Malware Analysis Report

2024-09-11 03:26

Sample ID 240528-phw7cada8w
Target Setup.exe
SHA256 989c54ab290e147aba6de1e542eb71cdbc50179dffc190ca46031ce8f18a6c8b
Tags
xworm neshta ramnit banker evasion persistence rat spyware stealer trojan upx worm
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

989c54ab290e147aba6de1e542eb71cdbc50179dffc190ca46031ce8f18a6c8b

Threat Level: Known bad

The file Setup.exe was found to be: Known bad.

Malicious Activity Summary

xworm neshta ramnit banker evasion persistence rat spyware stealer trojan upx worm

Xworm family

UAC bypass

Neshta

Detect Neshta payload

Detect Xworm Payload

Ramnit

Xworm

Sets file execution options in registry

Drops startup file

Checks computer location settings

UPX packed file

Executes dropped EXE

Reads user/profile data of web browsers

Modifies system executable filetype association

Loads dropped DLL

Adds Run key to start application

Checks whether UAC is enabled

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Delays execution with timeout.exe

System policy modification

Suspicious use of WriteProcessMemory

Checks SCSI registry key(s)

Modifies data under HKEY_USERS

Modifies registry class

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies Internet Explorer settings

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Event Triggered Execution
T1546
Change Default File Association
T1546.001
Privilege Escalation
TA0004
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Event Triggered Execution
T1546
Change Default File Association
T1546.001
Defense Evasion
TA0005
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Impair Defenses
T1562
Disable or Modify Tools
T1562.001
Modify Registry
T1112
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Peripheral Device Discovery
T1120
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-05-28 12:20

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm family

xworm

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-28 12:20

Reported

2024-05-28 12:52

Platform

win10v2004-20240508-en

Max time kernel

1380s

Max time network

1170s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Setup.exe"

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Neshta

persistence spyware neshta

Ramnit

trojan spyware stealer worm banker ramnit

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\kynnlp.exe N/A

Xworm

trojan rat xworm

Sets file execution options in registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe C:\Users\Admin\AppData\Local\Temp\kynnlp.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kynnlp.exe" C:\Users\Admin\AppData\Local\Temp\kynnlp.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe C:\Users\Admin\AppData\Local\Temp\kynnlp.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kynnlp.exe" C:\Users\Admin\AppData\Local\Temp\kynnlp.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\lfylsr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\uhmwlh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\fgmogd.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\kybqsi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\kybqsiSrv.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\kynnlp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\kynnlp.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Java = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kynnlp.exe" C:\Users\Admin\AppData\Local\Temp\kynnlp.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\kynnlp.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~1.EXE C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Users\Admin\AppData\Local\Temp\kybqsiSrv.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~3.EXE C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13187~1.37\MICROS~1.EXE C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MI9C33~1.EXE C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Users\Admin\AppData\Local\Temp\kybqsiSrv.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~4.EXE C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\Program Files (x86)\Microsoft\pxAD1B.tmp C:\Users\Admin\AppData\Local\Temp\kybqsiSrv.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MIA062~1.EXE C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~2.EXE C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\SysWOW64\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\SysWOW64\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\SysWOW64\taskmgr.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\MINIE C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{F2622035-1CED-11EF-BCA5-527CD1CC5F27} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" C:\Program Files\Internet Explorer\iexplore.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133613725710985485" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1337824034-2731376981-3755436523-1000\{FB75BDDE-77BE-4FB5-A315-21D35BEF9575} C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lfylsr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\uhmwlh.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\kynnlp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\kynnlp.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3524 wrote to memory of 2788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 2788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 1500 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 1500 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 1500 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 1500 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 1500 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 1500 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 1500 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 1500 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 1500 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 1500 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 1500 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 1500 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 1500 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 1500 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 1500 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 1500 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 1500 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 1500 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 1500 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 1500 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 1500 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 1500 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 1500 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 1500 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 1500 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 1500 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 1500 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 1500 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 1500 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 1500 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 1500 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 2324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 2324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 3464 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 3464 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 3464 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 3464 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 3464 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 3464 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 3464 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 3464 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 3464 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 3464 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 3464 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 3464 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 3464 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 3464 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 3464 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 3464 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 3464 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 3464 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 3464 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 3464 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 3464 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 3464 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 3464 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 3464 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 3464 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 3464 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 3464 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 3464 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3524 wrote to memory of 3464 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\kynnlp.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\kynnlp.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\HideFastUserSwitching = "1" C:\Users\Admin\AppData\Local\Temp\kynnlp.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\Setup.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc04f7ab58,0x7ffc04f7ab68,0x7ffc04f7ab78

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1720 --field-trial-handle=1916,i,3124549695539785615,12749470774965522215,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1916,i,3124549695539785615,12749470774965522215,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2264 --field-trial-handle=1916,i,3124549695539785615,12749470774965522215,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2972 --field-trial-handle=1916,i,3124549695539785615,12749470774965522215,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2980 --field-trial-handle=1916,i,3124549695539785615,12749470774965522215,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3592 --field-trial-handle=1916,i,3124549695539785615,12749470774965522215,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4420 --field-trial-handle=1916,i,3124549695539785615,12749470774965522215,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4568 --field-trial-handle=1916,i,3124549695539785615,12749470774965522215,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4532 --field-trial-handle=1916,i,3124549695539785615,12749470774965522215,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4736 --field-trial-handle=1916,i,3124549695539785615,12749470774965522215,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4872 --field-trial-handle=1916,i,3124549695539785615,12749470774965522215,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4868 --field-trial-handle=1916,i,3124549695539785615,12749470774965522215,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4056 --field-trial-handle=1916,i,3124549695539785615,12749470774965522215,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4196 --field-trial-handle=1916,i,3124549695539785615,12749470774965522215,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 --field-trial-handle=1916,i,3124549695539785615,12749470774965522215,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 --field-trial-handle=1916,i,3124549695539785615,12749470774965522215,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4604 --field-trial-handle=1916,i,3124549695539785615,12749470774965522215,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4272 --field-trial-handle=1916,i,3124549695539785615,12749470774965522215,131072 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\lfylsr.exe

"C:\Users\Admin\AppData\Local\Temp\lfylsr.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=4316 --field-trial-handle=1916,i,3124549695539785615,12749470774965522215,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=4744 --field-trial-handle=1916,i,3124549695539785615,12749470774965522215,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=4824 --field-trial-handle=1916,i,3124549695539785615,12749470774965522215,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=4776 --field-trial-handle=1916,i,3124549695539785615,12749470774965522215,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5336 --field-trial-handle=1916,i,3124549695539785615,12749470774965522215,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 --field-trial-handle=1916,i,3124549695539785615,12749470774965522215,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 --field-trial-handle=1916,i,3124549695539785615,12749470774965522215,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5704 --field-trial-handle=1916,i,3124549695539785615,12749470774965522215,131072 /prefetch:8

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x308 0x2f4

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5732 --field-trial-handle=1916,i,3124549695539785615,12749470774965522215,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xdc,0x100,0x104,0x48,0x108,0x7ffc04f7ab58,0x7ffc04f7ab68,0x7ffc04f7ab78

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1772 --field-trial-handle=2044,i,18054986930811227132,6327507184116215613,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2000 --field-trial-handle=2044,i,18054986930811227132,6327507184116215613,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2196 --field-trial-handle=2044,i,18054986930811227132,6327507184116215613,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3080 --field-trial-handle=2044,i,18054986930811227132,6327507184116215613,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3088 --field-trial-handle=2044,i,18054986930811227132,6327507184116215613,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4360 --field-trial-handle=2044,i,18054986930811227132,6327507184116215613,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4520 --field-trial-handle=2044,i,18054986930811227132,6327507184116215613,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4668 --field-trial-handle=2044,i,18054986930811227132,6327507184116215613,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4572 --field-trial-handle=2044,i,18054986930811227132,6327507184116215613,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4504 --field-trial-handle=2044,i,18054986930811227132,6327507184116215613,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4900 --field-trial-handle=2044,i,18054986930811227132,6327507184116215613,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --reenable-autoupdates --system-level

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff79aaeae48,0x7ff79aaeae58,0x7ff79aaeae68

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5024 --field-trial-handle=2044,i,18054986930811227132,6327507184116215613,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3452 --field-trial-handle=2044,i,18054986930811227132,6327507184116215613,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4092 --field-trial-handle=2044,i,18054986930811227132,6327507184116215613,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4688 --field-trial-handle=2044,i,18054986930811227132,6327507184116215613,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4236 --field-trial-handle=2044,i,18054986930811227132,6327507184116215613,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4356 --field-trial-handle=2044,i,18054986930811227132,6327507184116215613,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4300 --field-trial-handle=2044,i,18054986930811227132,6327507184116215613,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=4476 --field-trial-handle=2044,i,18054986930811227132,6327507184116215613,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5244 --field-trial-handle=2044,i,18054986930811227132,6327507184116215613,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4356 --field-trial-handle=2044,i,18054986930811227132,6327507184116215613,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=5572 --field-trial-handle=2044,i,18054986930811227132,6327507184116215613,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 --field-trial-handle=2044,i,18054986930811227132,6327507184116215613,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=2044,i,18054986930811227132,6327507184116215613,131072 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\uhmwlh.exe

"C:\Users\Admin\AppData\Local\Temp\uhmwlh.exe"

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE

"C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\fgmogd.EXE

"C:\Users\Admin\AppData\Local\Temp\3582-490\fgmogd.EXE"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\system32\taskmgr.exe" /4

C:\Windows\SysWOW64\taskmgr.exe

C:\Windows\system32\taskmgr.exe /4

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\kybqsi.exe"

C:\Users\Admin\AppData\Local\Temp\kybqsi.exe

C:\Users\Admin\AppData\Local\Temp\kybqsi.exe

C:\Users\Admin\AppData\Local\Temp\kybqsiSrv.exe

C:\Users\Admin\AppData\Local\Temp\kybqsiSrv.exe

C:\Program Files (x86)\Microsoft\DesktopLayer.exe

"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5192 CREDAT:17410 /prefetch:2

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\kynnlp.exe"

C:\Users\Admin\AppData\Local\Temp\kynnlp.exe

C:\Users\Admin\AppData\Local\Temp\kynnlp.exe

C:\Users\Admin\AppData\Local\Temp\kynnlp.exe

C:\Users\Admin\AppData\Local\Temp\kynnlp.exe explorer.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpA764.tmp.bat""

C:\Windows\system32\timeout.exe

timeout 3

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
NL 23.62.61.155:443 www.bing.com tcp
US 8.8.8.8:53 0.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 155.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
FR 172.217.20.196:443 www.google.com udp
FR 172.217.20.196:443 www.google.com tcp
US 8.8.8.8:53 131.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 74.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 196.20.217.172.in-addr.arpa udp
US 8.8.8.8:53 163.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
FR 172.217.20.174:443 play.google.com udp
FR 172.217.20.174:443 play.google.com tcp
US 8.8.8.8:53 174.20.217.172.in-addr.arpa udp
US 8.8.8.8:53 clients2.google.com udp
FR 216.58.213.78:443 clients2.google.com udp
FR 216.58.213.78:443 clients2.google.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 78.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 kitchen-minds.gl.at.ply.gg udp
US 147.185.221.19:65129 kitchen-minds.gl.at.ply.gg tcp
US 8.8.8.8:53 19.221.185.147.in-addr.arpa udp
US 147.185.221.19:65129 kitchen-minds.gl.at.ply.gg tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 67.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 i.ytimg.com udp
FR 216.58.214.86:443 i.ytimg.com tcp
FR 216.58.214.86:443 i.ytimg.com tcp
FR 216.58.214.86:443 i.ytimg.com tcp
US 8.8.8.8:53 www.youtube.com udp
FR 142.250.178.142:443 www.youtube.com tcp
US 8.8.8.8:53 86.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 66.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 66.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 142.178.250.142.in-addr.arpa udp
FR 216.58.214.86:443 i.ytimg.com udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
FR 142.250.178.130:443 googleads.g.doubleclick.net tcp
US 8.8.8.8:53 static.doubleclick.net udp
FR 142.250.75.230:443 static.doubleclick.net tcp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
FR 172.217.20.170:443 jnn-pa.googleapis.com tcp
FR 142.250.178.130:443 googleads.g.doubleclick.net udp
FR 172.217.20.170:443 jnn-pa.googleapis.com udp
US 8.8.8.8:53 130.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 230.75.250.142.in-addr.arpa udp
US 8.8.8.8:53 170.20.217.172.in-addr.arpa udp
US 8.8.8.8:53 poki.com udp
US 104.18.144.9:443 poki.com tcp
US 104.18.144.9:443 poki.com tcp
US 8.8.8.8:53 img.poki.com udp
US 8.8.8.8:53 a.poki.com udp
US 104.18.144.9:443 a.poki.com tcp
US 104.18.143.9:443 a.poki.com udp
US 104.18.144.9:443 a.poki.com udp
US 8.8.8.8:53 9.144.18.104.in-addr.arpa udp
US 8.8.8.8:53 9.143.18.104.in-addr.arpa udp
US 104.18.143.9:443 a.poki.com udp
US 8.8.8.8:53 t.poki.io udp
US 34.120.56.101:443 t.poki.io tcp
US 34.120.56.101:443 t.poki.io tcp
US 34.120.56.101:443 t.poki.io tcp
US 8.8.8.8:53 v.poki.com udp
US 8.8.8.8:53 101.56.120.34.in-addr.arpa udp
US 34.120.56.101:443 t.poki.io udp
US 8.8.8.8:53 api.poki.com udp
US 104.18.143.9:443 api.poki.com tcp
US 104.18.143.9:443 api.poki.com tcp
US 8.8.8.8:53 game-cdn.poki.com udp
US 8.8.8.8:53 games.poki.com udp
US 104.18.144.9:443 games.poki.com udp
US 8.8.8.8:53 a8ff451f-35dc-411a-bb28-d41dd5becc91.poki-gdn.com udp
US 172.64.145.186:443 a8ff451f-35dc-411a-bb28-d41dd5becc91.poki-gdn.com tcp
US 8.8.8.8:53 securepubads.g.doubleclick.net udp
US 8.8.8.8:53 imasdk.googleapis.com udp
FR 142.250.201.162:443 securepubads.g.doubleclick.net tcp
FR 142.250.178.138:443 imasdk.googleapis.com tcp
US 172.64.145.186:443 a8ff451f-35dc-411a-bb28-d41dd5becc91.poki-gdn.com udp
US 8.8.8.8:53 devs-api.poki.com udp
FR 142.250.201.162:443 securepubads.g.doubleclick.net udp
FR 142.250.201.162:443 securepubads.g.doubleclick.net udp
FR 142.250.178.138:443 imasdk.googleapis.com udp
US 8.8.8.8:53 s0.2mdn.net udp
US 8.8.8.8:53 464066f3816586406c5b81a0381bc3f4.safeframe.googlesyndication.com udp
FR 216.58.214.161:443 464066f3816586406c5b81a0381bc3f4.safeframe.googlesyndication.com tcp
US 8.8.8.8:53 186.145.64.172.in-addr.arpa udp
US 8.8.8.8:53 162.201.250.142.in-addr.arpa udp
US 8.8.8.8:53 138.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 98.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 tpc.googlesyndication.com udp
FR 142.250.179.97:443 tpc.googlesyndication.com tcp
FR 142.250.179.97:443 tpc.googlesyndication.com udp
FR 172.217.20.196:443 www.google.com udp
US 8.8.8.8:53 ads.superawesome.tv udp
IE 54.229.199.182:443 ads.superawesome.tv tcp
US 8.8.8.8:53 eu-west-1-ads.superawesome.tv udp
US 8.8.8.8:53 161.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 97.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 182.199.229.54.in-addr.arpa udp
FR 142.250.178.130:443 googleads.g.doubleclick.net udp
FR 142.250.178.130:443 googleads.g.doubleclick.net udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
FR 216.58.215.35:443 beacons.gcp.gvt2.com tcp
US 8.8.8.8:53 35.215.58.216.in-addr.arpa udp
FR 216.58.215.35:443 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 beacons4.gvt2.com udp
US 216.239.32.116:443 beacons4.gvt2.com tcp
US 216.239.32.116:443 beacons4.gvt2.com udp
US 8.8.8.8:53 perf-events.cloud.unity3d.com udp
US 35.190.78.8:443 perf-events.cloud.unity3d.com tcp
US 8.8.8.8:53 config.uca.cloud.unity3d.com udp
US 34.111.113.40:443 config.uca.cloud.unity3d.com tcp
US 8.8.8.8:53 116.32.239.216.in-addr.arpa udp
US 8.8.8.8:53 8.78.190.35.in-addr.arpa udp
US 34.111.113.40:443 config.uca.cloud.unity3d.com udp
US 35.190.78.8:443 perf-events.cloud.unity3d.com udp
US 8.8.8.8:53 cdp.cloud.unity3d.com udp
US 34.107.172.168:443 cdp.cloud.unity3d.com tcp
US 34.107.172.168:443 cdp.cloud.unity3d.com udp
US 8.8.8.8:53 168.172.107.34.in-addr.arpa udp
US 8.8.8.8:53 40.113.111.34.in-addr.arpa udp
US 147.185.221.19:65129 kitchen-minds.gl.at.ply.gg tcp
US 147.185.221.19:65129 kitchen-minds.gl.at.ply.gg tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 34.120.56.101:443 t.poki.io udp
FR 172.217.20.196:443 www.google.com udp
FR 172.217.20.196:443 www.google.com tcp
FR 172.217.20.174:443 www.youtube.com udp
FR 172.217.20.174:443 www.youtube.com tcp
US 8.8.8.8:53 clients2.google.com udp
FR 216.58.213.78:443 clients2.google.com udp
FR 216.58.213.78:443 clients2.google.com tcp
US 8.8.8.8:53 id.google.com udp
FR 216.58.214.86:443 i.ytimg.com udp
FR 216.58.214.86:443 i.ytimg.com tcp
US 8.8.8.8:53 226.75.250.142.in-addr.arpa udp
FR 142.250.178.130:443 googleads.g.doubleclick.net udp
FR 172.217.20.170:443 jnn-pa.googleapis.com udp
FR 142.250.178.130:443 googleads.g.doubleclick.net tcp
FR 172.217.20.170:443 jnn-pa.googleapis.com tcp
US 104.18.144.9:443 devs-api.poki.com udp
US 104.18.143.9:443 devs-api.poki.com udp
US 34.120.56.101:443 t.poki.io udp
US 104.18.144.9:443 devs-api.poki.com udp
US 8.8.8.8:53 4d0c7f52-b6c3-4873-92b4-79b2d482b3cd.poki-gdn.com udp
US 104.18.42.70:443 4d0c7f52-b6c3-4873-92b4-79b2d482b3cd.poki-gdn.com tcp
US 104.18.42.70:443 4d0c7f52-b6c3-4873-92b4-79b2d482b3cd.poki-gdn.com udp
FR 142.250.201.162:443 securepubads.g.doubleclick.net udp
FR 142.250.201.162:443 securepubads.g.doubleclick.net tcp
FR 142.250.201.162:443 securepubads.g.doubleclick.net udp
US 8.8.8.8:53 6237ddfa4b49281beaf6c950a4fa5ce5.safeframe.googlesyndication.com udp
FR 216.58.214.161:443 6237ddfa4b49281beaf6c950a4fa5ce5.safeframe.googlesyndication.com tcp
FR 142.250.201.162:443 securepubads.g.doubleclick.net tcp
US 8.8.8.8:53 70.42.18.104.in-addr.arpa udp
US 8.8.8.8:53 ads.superawesome.tv udp
IE 63.34.43.25:443 ads.superawesome.tv tcp
US 8.8.8.8:53 eu-west-1-ads.superawesome.tv udp
US 8.8.8.8:53 25.43.34.63.in-addr.arpa udp
FR 142.250.178.130:443 googleads.g.doubleclick.net udp
FR 142.250.179.97:443 tpc.googlesyndication.com udp
FR 142.250.179.97:443 tpc.googlesyndication.com tcp
US 34.120.56.101:443 t.poki.io udp
US 34.120.56.101:443 t.poki.io tcp
FR 216.58.215.35:443 beacons.gcp.gvt2.com udp
FR 216.58.215.35:443 beacons.gcp.gvt2.com tcp
US 8.8.8.8:53 84.65.42.20.in-addr.arpa udp
US 34.120.56.101:443 t.poki.io udp
FR 216.58.215.35:443 beacons.gcp.gvt2.com udp
FR 142.250.201.162:443 securepubads.g.doubleclick.net udp
FR 142.250.201.162:443 securepubads.g.doubleclick.net udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
FR 172.217.20.194:443 googleads.g.doubleclick.net udp
FR 172.217.20.194:443 googleads.g.doubleclick.net udp
US 8.8.8.8:53 194.20.217.172.in-addr.arpa udp
FR 142.250.179.97:443 tpc.googlesyndication.com udp
US 104.18.143.9:443 devs-api.poki.com udp
US 8.8.8.8:53 csi.gstatic.com udp
US 142.250.72.67:443 csi.gstatic.com tcp
US 142.250.72.67:443 csi.gstatic.com tcp
US 8.8.8.8:53 pubads.g.doubleclick.net udp
FR 142.250.178.130:443 pubads.g.doubleclick.net tcp
US 34.120.56.101:443 t.poki.io udp
US 142.250.72.67:443 csi.gstatic.com udp
US 8.8.8.8:53 67.72.250.142.in-addr.arpa udp
US 147.185.221.19:65129 kitchen-minds.gl.at.ply.gg tcp
US 8.8.8.8:53 api.bing.com udp
US 147.185.221.19:65129 kitchen-minds.gl.at.ply.gg tcp
US 147.185.221.19:65129 kitchen-minds.gl.at.ply.gg tcp
US 147.185.221.19:65129 kitchen-minds.gl.at.ply.gg tcp

Files

memory/4608-1-0x00000000003C0000-0x00000000003E8000-memory.dmp

memory/4608-0-0x00007FFC0ADF3000-0x00007FFC0ADF5000-memory.dmp

memory/4608-6-0x00007FFC0ADF0000-0x00007FFC0B8B1000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 7ec1656c2e2bfc5ee6ccaa23f21cc03b
SHA1 e77472393ec274acd12f1af33748f6769858af51
SHA256 01451f05acb5525724b59e2454f973a4dec2f02db6bc35ea9b81066d7ad709d0
SHA512 880a623fb7fbb13c9725099d5bb8978722767980300cebdeddc28a13bf05fba45c360399c25cdbe088d56bcab3a624692bd5ca7288878df36bff911d438108a8

\??\pipe\crashpad_3524_GIUNYKDCTEWGZBRY

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 fa0e802b172678e72ce793a6f0496734
SHA1 ffe96b9ee29a29b59f3bed7441d1b5a96fc174fd
SHA256 41404fad7ca78bed3f479d773af1b6cd6b6186cb654da3682d61b5d077e488f7
SHA512 36b60fa6d159b7c5f335559875c8b783dbc99a0a55ccc91199a4700b92da2cea5e0a10edec19f345f2c635061cd27ee1565e0927aa15d4f85538a198f2ff1c82

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ce8da7f4-d5cb-4b61-9e57-720a3710d4f9.tmp

MD5 787b5421f8f52a50aaef8a1db00d6394
SHA1 06d0cfcf70a0603f6ecaefb5f05081d791270069
SHA256 197d19f72c18d132c3161e95cf16aa3e7b50081146fbd429a7d66eb9d2e83b3d
SHA512 1748635db62fc1c7267a7a2ac43f08360b07ca68dc93cbadf4c3b45b4f1a47308dbf5b28045b006e6b3c9a616ef0d0b32850f8c7f101bc8394edcbb81b68f22b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 4e506bf940910b06580ea2564c2eca32
SHA1 8c2f8eee593cbfff068d2c1b13363d8c15551bb2
SHA256 5588e473a44125d6195fc62b80521b7abad638d1c85576e7848bf13888acbf22
SHA512 d56830f7e1d84a86ab1f998f2be8f4266cd86904e5f807fe78bad0129df821eb554f8f284108810cb9d63831bbaffc38b1c630fff46b5b44951cb46545d1ab8c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 982ad719450312039a4ddcaf4e8fada9
SHA1 912fcceb478bf4f6c8799966a0f8e95b0c4fc1d7
SHA256 febfdce32d07f3dbe7eea1674e3f842ffa9a896358f722feba229ac9a54f8cf1
SHA512 7dbc91e5901ce60af3f505be34af7d230164080452950743d4c15f2a0310cbfe82dfba78ef42682eb1c010008f03914eaad3b862d71d6972addbb80592b04aad

memory/4608-77-0x00007FFC0ADF3000-0x00007FFC0ADF5000-memory.dmp

memory/4608-78-0x00007FFC0ADF0000-0x00007FFC0B8B1000-memory.dmp

memory/4608-79-0x000000001AFA0000-0x000000001AFAC000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 ae1bccd6831ebfe5ad03b482ee266e4f
SHA1 01f4179f48f1af383b275d7ee338dd160b6f558a
SHA256 1b11047e738f76c94c9d15ee981ec46b286a54def1a7852ca1ade7f908988649
SHA512 baf7ff6747f30e542c254f46a9678b9dbf42312933962c391b79eca6fcb615e4ba9283c00f554d6021e594f18c087899bc9b5362c41c0d6f862bba7fb9f83038

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe57d736.TMP

MD5 8b2b6c231723a5d43481aa056690c6ed
SHA1 2f15252b4ef6fd86712c51319ad86a3fbe1b07f1
SHA256 8c9a146556488890ff41efb9711fc5d684c723c0658b4b08e9650770b8db7921
SHA512 f14979d6ac1bc0912772b203510a8b677dd8851947fdaa362e94d105b20706d5263810b3e5ee74ad7ed0eed16dcfe7da08a17319758011b3d356e45f346dcb5f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 2292288d1da6f3d425f519ab493787e5
SHA1 8425662816df7caa862a3217ea6d61c7a5b3670c
SHA256 80c5ee627171db6a04b84dabd46437170f6425b6deba30d08e3a23c482f46cce
SHA512 87a5920dc1b494724d804dd52d0b219909a59f311e004e5c3af956ba04e0b291cafac502cf70565189bcc6415d47a584c8ee1c28a302993e78c2a38502a43a21

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 1fd02c688f7186f0a6b7baf0c4044bfb
SHA1 e10695fedc74450d5f2afb1774695c5ff7446369
SHA256 6dde69926f4bf00946ff55c6e59f06b010961267ec6435dc56f440d866349d2c
SHA512 34ac7c8695f1935e436e52c8e61507901593ff6b414066c1abda55d36bfa2317db1c5722df775c1ed5269548fab882b1852f1cb8bc3c6b3ca8e1435800347673

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5 d878f42df971f77298f2ad7c56f4250c
SHA1 763fc0e1f3ea0df930da85a2564245e9a5a3402a
SHA256 f337877acede8e1ab8f9a641e5c7ef9fdce201ece38afd7496319da45739458c
SHA512 53edd6f6d20541379da8ab36ee915e9b01a766ac5e655d0461eed2c5f07fe2624371e747d525f27fe3bedaae573a05a12030229c654421b21653c981ef71f9e2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5806c1.TMP

MD5 a70033ba4f8ee134321151e34d3b1b5c
SHA1 887f99ef69a11b3907eb46d748abb7e15a5f93a8
SHA256 a1e5b03b6ae85e18c923a0265ce02c9cd85aa8bb4932c1ca59e65d494155dbca
SHA512 d13155bc5834e35351f872552f12f05baa9a4294cb3390903e018da0a0d31eeef8baaf37bdd434962cc9d8f6c718c793a2b14d9e2eb02b14b7e552dfa2e5df91

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 b7dccf17d82c8199d85d98d44e779c90
SHA1 a49eb959d54ead0cf21acb714cfcae8e8de323b3
SHA256 061b55e7d95acd3cda4ae1b8ece6e8553f1231d7c4eba3d73c9e91d101d9f7c0
SHA512 58ff0cdf026e138cd203f1c00f0dec3cca22ddd627a47070f96c017dac7cc6e0974b03603069852b4a9b0769a6c4030276b09a7deb68614c2ec0da4196bd778a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 b4da1f5ddad62437c77b3c97de4abea6
SHA1 fbdac20db44d5496a73817f3dabdc059d97b0f42
SHA256 81e65fef37fda50f9c6ecd26a6a253b9813f1757f86b73c2a2665a2d2133dfe2
SHA512 12e4294e3e763462ac7e7fbe3f280aebddb678f6a69e48a4b931547f648a9dceb33952061abf27d4483333f2027c230cbe5d588035de0aee2118e5bf1b948481

C:\Users\Admin\AppData\Local\Temp\lfylsr.exe

MD5 464d1821f7a15ad61364180aa38bf33b
SHA1 941ef8750a84b4cdfe1b5f9aefb862aa95276515
SHA256 cfb20098a65630d4488e23032169ea4564f92deeac6638a7607c19333e44dd65
SHA512 96cc0daa0dab9aed1c6f51c9033ae21e8c26f83002a8d77428e13b6cdee05968447c2fb2b76bcbaa984c8f87be03561c08d915fd7335ddcfeedb769e8a20acc0

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_a8ff451f-35dc-411a-bb28-d41dd5becc91.poki-gdn.com_0.indexeddb.leveldb\MANIFEST-000001

MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_a8ff451f-35dc-411a-bb28-d41dd5becc91.poki-gdn.com_0.indexeddb.leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 91d323fef58423a2cd2571a7af48ed74
SHA1 cac24ecc401fc7dbccd64570ad40830bda143b4b
SHA256 a0cf4487556a2a8d4b4cb371f284e7af3d554632178122e30237860b268b10a3
SHA512 d00d6d32b37b5260ec903eb44f03d960c2c6e4efbc05b18c2dada30739982e07968fc137deb1463aa2bdd6990f603b930cf7be145efd84f497d7bf8ed553d6d2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 f81883459f34f3bc71077610ca763b92
SHA1 ce13d8a8105b3a993e2813a4e5141a6eac0f0388
SHA256 20fd481aa64afb8ecbcd3bf72e3fc986427dda23c99f08444fcedbb17f375b5f
SHA512 bb42d14a12e6c42b95f2bf362cd96c603fba48c123a6540750ae6a714b15fcebf5dc1604e6fc567d40d53fefac43d05efaeb5e651778e679dd26aa17d4070fad

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\blob_storage\95393c2d-3e27-46f0-9f9e-a182dbb17395\0

MD5 eb04f66b920e8f93ac1e41988cb13db8
SHA1 abcb99fd2fdc1c0c7dd10c6599f8cc0fcb65c4db
SHA256 b75ebc89099b3e107b51652f9badeca4bf92a0c72ff4928bb8f96ac4d6be3757
SHA512 b315304ba08513b23fdaad8742685267464035e9af4cba8115c9783648b13d67cd154f7051e06b56e92395511cad258869662d6eb1115877bc9f16647a5fcb1a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5 ab29f0d9e8a479915e3bd4c61bcf1b24
SHA1 a3288ea008c287242bc2301091a4098bf59691bc
SHA256 3685b0c80e84401e654a5a2a180785c9a2355cef13c94e7c6cf572267ee36ab1
SHA512 32ec4b8da763178020a23d6eedd739a6f22db43eb098418190b4ae1b11c7375f621ba575cc9dcca69b88e6e33f7a204bd971ba21070f8f83d14ce97a06bdfeca

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 ae45a922d8e1c710f9d432a47de4a70f
SHA1 68fa2469a1456e16ea2251860071d737e272d7cd
SHA256 8ecd23826c919a3a4d7b2fe1b89e5f31e7bff96fd8e291c2d660b701419197b6
SHA512 1bd6316458bb554d04d65c9c3b2fe58c19c119578f37e066fe12550ee20dfb520c69ba3bbe595c934714d3c2a4640af0f29e656d313518a57f015ccc81b6c671

memory/4608-472-0x000000001AFD0000-0x000000001AFDA000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\ab82755ea28dfe93492befa9e736eba54dcf5453\02299fe3-0882-472a-9369-0accd4a52f23\index-dir\the-real-index

MD5 8727e45d56f96e92ccea19c7dafa3452
SHA1 e326db2c334b7055babfc39564d45369db5f8ccf
SHA256 9e6c2683af3a725511686cbe7df3e2e3b659f009a8047c8a3f95f33e8d59a93b
SHA512 5eeefbcdd26d14e3b186712e4ae5e689105c3684812c2c84a8ac648122fd9d7f428c48996fa5e3bb4abf155173d65647ced53754e6c68b5595b061f3acf1db58

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\ab82755ea28dfe93492befa9e736eba54dcf5453\02299fe3-0882-472a-9369-0accd4a52f23\index-dir\the-real-index~RFe591572.TMP

MD5 0710895bde54eec8dbb808161293d0b7
SHA1 5e1c5be966d149a8330d68c2838bdd83d79c287b
SHA256 c1812409b64ed8c288aef21cb87b430564cc329b800ef45f55146009ca1899a1
SHA512 4d972e7bf8ca58eb626ebd5d28384153ca05233329528a242c681a3b9bec7cd2f15f6b2049bc327032b4ff6a22e24cda19f76e0bd8aaf9244dd1316c10372b85

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\ab82755ea28dfe93492befa9e736eba54dcf5453\index.txt

MD5 82beac7e4fa13f0af9b0b2ff1f307519
SHA1 fb031774227434c5b6136be0225e40a233bf9761
SHA256 127fe2a20bc396d479ba70f966b94d34e134f379487b1cad11c8ae2f1a504303
SHA512 68f933b388034f652a53cec75bc081fad2b9275dd9278fff89ea1aa3553ffbb8b2adbba20f11d4971e7466a0a61369e65a65f70b125688470420dc47e7bfcacb

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\ab82755ea28dfe93492befa9e736eba54dcf5453\index.txt~RFe5915b1.TMP

MD5 db42fc6a7376b25911f37fe33c1793f6
SHA1 758d713644e3a11a9d4edda7d5c812a6d3a1eb5f
SHA256 c3d9fc364ab7f5a78e33d0099d421e8e81776603d10bf2a21cc587e9580df347
SHA512 56b1b0c838f682704680b69b4aa724102b6011751ab50acdfb7996ac959bcd7d981069c3a259a80193744a817f24c1504a01eb1bb809ebdd51c5942c03504090

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 21aa0c643fb473050e782ce0de14b40c
SHA1 0c82b055e88fa71ce768f8be94f28c82e65bb632
SHA256 9d36b61cc2bc7328f94098ffccf563f756d1bf1723e5a2d497a2751c47cedc9d
SHA512 e78de95d123ffc33192ccd6c487c1cc7000f869525b476f0e570ced671be31d49b90e06b63d0c494d93c24b5058b37e00c788feacdf9a2431afe5158d6f94719

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma

MD5 bde61e9e0ab1e5eb5f149d295dd3b71e
SHA1 2bd91e7ffb23a7a711e7fe127624e0dbe5785b8b
SHA256 ce0b463f08bb5aa4a83bb736f453980aa6bb7f8abf64672d8dc6cbbec3cbc6e4
SHA512 0e2aeb4e0f8270fac41d1661264cb8b5953a6301f84363486f141624946a306119dbe802e9bb9ca4a11eade288da227b6c3c1f8f31c217e98f547e9717603647

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

MD5 757f9692a70d6d6f226ba652bbcffe53
SHA1 771e76fc92d2bf676b3c8e3459ab1a2a1257ff5b
SHA256 d0c09cff1833071e93cda9a4b8141a154dba5964db2c6d773ea98625860d13ad
SHA512 79580dd7eb264967e0f97d0676ba2fcf0c99943681cad40e657e8e246df1b956f6daeb4585c5913ca3a93fdfd768933730a9a97a9018efa33c829ab1dea7a150

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

MD5 009b9a2ee7afbf6dd0b9617fc8f8ecba
SHA1 c97ed0652e731fc412e3b7bdfca2994b7cc206a7
SHA256 de607a2c68f52e15a104ead9ecbaa3e6862fdb11eac080e408ba4d69f1f7a915
SHA512 6161dd952ae140a8fb8aa5e33f06bc65fdc15ce3fbfe4c576dc2668c86bce4a1d5c1112caee014e5efa3698547faad3bc80ec253eedb43148e36e1a02ce89910

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1

MD5 d1796b94a5576e02a746ad60e5e6c805
SHA1 dd41c1ebfed4521fc883431b8e25ea7aedf624b8
SHA256 41ce653092789d2faf8dcd6900a2cc0d364caad0156f3f2e6913fdacc249baeb
SHA512 fed9e92c856d82ea9d6bc4435e67792360e06e59eb3409eb5f08f4af67877b8ecb2aa2e3be0284e3681591d948de5a9f0bcc7f4c29c33d8b4e321a0c38ea60d2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017

MD5 3821f1b4914613cd8e3f6b2be9f5595e
SHA1 01690474cd1340ee26ba3b32755d138a718f1b92
SHA256 f20484e43fffb76f528523ccfa33595e7a47b8bba7d19672e50a36d7c95e589f
SHA512 d216f7c8cf10ef97197de0f8f9cf879a15588442b3769124b2fcc5739eb6e78e2d3f5ea8054742aeaadf5f8ce5fd573dc9c2b8a6c25d0cb8fcc2490db749bab3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016

MD5 ec7ce309f9f6c41b6f91187c7c7726e7
SHA1 22355398914d18888b25a0730cb6d81cb98a47f3
SHA256 2065d961beeba6302d62a919bf974a0864ee3fcaa38ed8aeeed6c4f36672fbf7
SHA512 7d848890b10a865d48966984142185c081ba22cc888a5be615b795c3851372ddd1ac28473de7168436695971c3178a05d9220dfe680849385a208b2105a9728e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015

MD5 e8dfc02c3b5c396653186462aff7813a
SHA1 971e133e0b51f4705f742f4dd313d126e1cb9577
SHA256 c5ee5227dfd80d24aab357543306142afa8823fcfa205d4fb2b3e0f1533df79e
SHA512 9d8239db7777eadde43916b139a36dadbf6c5ad4c9408abf9fa4a10f588e9514c4c4512beef19552c3d3dec602ff8cef6764cce863283b1a1f5c8f6c14a7e841

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014

MD5 f941c2c08f149ec278a55f7db3bdfee7
SHA1 24b15cb166be8be824361ba53180cdb1d292af9e
SHA256 0f6c0b2a6d8a24a748eb606d40d97cebe53b9a8dd07c65ad07cc8e2ae190cbe0
SHA512 64b7d47cd96af8ee27036de1ef430372e4950a9b75d0b2ea6d040e941fa22cbe515f8a2dcea6415eb129fa00b6f277ad51cf376e82ef2256aad78d04707dc75d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013

MD5 0f978383950b924d31b77aad56c0ae79
SHA1 4481f7635c1cf3d98c542542d0106cfe498446e1
SHA256 afca43c7931d9ddc33882d9a079772bddced944debbf84143192c4eea3292c77
SHA512 b8ffaaf2d63b9582ec4917e970b2033989bd414b9bbf2b9d3b5359aa4a8a15cd3206e556514483e511df2433adab4c8cef9b8a251e2fb942fe4e7d846fdf936f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000012

MD5 16c0a2c82dc0ab50f23123f7ecb11f51
SHA1 fbaef7794f352126af25aedaa99f1bc22d131f71
SHA256 5749a98e9383a271b4f6cac8caefea4d86a6b40e203a750d45fda652e167583d
SHA512 0bf3c5458b647601a1f28c194ac1bcc424ecdeba91871fab9178e8daf1fdf2ee956ba55bbf61b3cd2f54cb1ca008dc894e6a54730f5caf754c61d9ba20da8244

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011

MD5 b4e4c40ba1b021933f86142b1010c253
SHA1 8901690b1040e46b360f7b39ecb9f9e342bd20af
SHA256 a1ad4fde10e0f378aeeb97ec0aaa27bbdba9ed434a0334052f0230e09fd891ae
SHA512 452cbfc40d99d69d65271ab7a6fb62c87d123813fe20898d13b938c13d54efb2e33eb04e165f18e9e91b6a0d02b3282b8e3bf2b8c65efaa974022d14c07bcfd4

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010

MD5 e697d69b66666900dab91c59cb89fada
SHA1 8e92b22ec92aa2a7dab86527d18cff37875afa59
SHA256 e3650b542aeb8e195f0a2608f8a019129674d828d7433c51b4214cc15fe5c1ea
SHA512 ade93800ebf13a0b39323db73060b10f0b7763991d3f8d2b64a8c2053e5860255385712e11df8b2679120c8ae1dab6949dcc506d89bff888ec75a74caa108a01

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f

MD5 21a7d4097801c320589bfde7ae22e451
SHA1 9b4347c8ef8e4c7efead52f6dd5efef4805523f1
SHA256 0973e98584b20b0a1415ddb5e3bfb8dcec35e97b0f12c5e39a611597f8fd1d12
SHA512 9977fd1131b11d2c697f35a49024bf72b47b8ec69fe6d4c1410c256351cfbd1be78248c5672de6211195d18bf0cb3d0a06e1b0de39c93b6a155b93f081d8bbd6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e

MD5 19b7f843cb98904523484aaba952e936
SHA1 6db7d0ab604066355d4c520f1afc920185bb1728
SHA256 46e4d79069de149b743bf13d125282283e16d2eeca871247b3c8eb419f060420
SHA512 5fd1686c423bf8f56542d15dcf2605d1453a70a6c47bbe6285a0bcaf9907d92b32b081d6030726a3a325cad227cef73a8033b327c2633d5ac540d483eadb15a5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d

MD5 5b1aaeffac4646b91be95ce23dd3ee31
SHA1 8a006f9eb63f59f5709045222b89da4f9d212f45
SHA256 ab28ef17d5a8a824b350e263788385537a6ff8dc0dfcaeceb3dbc89ae2eb5d2a
SHA512 307acbc71080eef3f4b42f0ccb60ccf9201f233b496dc6015b8097d412aa5ef8895bce58752f4a12d041071df6a0dcf48267696db1496887bac05a0bd26a1393

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c

MD5 150603bf75a8b8c0fb47e65dd30ea2c1
SHA1 9c4fa72fafe95375cbfdba3e974a240d9aefe704
SHA256 696674a9e01f6f1999c5ee6cc88527c24adb1b82c72e2c7c9df3901748f519e3
SHA512 bcf825c0f0e4939ed2e3280339e5e1cec43a161f773d12a734d60dc33ca7e23fb6259187351b988494b701ef8567ca30cb1b447cc7e526ef172ceb1e78f40244

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG

MD5 d2270843c371e8e60a2740b829ec1eb9
SHA1 06d6d2fb4b275166e670c80028536075e9e79bec
SHA256 e253d6412b011379f6ed088103f9c2ed0230966b791c42357769ad6623013b80
SHA512 27b9e4a3e159179780338620611079d92be85fdbea5e5a50b51a877d21e2c1554d3268b749b76b4ed263c8ebcfa6633b7cd73d57bc0fc2ddf0c4a032af91bd13

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons

MD5 57ea171d35ee0f8fd7c1d9e3ad966c56
SHA1 b73b8a823c60f2bef7498bf864ae99c10f3d3b15
SHA256 ee1a3f7a350dcf5530c70239dae9b2e8f4a0c7fa3a60cc18efe93aafd7473085
SHA512 afe90b5816668354a1bf4741f8c0b056c5de9fbae77bec36f16cc67f6d287fdaf9f42ad8350993e510b88090e7582722454bc8a9cb992cb1b64faf1f55ee0a4a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History

MD5 d639e66fb5295bc297b6e435e9ce5335
SHA1 441a57ae25f5d2640ad5e5ae49ec9b3b680f9880
SHA256 aed858ad6a976125206f3309fd41873a84c27752df74bae1f3e70a058f6a5b7d
SHA512 6c642cbdc8c4dcac725e764d53410a254ea1622de4e50033efbdbb6ad820a3e51c1663484884241b27ee6880718232e3eaa02e9d2078a915f5e5102798bb4e9d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Visited Links

MD5 2b6432cbf4e7cb9793dbd30303c48517
SHA1 abbfd30666dfafe4063b17d0b9fb5172c20d5b5b
SHA256 5a36147ea7370dd4392dbf6036ef8818314c00b46ec92a4460577a1b8e7f85ff
SHA512 b1af0c3118a5a345032e393b8bb56d3bf738e0f3fb57ad4a4455cecd3d38c95873cd1aecf52122b08d3515ea38723bb62a3dde152537684d3dcd27fff4bea424

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b

MD5 da1d252e947bce39c6b4fc3270383195
SHA1 f6e8fcd9d63683e56e457bbf1dfbd684586382fc
SHA256 28ac23c8020d600a3141888b982e3061d34aeaad83fe5993d8e61cf2a70b7bd4
SHA512 320539f5ec40d9bf31f6b9b7c1c99f6c644937060c5f29726b6719f2ff5d2043d237ddcbf4be20055e9b13673fc0e4e025d172bcd51495caf65ca57a689e2eb4

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a

MD5 6930ea7c53f0ce009cb02aaff619f4eb
SHA1 93bb7b8749e7e8f074294731776207371043d3b4
SHA256 16f28dd66541dcdac4dc74947b37305a05d20351e57e69662f7e37abef045f8b
SHA512 2806b3203ba93c5acab0f76bbe2d96a782fd65948ba61cdf49cd97fcf5b24ea1f811bf26a7900537b7f3c9ea4f5372d7e2d7998659036841789d4d5451d90427

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG

MD5 3d3d8f3d6a740668b2a231e9d0d72016
SHA1 796e5d5627c12978534fe6670a0dab751d55f991
SHA256 fc612504c60bfeb1439a30f78671985b60fa71589f805447f1fd9cdc75eea94a
SHA512 ad52ea72d75450f78b4206a529d2bc863c8ab31c50597adcb10c5e714e8d2fe106f9e79619479b028de92cd687810551ea5ae382e650cbc66e30abc010b80b4f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009

MD5 c356a0c771a0209d3482777edfc10768
SHA1 1ff2d992af8a6f19c30ecbe8f3591f26fe1cab08
SHA256 32381f4549d36fa4583e599adc04056a4da80a6067c6805b7081c3f3f54a27ad
SHA512 561084baf8d65579ead79e79c2c3920ef987384d52ecc11a2689aff95c54a6b823a0c4a8e5b910e60e569450e36563f53adb5796f261f13bbeea59130b81fe3c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008

MD5 e947a4a8f03dc0c52c15bfce5823182f
SHA1 262a9585d1062becefe9d56cafc8d644ebde178e
SHA256 2ecb4e4d0933252922dd834c9d230b277b82abb75f6aacf5b1668780189009b5
SHA512 ccb8947d98e4d4a711d39069227697a373517e68291e2a6ed4d65c2229d954bfde9fc2991bc56ab929e986bf49484320ef618afe60ba70f74aee02b378b78888

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

MD5 87c2b09a983584b04a63f3ff44064d64
SHA1 8796d5ef1ad1196309ef582cecef3ab95db27043
SHA256 d4a4a801c412a8324a19f21511a7880815b373628e66016bc1785a5a85e0afb0
SHA512 df1f0d6f5f53306887b0b16364651bda9cdc28b8ea74b2d46b2530c6772a724422b33bbdcd7c33d724d2fd4a973e1e9dbc4b654c9c53981386c341620c337067

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

MD5 33d2dcc9ccf87d6ed728ab0c46235369
SHA1 249e080a07601d8537b242546067229f49a4aca1
SHA256 a455f1cebb519dc1861af1646224fb2cff08843469c0f346d93efb6745615c4c
SHA512 754e230d5ed0a578559702f43312b2cb2b282676a95218ec3213efb566fed6ca02034bc6dc7ba124afee6f9b766a0680a8e51ea377b998eb2a10d0b7de67f7cc

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

MD5 725f35e629fc881240e5f51206ffcf54
SHA1 be67e1681e4a7e21e88b5da63fbaece6f4500602
SHA256 ec294d0e955e11d90b901362b3681d7dba8632d31be68641e0fbddb23b23e00a
SHA512 32cbcee01c26b1eb4abaf1af434a572da85decca57dc73e704a0818823b354c165c761d3110fefd03a17dea3ccb4ea97968785ada0c499b0cd4407b64b39fe81

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3

MD5 9c03dd74405840c8bbe80e98624fcc75
SHA1 bef53e336f2a2a8a8892bc3cd3e4fdec1bd49c10
SHA256 0cd353617f2ff53dd72e5aa51b71b0f94a5436031e9c33d1cfa8f681fe3a076c
SHA512 826225e9dc91889108d1020e81b5b73faaac52cac94eac14f2874608615b9c337b734e302cc9cdcb962e487c49390d772cedc4c8fdc192cdb877eb82f73b28a0

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2

MD5 e17456400af8be59340da2d9eedc1291
SHA1 828e30417b507b788b978402b190185decf2ec12
SHA256 c1aedb04bbb07e96868428a88606a172c9322c9e6cc4f0873b0536455f04bfaf
SHA512 97ebabd85f18353aab86273c8b535848457ed445397622c3023e604e81e58e0d742d6bd7d4a300784d3afaee8e6a0a5fd12c78496f7266ea3e4852dd996ce214

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0

MD5 7e5c4d58317f64ccd863241022b818da
SHA1 ece9961a1f3472161a7d910563c070b403abb016
SHA256 fb4b394a5f916a86875323eafa10d3682318df1d0727acecb0837eb5f422c49b
SHA512 3d011bb8bdb67df3efd14f456191ea053febf29261c92b509effd0ce179acb1d581f615e72e79b0e32298a97f4f9a584d0c54d5bb645139e8b320a7221ce54bf

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 0ca235e8caca7ef5bd07e5ec28b09e7e
SHA1 b3885545d4d6cfc9cf35c2c1d0b834888fdf191f
SHA256 b6851ded9809c84daf50f4115acfe7bad98cd9031e6bee9e596de6063ba36e45
SHA512 61e9efc52c8d3298fbe5d80f01bb479c2fb37cd18b506833202b561864cf6298c0d4d4f21e1ee3918812ce13258cb0fcbf47a9d0b6ab15696e7bffaa4ac5e4e2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 342d086fd13d2f7dce354bd6e3166640
SHA1 644ce8598aae8b36bf2a8c1f2b2376286010fcca
SHA256 36cadf350f8ad65460dd2b6bd936dff5bf012e310a4ccc8e7d418af7aa0d3773
SHA512 00386a5cb3622c46178e30375840d1939ec12d5149b7c845bed813360bcfaf6173feba547d564cb3cb4456eb46eee89241f04b99363c2361b96865d0631e261e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 4f88e88339d6be6a1c8f508788aa0d58
SHA1 71b89f6f702f45d3b92c56147ac99c639dbdc2d7
SHA256 e56d88412632a87a44660a89e8d673c8ff346c7537612dd1515a77dc9cc9a49c
SHA512 113edd161dc8fa1ffa9bacd7faa6886569da3888d7a3f839ec1d158ebf9cda7b6f06dfb04d26f5998bdb6df6a6dd946bb918d5e5cf9e043921378589208b0bf4

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 6e320207e39c076bab766c0f9b565a3c
SHA1 8f16813e3831416f5e7fad5b9cd0cd90504e9767
SHA256 1042af10c4438a8dde123cb9a8921f2b29c0bd5bebab1930c9bc6451e1f54232
SHA512 ad75068b27d36c8861e42a12dd14245537bb7dd8319587045525a8c4fbc6269459e2778e1b9ea068dc45deba7a8b32178e40871ee52d720598c3990fe38de5f9

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 55bc4b2590fd203de072aa7fdb0a105d
SHA1 5ec1480bab732ed43aa1d3ceade7513f57e9fdda
SHA256 40bbff56e286a7591047a03ea5bad1ae0cb1e679e84a174c13064eddb1a9463c
SHA512 5aeb787383c8262230e13e0689136de04afe34eb5669ac50ecbfaf9a9ba29b78fa6d3061e56de4cb5f3e4c9be46d22cf8f5ed9b2c3d566a21a1de1301ace90da

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 fc14b0b6aeb04b77f2b8adf3e3350f45
SHA1 92551020670df753f52f410dcbb10f1e6cc8beef
SHA256 fc5aaf34a2413293eecee02c1cfbd7856e748edeeffd4df748ca88f1ddea3c20
SHA512 d4d0f24ac15c544c99029793d346638873647fc9fc6221ae06f3193e46dcf354fb0411c1601c6c34fa6d786f665f451e0a5b02ce2f625a81d46b6c266606eb76

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5 d4d72e71ed5251aea8144b09333c7345
SHA1 4fde203db6dd2df0175f7d22461f059ebda7ea99
SHA256 233a7b3891daeb8116eaf5a1fb8de8728cfbbb0cd2ec7a8f60df21ca6a2e5bca
SHA512 9a12f9900ea9864bfffb4efe20d65e6e6fa8fee92ab5f09ff4088b2b01c2a749ecdb558aaee4e264a6c738d4c0fbc99928cce2f5a9ae68501d664c787f4e7e7e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 39740a0cc1272b0c9f3a4707ba4b3e3c
SHA1 10f7c6b93ea59f51b6a7d76f297cdc0d44ae32f5
SHA256 256711a226b8fa991480b00a092be207284cde7ea14f9aa33223c922484ec1bb
SHA512 29f6fe760189960729680e3d4d371fbcb2d3afb00f9fcb2636d3d5762f403ab2a27d9dac8cc2cae190c1a2afb571ad4bba855713aa03b33937d1b58d777478d1

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 b575db584e99a508d627b73613d9d63f
SHA1 6dc21a10370ecc20f9d813239a6e4b0a9b9cf349
SHA256 d2d5982a2f8e6e94bb97634b3539b3857a85f8cf17afb846655cdeccbe417048
SHA512 097302713cc6fb2d6631dbc447a7f1f4762dcfcfd16341da51dc3e0ca4912911a6002b5357e0f8e3c4bf6f150fe43a84d3351743b874f8a3ccf1a6b621dc7b94

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5 4eaf7ae5659567af1b99de421d0fdac0
SHA1 49c8580c0a9d1f6eb64438b1d316f89731f06ab2
SHA256 610ce7c5ce1969c834624811ea6ad7eb6574393f91359a6476cb013e4726c340
SHA512 bdb9865c706a850d27fe410d48bdabdd65c02a4367e57b222f9db35cf461437aa854f6c72763bc727bacbda6271f658a3769214c16a96708cd30e7d62312af6f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 9d7883d150b19cde3b1534c93b22ca60
SHA1 08127a93d3b6de54f41c3a7305abc4c60e2d9e24
SHA256 36c10484b42aa684068ec8281bbf10e663c482490a303e003deb19bb630336b1
SHA512 43a8454ab65e79b41751abbaaffde9709b0e9c020925de56623c72f8ee0e15e1af009825b35e79ff1f6d765ea165da8ce4d6c50818015c079e6f5a93e0e2a5ce

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 31195cab65e2ad1c587792158aad68c0
SHA1 fca77de8bb73fa6ad086c2714e24bee5112db136
SHA256 073a74a412b11ef5b02c1cce20e2dca37f7a69f5943304036590a1ee4489c1b0
SHA512 f8ead0dcca34dd0f4fbb2c1b5dc52dbdb1aacccf52028f64cee92ce27d97570818e54ddf5a88d4bbe3aa19e37097ad4fa872e5977514e70a2a6546c44d20671c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5ac824.TMP

MD5 f619823ed0770b90f80d3534cb081012
SHA1 e38226087b4db08f7eba7ce3cf0375f44f23e5a8
SHA256 cebdbbbc9491888aebbd4874f9937625c65a2f099401cc280e4f38b4005cfe60
SHA512 1bf4f621de26f9e7fe1f8e109a72b484c4862139d8e0771268ec1936be691c4f8567ebb9670b7c903de352a856fc002927e9215e9e6fc08936a77e70315dd4ee

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 8a36e1f237caf8d121afd43e7959fcc5
SHA1 f641878a3f8b02791576102e07e5db8a76c4c623
SHA256 4b9f69f7ff2d49318c0f3d1b436e74c73cb41920a2670dc34f2dabc54739a627
SHA512 5f40846164c221cc1f8943be4e2c2cd8d0cf504b9f9693dc6360877e671cdc1d4721362e7c6a33cc4bb9dcd19953d943ad4947bcb2b9da9cea1931d3a57bc5df

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 de211ccfa114d26386501f6fb83eba20
SHA1 7f623e34b4bc59657ab52782fd26e16fc48b22d6
SHA256 a18e952c99dee9e716335b409c6ffd02e32b520fb5c7dcb315ee064f8957b32c
SHA512 e6cddb656b3c0d3fa446287c345f736ca5ffe2a7ab5d226661bafb85b4a8aeaba259e56e2c58d080092a6a5d5eeee5402b53ea1345e3aaf61988769e90dfb773

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 937e5646f450097843c7b4646ba11be1
SHA1 cf3157f8a89fc4994e5e2196dcf1ce422cf39b23
SHA256 92dd1d48faff4767526ee0dece24f78e10ae1eee6b66b357abd62fde5bdd99b6
SHA512 5a90cbcb9ec533cbba8b86c32922643b4162c659003613ad3414b138f0073d3d64c59cef181c3a886dcea0667007354a1ec7b655e8849faa44a1927f8f52fa18

C:\Users\Admin\AppData\Local\Temp\uhmwlh.exe

MD5 137860d1b5feb9398ab44431f89d91cb
SHA1 456279aefa02cc3eaac1e2bd6534e86742608da5
SHA256 fe625188da34d9b6551ce1c34627cefd1a3e4da78f1dacc9442d04bd0ea944b0
SHA512 058466f7d3604df1e01f5a4e89402582091fb30225bb7a004b8bd1b89adcc17d3321be273378aba8fe44faf09b7846706ff6be9de635c95b3db4f85934e812eb

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 86de7497022e27a0a3971a76ee90fa79
SHA1 39457213b858b13bc45f40075fa5f26cc592af2d
SHA256 8ba1b4e998bc1de8befe8a45b97fb30c70aa7ee26fef7ad52f410e0e996a7bf5
SHA512 a7cd3374c4a2e34ccdc8487d49c3d2c237f6b4bb4532845e4a104da97854abe0a3f8e02a038014a1898ae02a99c0000200c70822222ba6e64fbfc8b8ab1156b4

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 bba345001f67fe5d5e055fc51f4b2361
SHA1 1c1dfff059daa4438a7fb89f856da4932daa597d
SHA256 8ebb0ddbccd3511195fafca46971ddffa0f7be4c54e57b689f96e32eb6031af4
SHA512 7006875f6f76db57638dad8c55a062da493543127eaa29696702eae4457e77112ea2c0bfc4c98de7c0ad43a074be558643740c187a7ee2e23153da03f7dd865e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 24e0863b5170f27d21d8782b0bc543d2
SHA1 f1b4fb51584061f43b2dc5eabd7fb58b1fc846b0
SHA256 5dcfc42214760e6138e3c0c1a159678fa10bc115e2c01148bf3546633c8af43f
SHA512 0a1c31373f0bd0bc083d6c1f4088270dce048378c68c3714b6dce4d6873813794844ec1ea244684dc37556a1110d0d70ebf18b29959b31364782173e50e87972

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 ca023d48f80cd234ed0f8af5ca7f1b77
SHA1 8e37f49abe3981521af3178e8e0de43709fd74ee
SHA256 63a58293a71979494111221bb12dd016419b4883124e3daf95eb2b6fce532b30
SHA512 8a27377b9940354b01b134f6dcf809e2d5a91be1382f7776f4b010044fc7b44d134e9aa6de530009c9bc79d849f12d9ebc358521c1b8548a1d6ac0dc1316eddb

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 5cbe5bf65ab4966bca5c1e34e0e1ccd5
SHA1 854010487be4c172ca1206cd55338e8c521717d8
SHA256 b697ad2b388821ea0f90c7257e944a18c3b07c97e54b821b1eb14d1c766fc96d
SHA512 8931452605ab8390b64bf325491451d7ff2eaf733cfba4e947ddd8b72ad7702ad643891df84b5acfafe5e87a0123d047eed5652faf9d85af6d8d374cfa54b532

memory/5744-1313-0x000001CF36C60000-0x000001CF36C61000-memory.dmp

memory/5744-1312-0x000001CF36C60000-0x000001CF36C61000-memory.dmp

memory/5744-1311-0x000001CF36C60000-0x000001CF36C61000-memory.dmp

memory/5744-1317-0x000001CF36C60000-0x000001CF36C61000-memory.dmp

memory/5744-1323-0x000001CF36C60000-0x000001CF36C61000-memory.dmp

memory/5744-1322-0x000001CF36C60000-0x000001CF36C61000-memory.dmp

memory/5744-1321-0x000001CF36C60000-0x000001CF36C61000-memory.dmp

memory/5744-1320-0x000001CF36C60000-0x000001CF36C61000-memory.dmp

memory/5744-1319-0x000001CF36C60000-0x000001CF36C61000-memory.dmp

memory/5744-1318-0x000001CF36C60000-0x000001CF36C61000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fgmogd.EXE

MD5 245e496f18d5976ec09d7f4af0bf6b55
SHA1 f801fc559b5e55e0ac50d96e52bdc4bf7e621b3d
SHA256 d52499c1695f41e92ff5ec0958747ddb8ef24f8d498eda3353c155948083f14b
SHA512 c3bbbf79c710a64474278d33bb736a02263b34f4002d1d09b95bf733b0ae7ec1e511adfe5c0e5a1c533175d6d43cfe608ee7fa67b5de72af69db656ba9e9a39c

C:\Users\Admin\AppData\Local\Temp\3582-490\fgmogd.EXE

MD5 42dd94809ad0c60480690c0ae0019ee8
SHA1 d578fb2fc7c0b08a8ebb375e920d3602a70a098d
SHA256 0040cd2d77e8f81db7414c284bf9828348d7b3a5a5322177fd9e8151fc00638f
SHA512 b8ba04feb9e2a6b15b017af6d2af55756987ac33de1c0740208ac09f402218ca585bbe0e6ce91b8aa50b0653fc8999473c1ed34c3b1a0d5e87b21ce35c19470b

memory/5324-1425-0x0000000000400000-0x000000000041B000-memory.dmp

memory/5716-1426-0x0000000000400000-0x000000000050F000-memory.dmp

memory/5324-1429-0x0000000000400000-0x000000000041B000-memory.dmp

memory/5716-1430-0x0000000000400000-0x000000000050F000-memory.dmp

memory/3584-1436-0x00000000053C0000-0x00000000053C1000-memory.dmp

memory/3584-1435-0x00000000053C0000-0x00000000053C1000-memory.dmp

memory/3584-1434-0x00000000053C0000-0x00000000053C1000-memory.dmp

memory/3584-1445-0x00000000053C0000-0x00000000053C1000-memory.dmp

memory/3584-1444-0x00000000053C0000-0x00000000053C1000-memory.dmp

memory/3584-1443-0x00000000053C0000-0x00000000053C1000-memory.dmp

memory/3584-1442-0x00000000053C0000-0x00000000053C1000-memory.dmp

memory/3584-1441-0x00000000053C0000-0x00000000053C1000-memory.dmp

memory/3584-1440-0x00000000053C0000-0x00000000053C1000-memory.dmp

memory/5716-1447-0x0000000000400000-0x000000000050F000-memory.dmp

memory/5324-1449-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4588-1451-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Windows\directx.sys

MD5 4fd86edfb0265fb23febe3de0faf02ac
SHA1 982aebee80f4628ed5a4528707ec163086caaab8
SHA256 4a3554885ef962e81e72ea265346a80445ec9e3dc0d8e8fa2fc6da2736bc685c
SHA512 d1360c7c655f743ecd624a84872ac35f5a9faa7d2218a0c068cf0552026d115afa349019131e469417ac559807574410558c97b3844310e4fcd7347a696be41e

memory/3500-1465-0x0000000000400000-0x0000000000457000-memory.dmp

memory/5616-1469-0x0000000000400000-0x000000000042E000-memory.dmp

memory/3316-1472-0x0000000000560000-0x0000000000561000-memory.dmp

memory/3316-1473-0x0000000000400000-0x000000000042E000-memory.dmp

memory/1480-1475-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3500-1486-0x0000000000400000-0x0000000000457000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\kynnlp.exe

MD5 37f62efcc36a75173c046c865e2f0e98
SHA1 4a28ea3b45fe70097613b99c68cb6e2d2cefd4f7
SHA256 a20cc260e46af4a5159456762fefa7ac2bddc3384ef1f18d5c3f7d75d6d1a7d6
SHA512 c3d873da37ae75e6734825fbb94636b0899591c6e55641d7a74e4f8db6bcfc133b61ee54c94f55a0bfbd079b38039d5ac3402e27b2c90ff041c6a74e1be3c304

memory/1520-1499-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3060-1500-0x0000000000400000-0x00000000006CC000-memory.dmp

memory/5712-1523-0x0000000000400000-0x00000000006CC000-memory.dmp

memory/5712-1538-0x0000000000400000-0x00000000006CC000-memory.dmp

memory/4608-1544-0x00007FFC0ADF0000-0x00007FFC0B8B1000-memory.dmp