Malware Analysis Report

2024-09-11 09:14

Sample ID 240623-d8xp1ssdqm
Target Client-built.exe
SHA256 5f5394d5a24e19d4b41d3ba6dc25c0b0af2bb0455643c8b4ee67fa777d189d35
Tags
discordrat persistence rat rootkit stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5f5394d5a24e19d4b41d3ba6dc25c0b0af2bb0455643c8b4ee67fa777d189d35

Threat Level: Known bad

The file Client-built.exe was found to be: Known bad.

Malicious Activity Summary

discordrat persistence rat rootkit stealer

Discordrat family

Discord RAT

Legitimate hosting services abused for malware hosting/C2

Unsigned PE

Suspicious use of FindShellTrayWindow

Suspicious behavior: AddClipboardFormatListener

Checks processor information in registry

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Modifies registry class

Modifies data under HKEY_USERS

NTFS ADS

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Web Service
T1102
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-23 03:41

Signatures

Discordrat family

discordrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-23 03:41

Reported

2024-06-23 03:55

Platform

win11-20240611-en

Max time kernel

437s

Max time network

450s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"

Signatures

Discord RAT

stealer rootkit rat persistence discordrat

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133635881798591229" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1276817940-128734381-631578427-1000_Classes\Local Settings C:\Program Files\Google\Chrome\Application\chrome.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\Downloads\fortnite aimbot.docx:Zone.Identifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client-built.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\whoami.exe N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3060 wrote to memory of 4980 N/A C:\Users\Admin\AppData\Local\Temp\Client-built.exe C:\Windows\SYSTEM32\cmd.exe
PID 3060 wrote to memory of 4980 N/A C:\Users\Admin\AppData\Local\Temp\Client-built.exe C:\Windows\SYSTEM32\cmd.exe
PID 4980 wrote to memory of 5072 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\whoami.exe
PID 4980 wrote to memory of 5072 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\whoami.exe
PID 2320 wrote to memory of 988 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 988 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 4024 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 4024 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 4024 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 4024 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 4024 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 4024 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 4024 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 4024 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 4024 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 4024 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 4024 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 4024 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 4024 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 4024 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 4024 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 4024 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 4024 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 4024 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 4024 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 4024 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 4024 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 4024 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 4024 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 4024 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 4024 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 4024 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 4024 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 4024 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 4024 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 4024 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 4024 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 3104 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 3104 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 2344 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 2344 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 2344 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 2344 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 2344 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 2344 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 2344 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 2344 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 2344 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 2344 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 2344 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 2344 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 2344 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 2344 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 2344 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 2344 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 2344 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 2344 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 2344 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 2344 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 2344 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 2344 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 2344 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 2344 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2320 wrote to memory of 2344 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Client-built.exe

"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"

C:\Windows\SYSTEM32\cmd.exe

"cmd.exe" /C whoami

C:\Windows\system32\whoami.exe

whoami

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004D0

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdcd5bab58,0x7ffdcd5bab68,0x7ffdcd5bab78

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1892 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2192 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3044 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3144 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3484 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4404 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4552 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4428 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4744 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4928 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4872 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4744 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5096 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4784 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4060 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=1544 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5456 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5568 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5608 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4116 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=5592 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=5628 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=5364 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3420 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=2860 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=5784 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=5620 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=4636 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=5876 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=5976 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5772 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4952 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --mojo-platform-channel-handle=4884 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=1180 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=2692 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=4828 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=5596 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=2588 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5756 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5980 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1144 --field-trial-handle=1816,i,4715427635526766418,12686147405168437963,131072 /prefetch:2

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\fortnite aimbot.docx" /o ""

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\fortnite aimbot.docx" /o ""

Network

Country Destination Domain Proto
US 8.8.8.8:53 gateway.discord.gg udp
US 162.159.135.234:443 gateway.discord.gg tcp
US 162.159.137.232:443 discord.com tcp
DE 159.89.102.253:443 geolocation-db.com tcp
US 162.159.137.232:443 discord.com tcp
US 162.159.137.232:443 discord.com tcp
US 162.159.137.232:443 discord.com tcp
US 162.159.137.232:443 discord.com tcp
US 162.159.137.232:443 discord.com tcp
US 162.159.137.232:443 discord.com tcp
IE 52.111.236.23:443 tcp
US 162.159.137.232:443 discord.com tcp
GB 142.250.187.196:443 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 195.187.250.142.in-addr.arpa udp
GB 142.250.179.238:443 play.google.com udp
GB 142.250.179.238:443 play.google.com tcp
N/A 224.0.0.251:5353 udp
GB 142.250.187.238:443 ogs.google.com udp
GB 142.250.187.238:443 ogs.google.com tcp
US 162.159.137.232:443 discord.com tcp
US 162.159.137.232:443 discord.com tcp
GB 142.250.187.238:443 ogs.google.com tcp
GB 172.217.169.3:443 ssl.gstatic.com tcp
GB 142.250.179.238:443 play.google.com udp
GB 142.250.179.238:443 play.google.com tcp
GB 142.250.200.14:443 apis.google.com udp
GB 142.250.178.14:443 encrypted-tbn3.gstatic.com tcp
GB 142.250.178.14:443 encrypted-tbn3.gstatic.com tcp
GB 142.250.178.14:443 encrypted-tbn3.gstatic.com tcp
GB 142.250.178.14:443 encrypted-tbn3.gstatic.com tcp
GB 142.250.178.14:443 encrypted-tbn3.gstatic.com tcp
GB 142.250.178.14:443 encrypted-tbn3.gstatic.com tcp
GB 142.250.178.14:443 encrypted-tbn3.gstatic.com udp
GB 142.250.187.206:443 encrypted-tbn2.gstatic.com tcp
GB 142.250.187.206:443 encrypted-tbn2.gstatic.com tcp
GB 142.250.187.206:443 encrypted-tbn2.gstatic.com tcp
US 162.159.137.232:443 discord.com tcp
GB 18.164.68.11:443 help.dropbox.com tcp
GB 18.164.68.11:443 help.dropbox.com tcp
US 151.101.65.229:443 cdn.jsdelivr.net tcp
GB 162.125.64.18:443 www.dropbox.com tcp
GB 99.84.9.65:443 aem.dropbox.com tcp
GB 99.84.9.65:443 aem.dropbox.com tcp
GB 99.84.9.38:443 static.cloud.coveo.com tcp
GB 99.84.9.38:443 static.cloud.coveo.com tcp
GB 99.84.9.38:443 static.cloud.coveo.com tcp
GB 13.224.245.43:443 cdn.dropboxexperiment.com tcp
US 8.8.8.8:53 38.9.84.99.in-addr.arpa udp
GB 99.84.9.38:443 static.cloud.coveo.com tcp
GB 18.244.140.82:443 www.knotch-cdn.com tcp
GB 18.244.140.82:443 www.knotch-cdn.com tcp
US 104.16.100.29:443 cfl.dropboxstatic.com tcp
US 104.16.100.29:443 cfl.dropboxstatic.com tcp
US 104.16.100.29:443 cfl.dropboxstatic.com tcp
US 104.16.100.29:443 cfl.dropboxstatic.com tcp
US 104.16.100.29:443 cfl.dropboxstatic.com tcp
GB 23.36.168.235:443 assets.adobedtm.com tcp
US 104.16.100.29:443 cfl.dropboxstatic.com tcp
US 104.16.100.29:443 cfl.dropboxstatic.com tcp
US 104.16.100.29:443 cfl.dropboxstatic.com tcp
US 8.8.8.8:53 82.140.244.18.in-addr.arpa udp
US 8.8.8.8:53 29.100.16.104.in-addr.arpa udp
US 8.8.8.8:53 235.168.36.23.in-addr.arpa udp
GB 18.244.140.73:443 configs.knotch.com tcp
US 8.8.8.8:53 static.ads-twitter.com udp
US 3.214.226.118:443 frontdoor.knotch.it tcp
GB 199.232.56.157:443 static.ads-twitter.com tcp
US 8.8.8.8:53 dpm.demdex.net udp
IE 63.32.235.18:443 dpm.demdex.net tcp
US 8.8.8.8:53 73.140.244.18.in-addr.arpa udp
US 8.8.8.8:53 157.56.232.199.in-addr.arpa udp
US 8.8.8.8:53 118.226.214.3.in-addr.arpa udp
US 8.8.8.8:53 18.235.32.63.in-addr.arpa udp
US 8.8.8.8:53 player.vimeo.com udp
US 162.159.128.61:443 player.vimeo.com tcp
GB 162.125.64.18:443 www.dropbox.com tcp
US 8.8.8.8:53 units.knotch.it udp
US 8.8.8.8:53 content-autofill.googleapis.com udp
US 8.8.8.8:53 dropbox.demdex.net udp
GB 108.138.233.86:443 units.knotch.it tcp
GB 108.138.233.86:443 units.knotch.it tcp
US 8.8.8.8:53 cm.everesttech.net udp
GB 216.58.213.10:443 content-autofill.googleapis.com tcp
IE 34.251.227.208:443 dropbox.demdex.net tcp
US 104.16.100.29:443 cfl.dropboxstatic.com udp
IE 54.171.207.123:443 cm.everesttech.net tcp
IE 66.235.152.221:443 dropboxinc.tt.omtrdc.net tcp
US 8.8.8.8:53 analytics.cloud.coveo.com udp
US 104.16.100.29:443 cfl.dropboxstatic.com udp
US 75.2.114.51:443 analytics.cloud.coveo.com tcp
US 75.2.114.51:443 analytics.cloud.coveo.com tcp
US 8.8.8.8:53 61.128.159.162.in-addr.arpa udp
US 8.8.8.8:53 86.233.138.108.in-addr.arpa udp
US 8.8.8.8:53 10.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 208.227.251.34.in-addr.arpa udp
US 8.8.8.8:53 123.207.171.54.in-addr.arpa udp
US 8.8.8.8:53 221.152.235.66.in-addr.arpa udp
US 8.8.8.8:53 51.114.2.75.in-addr.arpa udp
GB 216.58.212.225:443 hackerbot-net.webpkgcache.com tcp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
GB 172.217.169.67:443 beacons.gcp.gvt2.com tcp
US 8.8.8.8:53 google.com udp
GB 142.250.178.14:443 google.com tcp
GB 172.217.169.67:443 beacons.gcp.gvt2.com udp
GB 216.58.212.225:443 hackerbot-net.webpkgcache.com udp
US 8.8.8.8:53 sourceforge.net udp
US 172.64.150.145:443 sourceforge.net tcp
US 172.64.150.145:443 sourceforge.net tcp
US 8.8.8.8:53 a.fsdn.com udp
US 104.18.40.209:443 a.fsdn.com tcp
US 104.18.40.209:443 a.fsdn.com tcp
US 104.18.40.209:443 a.fsdn.com tcp
US 104.18.40.209:443 a.fsdn.com tcp
US 104.18.40.209:443 a.fsdn.com tcp
US 104.18.40.209:443 a.fsdn.com tcp
US 172.64.150.145:443 sourceforge.net udp
US 104.18.40.209:443 a.fsdn.com udp
US 8.8.8.8:53 cdn.consentmanager.net udp
DE 87.230.98.76:443 d.delivery.consentmanager.net tcp
GB 195.181.164.15:443 cdn.consentmanager.net tcp
US 8.8.8.8:53 c.sf-syn.com udp
US 172.64.154.159:443 c.sf-syn.com tcp
GB 216.58.213.10:443 content-autofill.googleapis.com udp
US 8.8.8.8:53 145.150.64.172.in-addr.arpa udp
US 8.8.8.8:53 209.40.18.104.in-addr.arpa udp
US 8.8.8.8:53 15.164.181.195.in-addr.arpa udp
US 8.8.8.8:53 76.98.230.87.in-addr.arpa udp
US 8.8.8.8:53 159.154.64.172.in-addr.arpa udp
DE 87.230.98.76:443 d.delivery.consentmanager.net tcp
US 8.8.8.8:53 securepubads.g.doubleclick.net udp
US 8.8.8.8:53 b844c5245177a9eba4b18f53bdbc2436.safeframe.googlesyndication.com udp
GB 172.217.169.65:443 b844c5245177a9eba4b18f53bdbc2436.safeframe.googlesyndication.com tcp
US 8.8.8.8:53 tpc.googlesyndication.com udp
GB 172.217.16.225:443 tpc.googlesyndication.com tcp
GB 172.217.16.225:443 tpc.googlesyndication.com tcp
GB 172.217.16.225:443 tpc.googlesyndication.com udp
US 8.8.8.8:53 34.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 65.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 225.16.217.172.in-addr.arpa udp
US 204.68.111.25:443 a.slashdotmedia.com tcp
US 204.68.111.25:443 a.slashdotmedia.com tcp
US 52.46.133.33:443 aws.amazon.com tcp
US 8.8.8.8:53 25.111.68.204.in-addr.arpa udp
US 8.8.8.8:53 33.133.46.52.in-addr.arpa udp
US 8.8.8.8:53 d3sts0r8miqkf0.cloudfront.net udp
GB 108.156.50.100:443 d3sts0r8miqkf0.cloudfront.net tcp
GB 108.156.50.100:443 d3sts0r8miqkf0.cloudfront.net tcp
GB 108.156.50.100:443 d3sts0r8miqkf0.cloudfront.net tcp
US 8.8.8.8:53 d18rdcd8evfmy3.cloudfront.net udp
GB 18.245.215.68:443 d18rdcd8evfmy3.cloudfront.net tcp
GB 18.245.215.68:443 d18rdcd8evfmy3.cloudfront.net tcp
GB 18.245.215.68:443 d18rdcd8evfmy3.cloudfront.net tcp
GB 18.245.215.68:443 d18rdcd8evfmy3.cloudfront.net tcp
GB 18.245.215.68:443 d18rdcd8evfmy3.cloudfront.net tcp
GB 18.245.215.68:443 d18rdcd8evfmy3.cloudfront.net tcp
GB 18.245.215.68:443 d18rdcd8evfmy3.cloudfront.net tcp
GB 18.245.215.68:443 d18rdcd8evfmy3.cloudfront.net tcp
GB 18.245.215.68:443 d18rdcd8evfmy3.cloudfront.net tcp
US 8.8.8.8:53 prod.log.shortbread.aws.dev udp
US 8.8.8.8:53 prod.tools.shortbread.aws.dev udp
GB 108.138.233.117:443 prod.tools.shortbread.aws.dev tcp
GB 13.224.245.33:443 prod.log.shortbread.aws.dev tcp
US 8.8.8.8:53 d7umqicpi7263.cloudfront.net udp
GB 18.245.246.123:443 d7umqicpi7263.cloudfront.net tcp
US 8.8.8.8:53 100.50.156.108.in-addr.arpa udp
US 8.8.8.8:53 68.215.245.18.in-addr.arpa udp
US 8.8.8.8:53 117.233.138.108.in-addr.arpa udp
US 8.8.8.8:53 33.245.224.13.in-addr.arpa udp
US 8.8.8.8:53 123.246.245.18.in-addr.arpa udp
GB 18.172.152.61:443 a0.awsstatic.com tcp
GB 18.244.155.48:443 clientlogger.marketplace.aws.a2z.com tcp
GB 18.164.68.76:443 prod.widgets.marketplace.aws.dev tcp
IE 66.235.152.221:443 amazonwebservices.d2.sc.omtrdc.net tcp
US 8.8.8.8:53 76.68.164.18.in-addr.arpa udp
GB 18.154.80.155:443 d32gc0xr2ho6pa.cloudfront.net tcp
US 13.52.31.143:443 www.toneden.io tcp
US 13.52.31.143:443 www.toneden.io tcp
US 13.52.31.143:443 www.toneden.io tcp
US 8.8.8.8:53 use.fontawesome.com udp
US 8.8.8.8:53 cdn.evbstatic.com udp
US 8.8.8.8:53 st.toneden.io udp
US 172.67.142.245:443 use.fontawesome.com tcp
GB 18.165.201.76:443 cdn.evbstatic.com tcp
GB 18.172.153.31:443 st.toneden.io tcp
GB 18.172.153.31:443 st.toneden.io tcp
PL 93.184.220.66:443 platform.twitter.com tcp
US 8.8.8.8:53 sd.toneden.io udp
US 8.8.8.8:53 js-cdn.music.apple.com udp
CZ 104.64.169.170:443 js-cdn.music.apple.com tcp
GB 18.244.155.112:443 sd.toneden.io tcp
US 8.8.8.8:53 connect.facebook.net udp
US 8.8.8.8:53 snap.licdn.com udp
US 8.8.8.8:53 analytics.tiktok.com udp
NL 23.62.61.98:443 analytics.tiktok.com tcp
GB 163.70.147.23:443 connect.facebook.net tcp
GB 163.70.147.23:443 connect.facebook.net tcp
NL 104.97.14.240:443 snap.licdn.com tcp
US 8.8.8.8:53 featuregates.org udp
US 8.8.8.8:53 s3-us-west-1.amazonaws.com udp
US 34.128.128.0:443 featuregates.org tcp
GB 18.244.155.112:443 sd.toneden.io tcp
US 8.8.8.8:53 76.201.165.18.in-addr.arpa udp
US 8.8.8.8:53 245.142.67.172.in-addr.arpa udp
US 8.8.8.8:53 66.220.184.93.in-addr.arpa udp
US 8.8.8.8:53 112.155.244.18.in-addr.arpa udp
US 8.8.8.8:53 31.153.172.18.in-addr.arpa udp
US 8.8.8.8:53 170.169.64.104.in-addr.arpa udp
US 8.8.8.8:53 23.147.70.163.in-addr.arpa udp
US 52.219.221.16:443 s3-us-west-1.amazonaws.com tcp
NL 23.62.61.98:443 analytics.tiktok.com tcp
US 34.128.128.0:443 featuregates.org tcp
US 13.107.42.14:443 px.ads.linkedin.com tcp
US 52.219.221.16:443 s3-us-west-1.amazonaws.com tcp
GB 163.70.147.23:443 connect.facebook.net udp
GB 163.70.147.23:443 connect.facebook.net udp
US 34.128.128.0:443 featuregates.org udp
BE 64.233.166.154:443 stats.g.doubleclick.net tcp
GB 163.70.147.35:443 www.facebook.com tcp
US 216.239.32.36:443 region1.google-analytics.com tcp
US 8.8.8.8:53 178.36.239.216.in-addr.arpa udp
US 8.8.8.8:53 154.166.233.64.in-addr.arpa udp
US 8.8.8.8:53 104.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 35.147.70.163.in-addr.arpa udp
US 8.8.8.8:53 98.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 36.32.239.216.in-addr.arpa udp
GB 18.244.114.129:443 widget.intercom.io tcp
GB 18.165.227.65:443 js.intercomcdn.com tcp
GB 18.165.227.65:443 js.intercomcdn.com tcp
GB 18.244.179.31:443 i.toneden.io tcp
GB 163.70.147.35:443 www.facebook.com udp
US 8.8.8.8:53 events.statsigapi.net udp
US 34.128.128.0:443 events.statsigapi.net tcp
GB 216.58.212.206:443 consent.youtube.com tcp
US 34.128.128.0:443 events.statsigapi.net udp
US 8.8.8.8:53 206.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 74.204.58.216.in-addr.arpa udp
GB 216.58.212.206:443 consent.youtube.com udp
US 172.67.142.245:443 use.fontawesome.com udp
US 52.219.221.16:443 s3-us-west-1.amazonaws.com tcp
US 8.8.8.8:53 io.toneden.io udp
GB 18.245.162.62:443 io.toneden.io tcp
US 8.8.8.8:53 62.162.245.18.in-addr.arpa udp
US 8.8.8.8:53 roaming.officeapps.live.com udp
FR 52.109.68.129:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 46.28.109.52.in-addr.arpa udp
US 8.8.8.8:53 129.68.109.52.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.135.233:443 cdn.discordapp.com tcp
US 162.159.137.232:443 discord.com tcp
US 8.8.8.8:53 233.135.159.162.in-addr.arpa udp
US 8.8.8.8:53 171.117.168.52.in-addr.arpa udp
US 162.159.137.232:443 discord.com tcp
US 162.159.137.232:443 discord.com tcp
US 8.8.8.8:53 194.98.74.40.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 discord.com udp
US 162.159.136.232:443 discord.com tcp
US 8.8.8.8:53 232.136.159.162.in-addr.arpa udp
US 162.159.136.232:443 discord.com tcp
US 162.159.136.232:443 discord.com tcp
US 8.8.8.8:53 10.173.189.20.in-addr.arpa udp

Files

memory/3060-0-0x00000222D8F30000-0x00000222D8F48000-memory.dmp

memory/3060-1-0x00007FFDD2C23000-0x00007FFDD2C25000-memory.dmp

memory/3060-2-0x00000222F3650000-0x00000222F3812000-memory.dmp

memory/3060-3-0x00007FFDD2C20000-0x00007FFDD36E2000-memory.dmp

memory/3060-4-0x00000222F4AD0000-0x00000222F4FF8000-memory.dmp

memory/3060-5-0x00007FFDD2C20000-0x00007FFDD36E2000-memory.dmp

memory/3060-6-0x00000222F6B50000-0x00000222F6BFA000-memory.dmp

memory/3060-7-0x00007FFDD2C20000-0x00007FFDD36E2000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_3CA8D4851DF742BC818FAF1349D5ECC9.dat

MD5 4b1e1d94ea2b3843028e35278193d536
SHA1 db13a43f7d35798526dd7fa47b5b758a5b1107ac
SHA256 836d8212dc2ba7f0d0a46af948ad52328d4893304e27d9788c3e11538a6c534a
SHA512 f40f1c02f16b0b3f9c6523411c9eb316eb0dbabc63f3dbfaa6b0f0c2baaf9cff6481417c21cca9b372aff80fdc797155f334fbcafb6b94c2f4ea1eef60ec6a5c

memory/3060-13-0x00007FFDD2C20000-0x00007FFDD36E2000-memory.dmp

\??\pipe\crashpad_2320_KVVPHXFKQEAYSRXN

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 f9ea4e309248d88719ad98484fcb47bd
SHA1 babb4b6901c406668bd0b21f3b11f65a26769a34
SHA256 955c4d57711a2083dbd0955fd857dda4e2bc5dcf45f7683d4307196833588391
SHA512 d1d32edb78b10f09b5d870ef475e4384dfc363c68ff237235308ea224f307c1df0a496f39b3892ca01c86c1a167d0be01ed45006619e434145f65fd77bf695d0

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 ebea34f247c242cbeab73f82ed51ebb6
SHA1 c4343cf65b6ec1187aaf43b74714247d62967d87
SHA256 33665a038ddcd540f3326bd3db2c6255abe6f9e03e65ca83f29f00454835705c
SHA512 99acf215234f9c919219dbc5137ef4573cdf37884b4c42fe075a00b63d39b5ba732af6527e27727b89e136e5734fc53b86fddbcdbc0cf1973f3f9d0b57c67b6f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 a0985a0696ffdb94363d3ba85b8a2561
SHA1 6a23b29783be9ccaefacc1944f2943004cee0a61
SHA256 4aafc08f822a37f544280fbad26b717cc298d0e41a96580d8581972240220aa2
SHA512 48f871880c3d61c2764c7d1a76831f4ed5825f32486404247191d4c4ec67b919548a50b235021ae482e939bbe78e473e9a3342d46ede8eea459be4f16ec373dc

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 a9fcfddf2c4deb90e4a490606d9125c4
SHA1 d89ef0f7956999642fc144e9b4d6919bca38247c
SHA256 6c83fadddb31d5ffaf34f8a79783a89e99a228ba813ca0336decfdad48a2cfdb
SHA512 2145135b903d44f7551c3d07486b7c5cad0553347a72d12fceeea57b81e806ba9d7018f84e4d8e87cf0fd1469ec87de8408a66a8082af7ed5b8d810fd7de990d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 a72fa4e16e52dc7a5cf136aca8deefb5
SHA1 8a846039c2d309a30f9ff1d30f000aca4d91fed1
SHA256 a2c3a39862f3e0ff59a524e54973d6e582de04131033c7618b2bba0f2547b9f9
SHA512 3d3ae455fd6988ef05ad91dc3180bfd5964b740ce6bac98eb218c0a970d61826cbe09265f404c0ba16008735813434d3ba48ed54aced7244866bb1953c18e5ae

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 6b7915ba212ae10c847b310c9d6095a4
SHA1 f4923071faf835bfd958d4cb4dc49b2333a7dd10
SHA256 16992ba91397dd0f3328151f1d1a5406875a2f68bf08e77683a833eb576a33df
SHA512 f17df8557c15eec85237ddaa533c3085bea9770c58765460ff355f463f790b486f7f930fd622be106fbef03d8721ae214fb82d2c76c9faf3e2d0fcb3ce6573e0

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 f98757b1a60bda9a52d3021c5e24a887
SHA1 5d5156ffaac9651cdac8b8da7e7d7937899785ac
SHA256 16f05acfaa28aee2c4c1f48542870743645d07341fc5c946fb834ce4f393ef02
SHA512 d21864abcc2fb889c7d6f8f34749de6d86490eb80a1ee39ac065d2e7ac341e81fb194237a06410026713dbb4e46bd182fa6844bea4641ef6467df7f259b2569d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 0bc9b1baca151378017f687ef4c49d22
SHA1 9b0872b2b62ede7f220b997d7b2dffd4d25689b7
SHA256 30a7224243f6cabf906e473a2ba461459ee635b718a75e46993e6561236f3477
SHA512 9b833f05f741c4c118bb33cc040b1762e3e285a57170fe7c2d219acc87a98419aebff9c23cead258932b9c0ea0197f0c27da6f1c6ddedd6ee5cf39277984338f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 e31622af627e6f2314534f63c3e4b201
SHA1 7408a865c20a93cdf4cd8e2d25b597583ed7fda7
SHA256 3e3eb5e15b266f7825a427b2b732e229a78b13babf45f6d1a501d1407606ffcd
SHA512 2dc97ccb69d6376292f49ee9d9e881075a4036c47e0147ff393d3e214fbc23a72601030aeef0db2e8312ef036ba1c82e187f91cbda1244cd8d4d54663c016660

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 c3b2d10f0d10ec9b45b347c3e22da331
SHA1 3b793a2dc83d9a9b202afabeb38e32a57ef986d5
SHA256 6783b4480c9c9fcc573612d390452485dcc2bd001798f2929eb8322e8aa81d6a
SHA512 99e9a83497926eee262123ebbd2c0b1f10635a1dbfb5210b4f781342d576ddbc237d8a7b74c523da26c02297ff4ac5f8cb55135a365d2f4f01e1712259fedd1c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c

MD5 87c2b09a983584b04a63f3ff44064d64
SHA1 8796d5ef1ad1196309ef582cecef3ab95db27043
SHA256 d4a4a801c412a8324a19f21511a7880815b373628e66016bc1785a5a85e0afb0
SHA512 df1f0d6f5f53306887b0b16364651bda9cdc28b8ea74b2d46b2530c6772a724422b33bbdcd7c33d724d2fd4a973e1e9dbc4b654c9c53981386c341620c337067

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e

MD5 921df38cecd4019512bbc90523bd5df5
SHA1 5bf380ffb3a385b734b70486afcfc493462eceec
SHA256 83289571497cbf2f2859d8308982493a9c92baa23bebfb41ceed584e3a6f8f3f
SHA512 35fa5f8559570af719f8a56854d6184daa7ef218d38c257e1ad71209272d37355e9ad93aaa9fbe7e3b0a9b8b46dfc9085879b01ce7bb86dd9308d4a6f35f09e5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 6064b774b496814780c4a4d02a06a8f3
SHA1 db5266b39ec8b9f1bc137cb6f1d439d57b028820
SHA256 61dd55b64da33179e0b08788967f463f79b5dcac4b94dd3586587f1681300210
SHA512 cca2adae6dad93a7a8baf1ca185c8e03c91746884605fe0163ba4bfc0a70ce563015c999435bd5823120d2360b80c1b37bbd3195e6bae69534ef25b8ce61e1c4

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 ce57dd6f867656dbbe1ef2147126c2ae
SHA1 2ab75d1c7fbe248e5cd1e7b1eca57d5ec32aaafd
SHA256 c01ba4ede71434b3eb505196aade2c65ee497552c767ab52077e5cc17d914448
SHA512 396b454b0a3d3220b40a154ef5a13a42adb53755c185088bcb1a6fbdc1ddfb39827dbd21ce5c3436025ba7e5028964ebde12200277f5ec5369f70e1cca1eb9d1

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 1a9ce24cbde5a88bdc35a63fbe59dd0b
SHA1 ad81623df9dde636e360da6344be232f92179997
SHA256 b908e27394319c70192a278f580b9d9f5e32624e72e8dad885ba4dd9f8949d64
SHA512 80b5e99178713208e2ffe314170384bc898141feb593061eed838008f73fc8136957c787a9b56db9a783e79dddc9b6fcabb3d6f051b042e19b7cc37c4330ecb4

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5 4a0e84b22c42c08d5b2cb524a67bf4fc
SHA1 e00136e496fce70552df5997c83809a18481d8e1
SHA256 38f567cc7f2f2e3d831090fdfdfccc1f78b046d624e027df455f3d2ee3717a2d
SHA512 2b3e669920b3eee9c7d93a7229a95e15e7301470e3c2e4379358eb4a351ee3b701ccf5ba3ed7de5a45c4b2bc61074bfcf991c9abfbf051bdb412eb71a4c6efb7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5a0d7e.TMP

MD5 2a1ef12aaa65226d50922969307aff90
SHA1 513abba60cc02899766d8d18470805344ebb2b37
SHA256 91d462b69d0f954b64e9c475f0cf98e173ffe7b44b5fcc91b4447e21dabaf47a
SHA512 facef98af9927cc134a0f3cfcb9e89dd89be3e595a8f2e995cd1913e50b0d8044ed48ba28aa287e8cc12af7e492db159ff8bca22079c33fe0365c9953d2b461d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010

MD5 5d4114cb033dd9abefa79daa8bb1fce3
SHA1 403170941671bb5c568c2a535cfc5d3e0c6798f2
SHA256 6d6e9e73e627d6becbe74b55cd632ced17a11df4e70a99ea305e76184e13dc2e
SHA512 8df0ac9df4d07c8d5572e5cfbd94f1d30fff4a8346bc6807f864550c78fa3293595eabdada7e669192d6b0fac47c06032bc94120ee9a3d4445791e865b54bd28

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011

MD5 989f75e894f728b36d6b1608a96fb908
SHA1 c5c82edad1b5668b151799a74e017a16732072ee
SHA256 32a2da14d39f556bcd2747be3b2599227b6feb35c4e06d5ea5402c03562b4d1b
SHA512 8f1aac4b0841caa18302b2313629ce7002d251a4e4e2f2839a987667501a43f2785863c647dd87139a3bb866a103aae2fb423425e258bb9ddfd912f499b7b97a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 ba69564da995551c88e537dfc1dc0851
SHA1 f8366cf2305c781dc66e6d8d3b7bc3ea9bbcb806
SHA256 0ea7c6fffe5bf554c1e6ea94cc5ea226476a1c643c2f552e2f2a9c3b8eb4b5fa
SHA512 5d968cec0df5c0c74d48504c0c3c8a08d8fa9ee6e2a42ed5e6f25bf884228c99dc69e8a324888f21fa6429f0f5e7c31124e8583d15ab7f8a14cedc9f08a2ecce

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 0f3b5342b4e073505f3c1d5f2e85b3a4
SHA1 5cb8f59c4ca48019e7fa3c51da532e17a69578c3
SHA256 9d116a181a9ba10573877839b178ca8bcaa34b8368c64da7f6c546c7fe23a558
SHA512 8430163f1b09eba4663284ead543ed0674526a65e0e9149cdd7cc2ca908aafc2bd659496fe27988971b90ecb9731ed11d9a9014a11b08ec5f443cc7691696f7a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 e411f4c3705164776bd66675268a018e
SHA1 9f7a2529442a7e265e88d119655a9a14f629a95d
SHA256 1448a8ca3f7008c0b5c894d0cbc4a64f0f982b292755c68f74efb128133ee062
SHA512 2637c06473566791663ef57c60d2f9b081d4644bfcd93c0d05d52dd1c4afab2e85ea606816086a289f02fdddd3f7f57939b4e092154a6ca55a33de4e1ccd2a0e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5 22376a1f53d4f46c6ab3ade2475ba4d9
SHA1 573c0d67912ddc2bb7e16dcebf345016692d6d0f
SHA256 54e8842c6f9131aa0e3b20a0672d73ddf1ed2555ab93f80705d677567150180d
SHA512 3fcdfe8bfebb7e3d4103156e54dd07d953e01d1b725491dc4d5a1a6e5fde729f733c84814252946d67413d86e09da028ab191af157e3bdb91338d4dce0bd6b95

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

MD5 caaa5222d179a24ca5540080c7018b99
SHA1 1f415a7a73a12a4c16f25709504f4e4e4beae9dd
SHA256 b729255f2e984a20fa0f0eb07e08368cf468fd17ff27a7d1dbb4042ec261d8cf
SHA512 71b4f878aa154ba4a8523c2e36faa8dbe3cfafa082b18796d8b69539dee9506253b9e55fc9b71cc2c9027d22ae08587b0e2ddadbc8d3395dbb73584d1ca1ebcc

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

MD5 98f0015e532ec7c6c690752f1870295c
SHA1 6b70dd62110dfb1a42f88b64d16a56f10eecdc81
SHA256 28d7695657d7252d8ecef47fd79b8b950663fb7b9668d54220f2390230b0ba4e
SHA512 8778cb65d5d986b35a3ceae8a544c1fc2dcc9d853cceb0a8174c6943608e4369fe95cb54eb187f5b7ea95cec3c2392bbee2ff6ca66a9532ac066bfd2079c7607

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

MD5 1c18f1119c1dba66392ac3da2961651f
SHA1 86308323aa6a7fa879495df25a376380abf5d776
SHA256 1723a5a0c95d70336642e9abd99951b98a6a90a2e5df5da6ec4a32d819e18689
SHA512 da8d7eee3f4bcef10c8b3dfc6d5f781dad18e95189227b33ea60564e9295a29764b19c86dc8a3179ae8355c5dd262ad2276398532aa05b3b741f62d5963b240f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 231bc26410235334e6fe38691c7e643f
SHA1 efde5a0ad0a76923b55040bd0e35c174aeac309c
SHA256 f145ca157c6b99f146980de3b7f8b4b893e183a9a22d476724962159e53e11a0
SHA512 a8c672f0727cec94050c3318fae15537b31b0df15a16bd19d5cb852c8cca7efc6d0a9682667a55dad4c661783baacc6e84f5f00778f9c33860abb9c04456c1dc

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 6ecc3d882023b2b1646bc57bae5700f3
SHA1 40922a3309d3fbdf6f75b91f1067b1c1a05fb7db
SHA256 b582ebd75969976311939839d69a9bb3cc966bbbf0e2d28c102f1db21d50641f
SHA512 04d503e00f99a125927c58f0554ecf227635e13d227d57023c0b2cceebb7a7aeb0e2e664bcd94eb09fe8b6a07b6bd640a5658e93cb4d6429ee40e161fde9ff1b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 823732ac16893d8185d37343ea84edc7
SHA1 d0c2defb52897013f6c7707dbdaef187b72a43a7
SHA256 7fb0e84ccf39e94d3257740cd06db2757224812295a730156933463a3c441a8e
SHA512 133dbaacebfa31f65cec69bbf0a97cae3afedddbfeeda8a1c41ac53565362b3c937ba3f320a9b552b7c1a9ef081060cc79f64caba8876575495b8b017c1b8467

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

MD5 832af5bdcbd01ffbb810d0625a7032ba
SHA1 3609f1a4fda4953438dc782fb1b972ebcb2fec9c
SHA256 641a15f5c42742d69eb986dcd1754a8ecaf5620fba48ce8e1f877dbe259779d0
SHA512 ca0e91280ce69ec016894760cdb66734af1899303e32c7a1ef217b030c70917da36332fc40993a5413d817000fe98cd4c4cdd75ccc98549ad0b7d0d396dbe371

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 e1f64e17b68ce2b2482f8a0457b68880
SHA1 6dc40ad0a67f21aea8d4f2eee9031a7362aa2fcd
SHA256 91b52b33888ba0faddd1168e32fd1ee907de1e6117f2b52eddf54335a34592c6
SHA512 547d316e3db60e652fe001000847fd641fd2c1e8d2258166c713631889a51e20e44dafa56c71ee6fef741f80c36494809d602a3c7d1accfb5192f9b1baae9d32

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 16eac2813e0ae7fa398d320bea04b14c
SHA1 76b4109018daa964a543a6483ef47d29d36c6a17
SHA256 5d6f15956e1d432e4f6d0ddee17385f51110389d22cfaa43b2c2fdf23aedd20e
SHA512 e8dab55324f86d9e58e38db5f01195dfe58c52b18981661ad822c3b16165fb54a750d06fa4e6a4520e7f253f68a2e1554594f207f378064ea8321071817be7a5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 204103d6040012d773a2566ab5c98e43
SHA1 3c341d1a7ca3e2c300bc69d576c67a0f849aed74
SHA256 b7f12db67db92ec05ade1442209c9b43d721217e13ed9ec903919e4a12c6258b
SHA512 82be97df4856049c8ea2553d3ac2e1ee49500327c1817955ef10d640949c10477d77c2e27d0c2dbb5d5d84f0e1ff04f717b8d8bb321d47c6f5526c5d43f61b75

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

MD5 78034a6e8de00aa76b5f05609b3c9846
SHA1 5e05bb72f012a49f32bf30fda7fcc6f518bb103a
SHA256 9454769c9695e0fd7329cd77a6322ea7c61f522ca550b7f0920855b561226dd1
SHA512 bd70150d5d4a4cd273b30c4707ce81bd2a440d9bfe92caf54f95f2e41d9310f350c901c33044844d6576e618572ecdfc290bc99791f9c05127aecfe245d38771

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

MD5 da7892ac27884a221a5a44d2d82ee1b8
SHA1 9f40b64222168032f6eddc98f361a374d2a8a089
SHA256 a9b2725f39902999b302fa0d0dc3b1ddbee8b6f946ad50c5cb00110b79de890d
SHA512 13d06be997e0d0fa542578104034cce82a274b77b72eaf7843b2b016fa99c36e4ad4f9c8d88b2b8622bec3490e296c3b53478162453bb460b2dd50a1b6c1c818

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 aabad53cda4891bad4e2797cf455ff8a
SHA1 e89f49f96c11936967f41dfe98a2c15010d63d85
SHA256 3b6636ebb7bb3a748d9417b08f56d0bf24a2ca1260d92c37878910cfd4c210fe
SHA512 dda403c9b92b6dfb58fb4d2c2b3ba3e03873209e84c72c4afbaf6da2bc675d8085a45b3cff4b75b871d2fa310aab9b469c8d341e8587860f46caba2c3254fda4

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 51740698ec3c39730579aff8668be1cd
SHA1 766bfa09f13173b52364e9c9f37d57d7bb77232e
SHA256 ab9504e2a775e1e7c583e7be2d08ae0e543e3838d26a4dbeef540735cc766c46
SHA512 d5808e3623a64f674e83159d3a291a062a4a9d36dba0bcbe852fbabfac0c679d19f03c85bb8be4b15c3d36d6a1796d2aff5f114eafd27ba6021226e01c2e27fd

C:\Users\Admin\Downloads\fortnite aimbot.docx:Zone.Identifier

MD5 de3430b3c4684f172671ec9382bbf2f4
SHA1 1572ca3491f9ec76c8b17bc3aa9aa8873efa7a5b
SHA256 2ce17002cae285d62ab906b86e9c02daca9bc087ebe0b1c5c7f81e016fc8e76d
SHA512 9ba66247eb6d6b9e3a8395bab808a961a5f3cd249fbe7132f8c4ea75887d8f3d3ba30a74f064c62c78a9fd7b7af12e26f09924e3f266c764b0312ab206c7a99a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 edc165150e8bf78ed9ab01e390251915
SHA1 b2193e133f33af5ccb543e38506beb9cf1936c4b
SHA256 be7bb9f9a7d3fb29097e9f3f6589a81548fad8696bcc66b3387c12027486491a
SHA512 aec2c936c3d5645042d90e2245aedf58e93527b8fa33ca19c5fff75d46edbfe579128bd045bc5669c1ef28cc662757701e453adad2431bd975de5dd8ee7962e9

C:\Users\Admin\Downloads\fortnite aimbot.docx

MD5 e6829859e3fb02961ca5597586f65203
SHA1 19248cca13e1c64d75933f8b8febc5937df25743
SHA256 6ee02c57c5e326da73c444c57a2f8672bc25be1d17619fc5caa9764a4a39c7df
SHA512 2987e70201ae8059ad17f9a85d47a07b3b8ac9ed695e773c28dcf12b6ff884e73825f0e1e5581e2a9387df43b6bc06b2636254db3ab28472caa1884339fee765

memory/4532-945-0x00007FFDB3E30000-0x00007FFDB3E40000-memory.dmp

memory/4532-946-0x00007FFDB3E30000-0x00007FFDB3E40000-memory.dmp

memory/4532-947-0x00007FFDB3E30000-0x00007FFDB3E40000-memory.dmp

memory/4532-948-0x00007FFDB3E30000-0x00007FFDB3E40000-memory.dmp

memory/4532-949-0x00007FFDB3E30000-0x00007FFDB3E40000-memory.dmp

memory/4532-950-0x00007FFDB1290000-0x00007FFDB12A0000-memory.dmp

memory/4532-951-0x00007FFDB1290000-0x00007FFDB12A0000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

MD5 452c0042a8e87ac3ca01e9ebb9a2c897
SHA1 3e0d096abda1a0742c70e7c6a33a444b0f5b6dde
SHA256 b7587f47748fc0fa153fc560a78296b29b9ad396031f66cca9d8acdcc822f3c3
SHA512 9d894d1ada9d846b58cd38b136abbd7ab55fa8fef449a53cf35716b11575270552096be9c37c21c44ca97192039abcf41d22b2206c973a6d588120296332195b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 b57c133dce2dff9e08823533afaa089c
SHA1 d52798b1d9e246ddb2de406cdc9a1abdb450f47a
SHA256 b294e5eca3444540c56ae03cfb1ddb7dafe64c21b9287fdc650de01545a735f4
SHA512 6277441b2ca89be61651a0143d065031d70ffa50433d288557481b2bfdf5ec0d163063980a2a0130bc8020e830a3a92494417b5a2ec66dc955203708e17d0899

C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0809.lex

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 f389efab8562a50fe70948196f73628e
SHA1 5593128363809cab9de4dd6443ce9c71015841a5
SHA256 b6818948964f224db9eae529611619f7c16b62e6e4d7f4fe454e7fabd41dcd66
SHA512 e9e27922778c33a17d0f8004c86c9421d3cf06c775cd728cd1aaf0aedcb669825952d5f706193063936840fcd5becc4d33517181f77374ca6ef14124e0432d0e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 18c5b6925d871a290210c87dfa0d5953
SHA1 408c8c880c07500429091d80bcec7d2f0c16995c
SHA256 85848d56e74d4240dc416524e9e2cba13b31f19a19f05f604f3c8adf71b42c46
SHA512 77312721b678e7d8bd2a8494fb97b5d01851c7d9a9c2c625d3ab54b1aa8b548200bcf650aa979df4739e58711fcc3ec099f6c8de8c7766fa322153bd0e4d5269

memory/4532-1021-0x00007FFDB3E30000-0x00007FFDB3E40000-memory.dmp

memory/4532-1022-0x00007FFDB3E30000-0x00007FFDB3E40000-memory.dmp

memory/4532-1024-0x00007FFDB3E30000-0x00007FFDB3E40000-memory.dmp

memory/4532-1023-0x00007FFDB3E30000-0x00007FFDB3E40000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5 980b3ebd4fcfb36f5f6a8251fdb14436
SHA1 a16774d572347851d463e5c1a57e914e469e938c
SHA256 5bbdf45b23235d79b1fd4c4332a28cada3736cd81fb757f9dfbc875e3ece78b0
SHA512 c6339658a438bafb861d5b1ee32c47c6d491947ff41049f42d4b70581750f69d7773d7d7855a2ec162c59ba76a2cb4e4408874971c22c841abf19663b7c74b1a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 d957021ad6532026836b870d9df13dfb
SHA1 3724c239ba2425b7641185b1cf44a72b141ae9e8
SHA256 4f5047ecdaee9f64cb7817e9287a3eac99351bf970f088de85bd7a7ecd198ca8
SHA512 0ea885b522015f5ad8ae118dcf84f79342338f9f48228a577bb21e2ff2e95595061d9b0996f4df020036bdd3a01d42c40fafce496e7bbeebc608332c4d8fb2be

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 66a6532ee8c13653d5c57ec7a2e8641f
SHA1 bb3b44c9397d2acb5edb6151645ae032c7f0be7a
SHA256 c65fedd57b57ae6aa34bcd7bba50b93a8926efabf1ad5789c87c203aa12ba791
SHA512 a5c84ad56d40a3997fd4bca29cba4b1048a7ff49b6da4cd03bb55c2b209d65006666e65f14293d4274507bb448eba6d9539dbef4ca3b7789494766030e021cfa

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 2f74097319c1a067d6991ab2e3966d72
SHA1 f880ec86636d07dbd1c184a6d930bc314ede6d43
SHA256 949876cad2fac74a111af4e970cc9792d16619da64232b55ca4e7aa6b4bb661a
SHA512 11d8acc8fef792a13c5981827f0b937e6fc7639496b5680ba7e308fcb460580fd974840adbf1517015ec0fbf98bad62ef44ef0e4659e2f22deebb95ef2813853

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

MD5 d43027b022d0deadd13503fa32b4cbd1
SHA1 9bc33a675d41d0ebed0bbbe5f7f95ddcd8a5ed28
SHA256 493b9eb7146576f45590ca13638a6fa9337f57fb20281df61d5230000eac99e3
SHA512 b79f0e8d292382b794ee2c2487ca2f3c8b98850dc0f10d60af602bee2926946b2190aed4309c20137b0da1c28768cc744647703e117d7ea2fd029c9f7e46f2d2

memory/4396-1173-0x00007FFDB3E30000-0x00007FFDB3E40000-memory.dmp

memory/4396-1175-0x00007FFDB3E30000-0x00007FFDB3E40000-memory.dmp

memory/4396-1174-0x00007FFDB3E30000-0x00007FFDB3E40000-memory.dmp

memory/4396-1176-0x00007FFDB3E30000-0x00007FFDB3E40000-memory.dmp

memory/4396-1177-0x00007FFDB3E30000-0x00007FFDB3E40000-memory.dmp

memory/4396-1178-0x00007FFDB1290000-0x00007FFDB12A0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.SurveyHistoryStats.json

MD5 6ca4960355e4951c72aa5f6364e459d5
SHA1 2fd90b4ec32804dff7a41b6e63c8b0a40b592113
SHA256 88301f0b7e96132a2699a8bce47d120855c7f0a37054540019e3204d6bcbaba3
SHA512 8544cd778717788b7484faf2001f463320a357db63cb72715c1395ef19d32eec4278bab07f15de3f4fed6af7e4f96c41908a0c45be94d5cdd8121877eccf310d

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\E1D1C088-701A-44BD-B102-D17468EF12FC

MD5 018f2e9cd0308aec8b757aa05d2e0348
SHA1 6e47825700f9fce5f5f4e66b295177721e2b54b9
SHA256 ae6f4e484692498b20cbe6c1817dc5dac501a868ff5e81722a31f31de91972cc
SHA512 af00d38262eb09137f69ca55a1afc53321e4232fc8e9349cdf4376e599e898faf34d15e2c4244ca5361febebfecbaf892458b0fd53b5f2ef1072b05701e0de5f

memory/4396-1182-0x00007FFDB1290000-0x00007FFDB12A0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.CampaignStates.json

MD5 f1b59332b953b3c99b3c95a44249c0d2
SHA1 1b16a2ca32bf8481e18ff8b7365229b598908991
SHA256 138e49660d259061d8152137abd8829acdfb78b69179890beb489fe3ffe23e0c
SHA512 3c1f99ecc394df3741be875fbe8d95e249d1d9ac220805794a22caf81620d5fdd3cce19260d94c0829b3160b28a2b4042e46b56398e60f72134e49254e9679a4

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.GovernedChannelStates.json

MD5 c56ff60fbd601e84edd5a0ff1010d584
SHA1 342abb130dabeacde1d8ced806d67a3aef00a749
SHA256 200e8cc8dd12e22c9720be73092eafb620435d4569dbdcdba9404ace2aa4343c
SHA512 acd2054fddb33b55b58b870edd4eb6a3cdd3131dfe6139cb3d27054ac2b2a460694c9be9c2a1da0f85606e95e7f393cf16868b6c654e78a664799bc3418da86e

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.Settings.json

MD5 e4e83f8123e9740b8aa3c3dfa77c1c04
SHA1 5281eae96efde7b0e16a1d977f005f0d3bd7aad0
SHA256 6034f27b0823b2a6a76fe296e851939fd05324d0af9d55f249c79af118b0eb31
SHA512 bd6b33fd2bbce4a46991bc0d877695d16f7e60b1959a0defc79b627e569e5c6cac7b4ad4e3e1d8389a08584602a51cf84d44cf247f03beb95f7d307fbba12bb9

C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\fortnite aimbot.docx.LNK

MD5 834e27d80dad93aef8e7cf8f2433694f
SHA1 e59d4983dddff56d8a97bb68f31f27eb8d51001c
SHA256 f824b1f5e58c5cd0412c50ec716cf1d32119bdbe346f5d1b64c6fd7d8a948fdc
SHA512 6b7306e2dc055e44e949c5d1b418569e434a748c2af93d469f77a7b7d3ec98228f335ffd5a674f510813d6736d65e385267a9fbcd7f0432fa8291a14a57a73d6

C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db

MD5 b00f3f56c104c94e03cd2ad8452c14e7
SHA1 51b78e45015e0d9d62fbdf31b75a22535a107204
SHA256 ba2b669020334ff01a85bfc900ea4371ea557bd315f154875d9bdfdc16ae8b50
SHA512 93e1609be5bbb414c285f37432ce93294c3d1583ef46c7c6c570c122f0b166c34b0ad87de708005c8af97dee27923ba53395a34c2563cdadf3c0a708848b3525

C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog

MD5 990b03bbdd8bbd78fc11d63f56a5ebfd
SHA1 547b17491dadaa974a686d1370ab2916070888c3
SHA256 7bdb6e1f8b69afb3b0cb79e58ca5b0d06e691b54fc897032293e10aff38ec08d
SHA512 9b6736ff6ad9f9e3b5acd3c150dfddcb38b0cf569a0899aaa1a2dea46bd8c33b614133ef345b6caef6fd26fb83272c8205bd56be43d000d8cf574db902008d8c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

MD5 3ac0940190f50b40d4ad5beaaff6cb4b
SHA1 25e6ddc0e65895718c948ce1fb1341c85139ee16
SHA256 91a10fb1dbfe58f66ffa25677bdcda28f823f9978cd4e3c83f77fbea64673688
SHA512 7605197a7f744f98a62cec042447a1fbe99e794ce51cf600a6fcfd9509e4a83642ed8f66f3787d742331832f1a8df8827f29598c54cd76fd42814d68a52a5561

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

MD5 f40b4e4692f6a96423dafcbf5ff89e6f
SHA1 9e5cc9c388de3212d974bf7a0106126cf38c89c1
SHA256 378cdb654afeba1c790fab544a148bd30d4317e68e1b9cf8d73a001eedae2ed5
SHA512 de91b6397e9bd5f756fc6641ffa04c58c099db030ecc7d6990521542c8b92bc0c6fee71ba351a0ac2efd9aae1f0ee2353dcc32032fa819fd529f7e36795faa4d

memory/4396-1221-0x00007FFDB3E30000-0x00007FFDB3E40000-memory.dmp

memory/4396-1222-0x00007FFDB3E30000-0x00007FFDB3E40000-memory.dmp

memory/4396-1223-0x00007FFDB3E30000-0x00007FFDB3E40000-memory.dmp

memory/4396-1220-0x00007FFDB3E30000-0x00007FFDB3E40000-memory.dmp