MD5
f1e9eed02db3a822a7ddef0c724e5f1f

SHA1
65864992f5b6c79c5efbefb5b1354648a8a86709

SHA256
6dff504c6759c418c6635c9b25b8c91d0d9ef7787a3a93610d7670bb563c09df

SHA512
c22b64fff76b25cf53231b8636f07b361d95791c4646787ce7beac27ad6a0de88337dcceb25b5196f97c452dda72e2614647f51a8a18cb4d5228a82ed2e0780c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh990A.tmp\System.dll

Filesize
11KB

MD5
17ed1c86bd67e78ade4712be48a7d2bd

SHA1
1cc9fe86d6d6030b4dae45ecddce5907991c01a0

SHA256
bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

SHA512
0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh990A.tmp\UserInfo.dll

Filesize
4KB

MD5
1b446b36f5b4022d50ffdc0cf567b24a

SHA1
d9a0a99fe5ea3932cbd2774af285ddf35fcdd4f9

SHA256
2862c7bc7f11715cebdea003564a0d70bf42b73451e2b672110e1392ec392922

SHA512
04ab80568f6da5eef2bae47056391a5de4ba6aff15cf4a2d0a9cc807816bf565161731921c65fe5ff748d2b86d1661f6aa4311c65992350bd63a9f092019f1b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh990A.tmp\ioSpecial.ini

Filesize
826B

MD5
053e240642649c2ff3200ef7d25f5f23

SHA1
5a9c3e8e84f9059dae08095d59333b47956a257b

SHA256
692b2b88d672d65f03949e2a98a290218407bb769f7ef2ab51d6ceb610df2fb1

SHA512
ea19be000a8b96f789837d982eff4d7857fbc9fd46e6a3095353d6b4750dd38b5aa352a0ce3485cba51394cff8ac0662776d067c0418347c1f2a3c2be21c9267

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh990A.tmp\ioSpecial.ini

Filesize
1KB

MD5
73eb3414dd03a4ab2ae59e0f6fd6209e

SHA1
106ed61706545644d93a71bf3b4233347f224c7f

SHA256
b50b27cb99996e349fe66cfe9e09df713441cbd31409d0d014440cd32c9ee7ca

SHA512
dcc11d363c8e72189e45b217a62105e03ab4ea952d38d387bee6e421a5a7856f450d74f66ee2982f54fba44808266b5ff741f149782806a45efbd3b4ac32ba0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszB6CF.tmp\System.dll

Filesize
11KB

MD5
959ea64598b9a3e494c00e8fa793be7e

SHA1
40f284a3b92c2f04b1038def79579d4b3d066ee0

SHA256
03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b

SHA512
5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64

Download Submit
C:\Users\Admin\Desktop\AssertConvertTo.svg

Filesize
438KB

MD5
1cbf150f87af9bdf67d7342c26f01f8b

SHA1
bbfa1fce605a2e8baa65c93e3885fe2ac8092a1f

SHA256
17633009045abf438cc783bc892efd780af7777391dc8f8d7fc05791a78e15b5

SHA512
80157a1c36f33b32f205d5d65e5881936ebae15b66319d0364128bf7d9bb3c6d17aff5614c5fa26ff2fd2b9daf67d63ded378010862366868ec41b672435c473

Download Submit
C:\Users\Admin\Desktop\BackupStart.svg

Filesize
329KB

MD5
f94cb45cfefe8222d45b63a3d431e6d8

SHA1
db4734486a6e9a74a618d9c45f1a25154498557e

SHA256
68a66a917ce29e2229b6aec931b1f2b1d64ad8de2fe5c9b25bf706b65b4ae5f5

SHA512
66fa2d78ca4981b935e4679ff7098be515dcb459251cb9eef72dd2f91ddaae6b620cbab6c52a3c05f31c9f28b4cdfd3b56efd5d90b8453067f2ed95aa863213f

Download Submit
C:\Users\Admin\Desktop\CheckpointHide.M2TS

Filesize
282KB

MD5
39e8d1f100918f9e5a6065522f9cd9b1

SHA1
4821fffde3da0e265f01c2cef6b06c6117021c11

SHA256
96752edaa1b327442c8ac99d9ebb74c415de4cc75276bbe3dadf8223cfc48540

SHA512
12fcc27f3b51b6971bc0c6eb886260dcb72cca830b43ea7c64a948b3ac29930027bc53da20df52c0ff223aa06d74e98083ec48c1ad9cdf54192c11009cf503af

Download Submit
C:\Users\Admin\Desktop\ClearDismount.vsd

Filesize
517KB

MD5
e825a38839b15d636fb5f547c2da3870

SHA1
0a69d3b4a1c36da56bb9e1b49f138a5646b4743d

SHA256
99fb556191b6f4e8ab5a1cf464f5409426fa4d16726d5e98e8e47d182694ef27

SHA512
865d50a2163b506eef13f00a34ed2bd561b878680d0f5d97ca5fecc1016dfc2895179dbb1fe01935ac6c585a5f3642fef5bb5ffdfa99d27b862fa1ac041996b5

Download Submit
C:\Users\Admin\Desktop\ConvertExport.aiff

Filesize
485KB

MD5
fc1fa406e3fea12b79c5a57e7c829252

SHA1
54f49364fff27cb99ed2865153a2b0622e3f9bbf

SHA256
ba158837650159539a31950b71c94f7987aef2d67b413f6cb75911085c47ae01

SHA512
9bb35f1d24988a2021c1579a810c903b7a0ffad7f452c08574395e95a34b6695383bef258baecf10d582a97e8e75f83e19125a0d5340cf09b8e8b8e1305ba626

Download Submit
C:\Users\Admin\Desktop\ConvertToCompress.dwg

Filesize
266KB

MD5
073a3ad54e8a1a6be327e09f6642cb7c

SHA1
cdb3eebde17ebbba8992fb7f2d2595100fa3845c

SHA256
4d301191953ff42c3f0cd843dc4102e53cc3be7ef5c2357f6076b1aa03e5917d

SHA512
7032647bae1d4864cff2129c84cb32606199c1f3fe189217dc34ff6420a2da5c3047ef34a99678d3478523bce2ca71acfb4e67fbb875c1bfe7cb4e5245c7927e

Download Submit
C:\Users\Admin\Desktop\ExitRegister.7z

Filesize
626KB

MD5
71e41ea8ae953aba4b1827105778da83

SHA1
8dcd864e4905fff1d61298d353f095c0b353fa3d

SHA256
e9b5cb0e7ca903239b2cfc599692e5d3fec408a0b126ea69d2d4e30507bca371

SHA512
5bc7d39e5327f451588bd8f2ece9a2f06a94cd2fda35d842688be8abb1bde31066a6cedfdf39e911d0e6d48b43bb408a215200e0660abe4c4e32efe68261307a

Download Submit
C:\Users\Admin\Desktop\FormatRestore.emz

Filesize
219KB

MD5
96ff2ea11d4d4baa5a6186a69f2b278a

SHA1
ff1b14bf1f3b6910542e203bff9781a5e3da15e4

SHA256
b693b8b2b3f773d2d6da0a8c9ba35303ee66ca32d209b7112d21356077ecb3d3

SHA512
9656e1e41ec71ca4710ac025f89c352b38a96667dffa4a7445bc1dd753052c84256fe2fb45b64cef95df411941c200ec75e5b9a2df31cf47faf5827ae525291e

Download Submit
C:\Users\Admin\Desktop\GetBackup.7z

Filesize
407KB

MD5
95491b0332935ae8c2849cdf2c2469cc

SHA1
2116fe712116d02c75ae370ed52bc2388b8d3f6b

SHA256
7ff00b610607a58702ee2a15e53dd8dceff62b451c410da7a5f28f6d0e3dc428

SHA512
42b678c66386f4155f81013b7c580317a40b8702bd1883d7cd59cba800b09b2609b9cbb5a47161a189004a9b4d94094a2b1e12d6f351055281769ff3e8e30edc

Download Submit
C:\Users\Admin\Desktop\GrantUnpublish.vstx

Filesize
454KB

MD5
31ee05b9fc59b4bd55b7e6ac286cd4c9

SHA1
8ad1e47e492ae0d699abb5bc1c18be5cf3b8f181

SHA256
d9d71bd18c7e73779a677231f995be93a4a5199a0c5d6c972dadd5487079e3b2

SHA512
d87f956818fd8b3a7bacdeb031014ba058ec04321e072a99b9d313887e97d970e570303cecb3e3411ef76c93c5113ae370dc58cd8049e26a1c30243839596347

Download Submit
C:\Users\Admin\Desktop\InstallUnpublish.tiff

Filesize
548KB

MD5
efad67c776eb88927870899d3bbd8011

SHA1
5fa3611a071d3052911ca14724557fde030e7a45

SHA256
016256fb31d82a6ee72b846dfa217b1b58452a8f835484d8d48b2ec84341c18f

SHA512
864f47729996ca048a4cd81b8bfe26037be9309de6d45e6caecb780603d38008d1f2c6188533e17760dad847fe3c1b81652c1a4ec8e262182ab7a599fc267fec

Download Submit
C:\Users\Admin\Desktop\LimitUnprotect.csv

Filesize
344KB

MD5
04ab76875a220d615bed1c6b3a515fbe

SHA1
f066e4bef8ea558414f71263ea1c37de8d6ef256

SHA256
cde13fba25c00319f6e50339f064d37c29363addb5654b8299394be338fb8443

SHA512
86998c7f51efa75c30dd1e33b4ab38ed33d666cb984658290c6ff4f6191adb1ba14a325e35c0a41cff3cf017b20fbbe25c49a890f1457b2c976e2f31385039dd

Download Submit
C:\Users\Admin\Desktop\Microsoft Edge.lnk

Filesize
2KB

MD5
26e4046c65c036991451fa149075f27d

SHA1
8ecebf0d07a073a4da2225b2fbf4fccc978b9b33

SHA256
d4aa0265bc91ff4f42d77997a6f48ad73bc60ebc9c7ef005887d4417d2bd1152

SHA512
3d990436f49e0c216a5d04ed30ce6000a2590948845936f422b06fa78cdabc8a20736d20a91a9e3e5125355f4be9d2325115932d6c4842b2f04f4d7e16621a86

Download Submit
C:\Users\Admin\Desktop\MountConfirm.wma

Filesize
611KB

MD5
7efac9175a4a1719608dc7b36f08a992

SHA1
0169891d236c6e4dc2757d83d6c2979defce2e9a

SHA256
0d4eefc1b675a19a3808b90c5ac78cd8e7e7ca87ffa4822a2f1534ea33612bfb

SHA512
2cac09d430d2e6ee6ed65794f30d242c969392224968a0a2040ed50537812f079abc2ba0cc7769bb5726687eae0df538e3ee724e5c587bd29ca12334193a171f

Download Submit
C:\Users\Admin\Desktop\PopEnter.7z

Filesize
235KB

MD5
adde77a6fc4122cf6ed0a75794eed704

SHA1
1211bd64a402ed8050bcf35281e2171dd452b2fa

SHA256
5235dff215482288ff717dda42bc6ce0444b83db73d4fa1b37e4aa08789727fa

SHA512
d954304f1be633e77e1226b1888b093599bc88c0ae8fb0db2db1e902a3b7c8b833a9209b1972af2e28b9a49bc52137f7dd0d20c6f0ac2816dbbfe4d87cd389cd

Download Submit
C:\Users\Admin\Desktop\PublishLock.midi

Filesize
579KB

MD5
bd6cd4f85a4d2e85128fa80af2f2a96e

SHA1
c5ffea15f6c645d5cfcfab48ad2deb01a47d7029

SHA256
1fb6be114700cdcbb698f63fcdbd02536ebedb0780cfb1a990d10dd02c5c0ce4

SHA512
11861a21439e747ea8fc2b20c53c2dd40c26f2f0f55f48f780b0ac201dfa7157146cd5157394ce4131fb17e68f5d4d0bfe0debe8ca3faad5474cb233e27f202a

Download Submit
C:\Users\Admin\Desktop\PublishPing.xlt

Filesize
470KB

MD5
2cc406bf7f00242a2e01014c7a839544

SHA1
09c86a5db29a2f0d75daa756983b55a5b762b664

SHA256
533e7d3bd6aacf6bbebf2f7d957adfd48272a91af3801899fc7124c3f4254053

SHA512
81316f1dbb563c9bb2be47a14a5866df084b4a6758b1879167ac554c571e6da230cc8a65f4721d5fe52f2fe3707e24a7dd424334a9449a1e584ca4a803ab9c37

Download Submit
C:\Users\Admin\Desktop\ReadTrace.M2T

Filesize
391KB

MD5
678e5f181be3467bd026142ce00b42b7

SHA1
af57b0b28beb40a19f5e965e422ace1487f110d9

SHA256
42ee5c2583494fa568ab3fbc6d9c2d6713491da8675dd7b5572a14c5108402c6

SHA512
a3d41d5e8eddf96c504469709a796cec5f20604b91454c538329eba067c26ffab817c87c5c48ba5d69b4a50f77c3fb21df7642b129e1d3fc541acf928e72cdfa

Download Submit
C:\Users\Admin\Desktop\RemoveMove.css

Filesize
532KB

MD5
527182848e69916af5a69d4a0d72f08a

SHA1
a6b2e86bae04b5079e252ba8190f45f3529654c4

SHA256
e0be6cd6a2172753208ffaebdef2c312fab1284e06319d9c0cccd92627a6cbb4

SHA512
3b182b764a55a8a7db1aebdb2ddb758b2978d994e438a062171ebdf1710785f8a5ab48982a5090bba924fb7af91e83723f3a1b4bd246e76816c93d9d77732882

Download Submit
C:\Users\Admin\Desktop\ResetMerge.vdx

Filesize
501KB

MD5
5aee16f4b495cec0221dd12ec0ad088a

SHA1
41c7b1e7696814a86ca61aa7a87f4c9dbe466840

SHA256
b4730a8c3f57944b2e73b3b122fa8d82ab5f147d17a7c2a150cabcf0e07f228d

SHA512
ddf7111909bf1344bdb299d122e8b9bbe156d39fa14517bdd5597ef028096bba698a4d2e9be68cb076e199f3879607513ecd9799dd76c05f7b686e1c66aa27a4

Download Submit
C:\Users\Admin\Desktop\RestartUse.wmv

Filesize
564KB

MD5
48ed8f478918a504ad6c5e73a4d84af2

SHA1
cd9acf510a71ad0d14bb0f0379f5d58656727fd0

SHA256
dd4be91ebe81aa60c278151699bbe37844deb9b4e2611604f18945f95a44dd62

SHA512
788776981f648a0486ca2009145c2754ea64356358320e60d7e3dc3c2c0bfaad84b6c24b051e09326a26035f22944adb3b275cc14ed4f34b06784927ecae0460

Download Submit
C:\Users\Admin\Desktop\RestoreUnprotect.au

Filesize
376KB

MD5
c20f7e27a73dc5495f704e1530c0eb7f

SHA1
6f561cdaa7941b861520915c5be7cd8c13301727

SHA256
375c8ba30bbcf92ce103417d7887e4f2b5c34fd4f639e45397f29d9213d464ef

SHA512
cbcea124699d4ae02d8ea7b5dfed771dfb8497234ddaf44b3de2e80205c9b10f059ee2306cb3e20b1d40d49656edc50fdf15603e5f1514920603296b526d5ee9

Download Submit
C:\Users\Admin\Desktop\SearchSave.rar

Filesize
297KB

MD5
da6bd2b81b68b8560a54e4039f05ce99

SHA1
97c4d6ce3052a91a423f82c68b7757fdc823c556

SHA256
019500b6b9f38694425993a1f190331744ca9eef44068516c2bf228ce0ee6186

SHA512
5d903316fdd5104cc5e1092fcc31b6aef1e72e08cee04253dceafa0bf34922afddcf8e47c0dbfc687c7a4f2eac6cc1328c6b69a13102d1aff26f79873ef7b33c

Download Submit
C:\Users\Admin\Desktop\SetLock.mp4

Filesize
595KB

MD5
217d53451ff26592e86cb23425e18da6

SHA1
eecc9493928ecd4483df4c168c0931bd3b404ca7

SHA256
4c92c9a5d014681ec3a9f3cff4976a623f3f3c65a0fc38527446cba1fcd23be4

SHA512
76ce0596c80a923eceec07e28fb2e1e99c681b0472cab258c8be4a5fe306bed5a479d0c3e78c3f615c1f1961b6c63bc9f2217e1f78242fa6d3466d2827070b17

Download Submit
C:\Users\Admin\Desktop\StartExport.mpg

Filesize
423KB

MD5
d2894cc4e30fadb85a5712b5ea59d8e3

SHA1
1bc5df6dcb1c645e8f93570f1e4c3f5213b1f69a

SHA256
7df0252bd935b45977c7a6c331e03fef4325c52be3fe137df10fdd0e4320e040

SHA512
7a972dcc4c20ce5ca521f999206acce74657e9c67036019e6779e259e5e0d66ae4d549dfd5ce965693bdb5de2fa5ee66d4d7f88ca7d19697423b36c92c4c8df9

Download Submit
C:\Users\Admin\Desktop\StartHide.mpeg2

Filesize
360KB

MD5
e054f66f59fd98cfad61cc889d58d490

SHA1
2c0bbd78a6868676e9c5f614fe04b06f9c284c2e

SHA256
1f981208806101ed533abb078cbaafbd6f1dce034bc0ff9782be52161736a0e4

SHA512
3272ca63b2437b716d9efbf6c0592a9a55a57025dedc283edec1dfcd18aa47c13eddf60c3aaeb10b215c2695c6ec945ae6caac3af3d6420418aaccc47f0bef65

Download Submit
C:\Users\Admin\Desktop\SyncRestart.vstm

Filesize
313KB

MD5
7bf3fb683cc31657aa95e0cdc95a65a3

SHA1
9cc34c0ca593eef84cc686d106fa3539c4470ae1

SHA256
21ebab214a03f6bd56abd856616a9cf39ad9e59a0dc09af8ba5f08c048b40d5f

SHA512
18e07c57f4c7d19e6e91e3ba300197ad9ac527635076fffb5558d9eb57507a55446036522e549454deef8fea07cb407c606b53555bcbee7d4c76fed6c3b7b226

Download Submit
C:\Users\Admin\Desktop\WriteEnable.shtml

Filesize
250KB

MD5
966f5b46021c3fbd9bee586f8f8f9341

SHA1
49d018b53f678da9c38a89055850df3f12952cb6

SHA256
4714377c03af86c86f9bbe7bd02f1bc71b6e34c7ac01edceeba14879fa7e86b5

SHA512
f22d3a347b58106f1977cf201470deb7f7fb081735ffa1fe4675016a951548fbad62765ddcd366b603833fe844bd5aa2ce4acd8faa51be951a4aee336ca39ea5

Download Submit
C:\Users\Admin\Desktop\WriteUnpublish.rm

Filesize
861KB

MD5
8305f6f95252769f12d3d0081abf1b44

SHA1
43ab33108bc4dab30824358d4005c5b543b6ddea

SHA256
a91159bc29225cda5371c1e675103b365575e1c1f88c24d056c44ca6f6ed12c3

SHA512
ef5e0a9cce64fb7403a27d07dd33d6f3b74a9def744d39ac14520205268a1d7232b6d39eebacba3e75440d2b4f07183567e36a4c3ad5b74c76054fe5d8c70106

Download Submit
C:\Users\Admin\Downloads\bdcamsetup.exe

Filesize
31.5MB

MD5
afe8650dae3ff7c7bacd3981ed78c28a

SHA1
8caee90267e31a16f4ce2891617ef0974108036b

SHA256
f9281f52196c6769429a260a3a65a70bebfc679b2687ffca827d183efaee57d0

SHA512
ba6d6e427d30135f032047b0ec58b047e81c53b148cc7354765f67744b6bc2965f93c911b763aafc2d1e8349b725014a61d2b4418702c8d0085feaf6fa20dc9a

Download Submit
C:\Users\Public\Desktop\Acrobat Reader DC.lnk

Filesize
2KB

MD5
943ed92b63c97313a015f8ee64cd7da5

SHA1
85ca5d583c10ddc1f562f4f07ff937f8d81e0b7d

SHA256
76f4182ffc414282185da0c3d8f56f28279be677575939bf3f0b13fc8cedc3bd

SHA512
e4f3439da9ecdcd06579c162aff0bbef965c9dbd494ad185a0f37f8629f2c5e9020b04c20d52db82ce7ba5aeedbd04e139f14215f09b90f0af83c5e60231ed8c

Download Submit
C:\Users\Public\Desktop\Firefox.lnk

Filesize
1000B

MD5
05244d35f5ba512ef05e29d7cac3b1cf

SHA1
cf950bfe99694a5a10eb33751e21a3428a475420

SHA256
ce7afd9e16b2d8bdc7c8abc7b9de91518e6958fddfabeec0ba7401db4097bd55

SHA512
dce0af2d9857a310b3b3ef2cfad0f96ec042bd6fe6ab42619b93df3b2517aa9fd4ff149a26f56a945277f970e90e0b428361065f832029b65c7487b6afa1c2c7

Download Submit
C:\Users\Public\Desktop\Google Chrome.lnk

Filesize
2KB

MD5
a5fcd39c6abb106243ed77a7ef31f406

SHA1
f52010493b4be7b2a5ed1a8d108d7d06800b0fae

SHA256
b74be6199aaff0f8e146d2837fd499675e37832c5837eec094a4a6a826c9c02b

SHA512
bae1f9c3f901351736404065fe8282cec3f1728cf5d116fc53a3634e879d508297a5c46259b1619b576011eef3eb8560505de6f2d9fb281fbd643a02aff6c07c

Download Submit
C:\Users\Public\Desktop\VLC media player.lnk

Filesize
923B

MD5
796ff3a8238bc0efa4a80e382e7589b9

SHA1
9c18143b482d0be2b1a582eb575d7162285e15f6

SHA256
061c3e9e9132b7cf86a245154104e5f817304719cb54ee32e98c4b0edd0f44c5

SHA512
4c2b7380e3b1fce6c03686d4e154c27b4cc8f9375df4895659ceae1687d6c8557a1793e3b31a1213a8b4697cb00bfada35152b43401c477bc2434479b6f91b92

Download Submit
\??\pipe\crashpad_1844_PSDHXFUFRTYVRPWP

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/852-2291-0x00007FF7DAD70000-0x00007FF7DBAD2000-memory.dmp

Filesize
13.4MB

Download
memory/1148-2306-0x00007FF7DAD70000-0x00007FF7DBAD2000-memory.dmp

Filesize
13.4MB

Download
memory/1668-2180-0x00007FF7DAD70000-0x00007FF7DBAD2000-memory.dmp

Filesize
13.4MB

Download
memory/2704-2012-0x00007FF7DAD70000-0x00007FF7DBAD2000-memory.dmp

Filesize
13.4MB

Download
memory/5576-2261-0x00007FF7DAD70000-0x00007FF7DBAD2000-memory.dmp

Filesize
13.4MB

Download
memory/5680-1869-0x00007FF9A6930000-0x00007FF9A6932000-memory.dmp

Filesize
8KB

Download
memory/5680-1870-0x00007FF7DAD70000-0x00007FF7DBAD2000-memory.dmp

Filesize
13.4MB

Download