97394c6d3371e8e3dd62d70ebcda4c8ad02b6a6c9bc69b38eb5fef22f030533e

Analysis

max time kernel
1800s
max time network
1702s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
28/09/2024, 02:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LOUD (1).exe
Size

6.6MB
MD5

0dff13e4c70c094b2972d640c3695103
SHA1

5769dc915217ce43551ad3eddacdc893d3fbc1dd
SHA256

97394c6d3371e8e3dd62d70ebcda4c8ad02b6a6c9bc69b38eb5fef22f030533e
SHA512

a53105e4b711f7734e2f1f45f632d54961c57451554440a12e6beddd43cf248aeef340e59d01693452dcbe788b635112275572012c10b06855a91736bc63de54
SSDEEP

98304:mMamq8pxmx/ZRCJhO1WnVfv6UuaBdZGxTFOgpFbjEIRYd3ZR4zyrIiZf5VhZrIq:mtmZpyh8bVnxBdkxTbzXGdJiiZfrh

Score

9^/10

discovery evasion persistence spyware stealer themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	LOUD (1).exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	LOUD (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	LOUD (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Installer.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	outbyte-pc-repair.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	Installer.exe

Executes dropped EXE 14 IoCs

pid	Process
1488	VC_redist.x64.exe
4344	VC_redist.x64.exe
4864	VC_redist.x64.exe
1904	Emulator.exe
3660	Bfsoy.exe
3684	Bfsoy.exe
4216	Bfsoy.exe
1352	Bfsoy.exe
2660	Bfsoy.exe
520	Bfsoy.exe
3900	Bfsoy.exe
1336	Emulator.exe
5076	outbyte-pc-repair.exe
4704	Installer.exe

Loads dropped DLL 29 IoCs

pid	Process
4344	VC_redist.x64.exe
4916	VC_redist.x64.exe
5076	outbyte-pc-repair.exe
5076	outbyte-pc-repair.exe
5076	outbyte-pc-repair.exe
5076	outbyte-pc-repair.exe
4704	Installer.exe
4704	Installer.exe
4704	Installer.exe
4704	Installer.exe
4704	Installer.exe
4704	Installer.exe
4704	Installer.exe
4704	Installer.exe
4704	Installer.exe
4704	Installer.exe
4704	Installer.exe
4704	Installer.exe
4704	Installer.exe
4704	Installer.exe
4704	Installer.exe
4704	Installer.exe
4704	Installer.exe
4704	Installer.exe
4704	Installer.exe
4704	Installer.exe
4704	Installer.exe
4704	Installer.exe
4704	Installer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/4296-0-0x0000000140000000-0x0000000141047000-memory.dmp	themida
behavioral1/memory/4296-3-0x0000000140000000-0x0000000141047000-memory.dmp	themida
behavioral1/memory/4296-2-0x0000000140000000-0x0000000141047000-memory.dmp	themida
behavioral1/memory/4296-4-0x0000000140000000-0x0000000141047000-memory.dmp	themida
behavioral1/memory/4296-6-0x0000000140000000-0x0000000141047000-memory.dmp	themida

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{5af95fd8-a22e-458f-acee-c61bd787178e} = "\"C:\\ProgramData\\Package Cache\\{5af95fd8-a22e-458f-acee-c61bd787178e}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
86	1468	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	LOUD (1).exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	bcastdvr.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Drops file in System32 directory 51 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_threads.dll	msiexec.exe
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File created	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File created	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\mfc140deu.dll	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4296	LOUD (1).exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58bcd6.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B8B3BB4A-A10D-4F51-91B7-A64FFAC31EA7}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC565.tmp	msiexec.exe
File created	C:\Windows\Installer\e58bceb.msi	msiexec.exe
File created	C:\Windows\Installer\e58bcc3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58bcc3.msi	msiexec.exe
File created	C:\Windows\Installer\e58bcd6.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e58bcd5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC3AE.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{59CED48F-EBFE-480C-8A38-FC079C2BEC0F}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBF73.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC12A.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	outbyte-pc-repair.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Capabilities	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009	svchost.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	bcastdvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	bcastdvr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	bcastdvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	bcastdvr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1A\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1c	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1d	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133719626030702377"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1B	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1D	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	rundll32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A4BB3B8BD01A15F4197B6AF4AF3CE17A\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{59CED48F-EBFE-480C-8A38-FC079C2BEC0F}v14.40.33810\\packages\\vcRuntimeAdditional_amd64\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CD29F47F-05A6-F78F-29CE-C54BE9BD3946}\Version	Installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F84DEC95EFBEC084A883CF70C9B2CEF0	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\ = "{B8B3BB4A-A10D-4F51-91B7-A64FFAC31EA7}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1\F84DEC95EFBEC084A883CF70C9B2CEF0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{59CED48F-EBFE-480C-8A38-FC079C2BEC0F}v14.40.33810\\packages\\vcRuntimeAdditional_amd64\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	Installer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F84DEC95EFBEC084A883CF70C9B2CEF0\Servicing_Key	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.40,bundle	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.40.33810"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A4BB3B8BD01A15F4197B6AF4AF3CE17A	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\PackageCode = "0F1976868EAF8784585CF1DB265C6A81"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Version = "14.40.33810"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\ = "{59CED48F-EBFE-480C-8A38-FC079C2BEC0F}"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{B8B3BB4A-A10D-4F51-91B7-A64FFAC31EA7}v14.40.33810\\packages\\vcRuntimeMinimum_amd64\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{B8B3BB4A-A10D-4F51-91B7-A64FFAC31EA7}v14.40.33810\\packages\\vcRuntimeMinimum_amd64\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	Installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.40,bundle\Version = "14.40.33810.0"	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Dependents\{5af95fd8-a22e-458f-acee-c61bd787178e}	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\PackageCode = "A40E8013387385E43AA0F61A9357B166"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle	VC_redist.x64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CD29F47F-05A6-F78F-29CE-C54BE9BD3946}\Version\Assembly = 99ce9c631a54e2122a6101605ef2ad7a99ce9c631a54e2122a6101605ef2ad7a88ad8cbb5ed3f66b83a8a2cdf194269c890bb34aebd806e41a50d3bd9c0b4765219909f09e75dec0927ff4e8152284cd219909f09e75dec0927ff4e8152284cd59b5414605bae21e9735786eb516d3f8de1283c2aff9bf99d33ed2740c86bbd2f8157495fe950fa4a01046bb55f00dad0f20aa1b1adfe602954529934d03147d	Installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8800A266DCF6DD54E97A86760485EA5D	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\ProductName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.40.33810"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.40,bundle\Dependents	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\Version = "237536274"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8A567BD6FA501A947AD1F646E53EEC14	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53\A4BB3B8BD01A15F4197B6AF4AF3CE17A	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F84DEC95EFBEC084A883CF70C9B2CEF0\VC_Runtime_Additional	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle\Dependents	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.40,bundle\Dependents\{5af95fd8-a22e-458f-acee-c61bd787178e}	VC_redist.x64.exe

Modifies system certificate store 2 TTPs 45 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ClientAuthIssuer\CRLs	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\Certificates	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\REQUEST	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\REQUEST\Certificates	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\Certificates	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\ED72EB69C2652296528E0556C745CB0BB4B47CAD\Blob = 0400000001000000100000003b214d5db3574edc39295a92bdc6f7c80f00000001000000200000008cc225ba3a343f842ce131e1e899aeeecba689606333ae67af058fbf270f4de9140000000100000014000000ce514d070120d0a1cf566514883b91eb0efbef891900000001000000100000002f63b7e6a0a6ae00c7b4032f44778e67030000000100000014000000ed72eb69c2652296528e0556c745cb0bb4b47cad5c0000000100000004000000001000002000000001000000850500003082058130820369a00302010202141d4057e0a1838c7fb8d3e254d1ab74ac64938178300d06092a864886f70d01010b05003050310b30090603550406130254523111300f06035504080c08497374616e62756c310e300c06035504070c056369747974311e301c060355040a0c15476f6f676c65205472757374205365727669636573301e170d3234303930313033313330345a170d3237303632323033313330345a3050310b30090603550406130254523111300f06035504080c08497374616e62756c310e300c06035504070c056369747974311e301c060355040a0c15476f6f676c6520547275737420536572766963657330820222300d06092a864886f70d01010105000382020f003082020a0282020100ddc16ba6a694b23afddf7489c59de59d20e844d428f37be6da0eb0a0cdf100b323836a8cb354c75d7baaa87f22d36386a3264c3bcc08c9663a964e572d0da7e7eb3b51b57ec74a7a0ea32b9bd33f623199dc44d1c6f33d5f1388fcbfdd91e5186bd64586b75aa93f2dec25803c6fe1ac41ab42b56f11e1a5c7a45e3100f94ad55e8fc36bc7963327a25cd2f5730bbef3c20da896871017a05917582159e4748646467e21d8813d9e01e8ccc0d31b82617290880006be579c2eacd487ccabfb2bb651ddfe9cdcf8265a2d11a74d707e599e121db853efb5b66be2afc2fd670dd142980bcb339a6951e8fb8a1afef6b60525b9bec66ec7ef3ab4c207d89f616356ef26da161d2931fb2ed429529cfc1a6587914ed8390c27531e36ac44c8e1aafe5fea8b34133936a2f59e038599860704328690059be87535902d72dff0d79728799143f46a7e83d8549ea64276508c07bf3971d273d9e51b23fb5ec8e36a9913ddbf0c40d74267de521a404440c7bfcdcf31b214cea922d6a8f7010736a3a0b1b30a09cddb22de65a9636ed17de2142337f534cba112aeb89d0e374bc490c2e4ae6665173b00839f70513e4c2400bea5a1fcd4e93b1744762cd8d7278364c99f8ceae1b3f9a6426fc253ef7d192d6d87f5f446d794512e89fecec3a5bcaff10f7d4b441164f704fc5698039e02a0c636ee497f51628b6417e72caf531b73efd50203010001a3533051301d0603551d0e04160414ce514d070120d0a1cf566514883b91eb0efbef89301f0603551d23041830168014ce514d070120d0a1cf566514883b91eb0efbef89300f0603551d130101ff040530030101ff300d06092a864886f70d01010b05000382020100c5bad472ed19b7967102e4e7d6c0c701b7910bbe2b83efb46833f8aa1bb8aafd68d9d1d0cec9ef84b523ca393a29de51d1b762f7d8746e5d178c4a77be4f5e5ae5d139977a5564c5a3bda57fe59f03458f2ba85d816ef24c5a13e83423f57cfcbd2f425120db7e3611669926d68b0b4311d76164dc29ad1ecbe9225545528ebb45984c11e08892ba7cabbf076307b83a7b4e07fc1bbbfc6ca940c9828a0fe4bc124883f36b42d7262400631e97f4aad83a215a943f2aa0e48172d710b018e9186dc031a839aed5a4449e95f8280a415a61821c0c26c6f4f868d57c21677e2126383b1b04a1e24b4558e489ee7fe4af6dd21ece9dec10b1d6faaccc8eff208e9683de75461e57c4a278dfca21856a68e8ef917ba901b282eb711bd5fcc323070d65e48731aa7c623276fbd4e3011d1f00d07c05a8e875397ed7a68379e98cd0e4708c934e7123e526de0992ca0abf3b9973704f7ba2b1b5694aedb8b42fa9d11d579a9c9c4d1aaf2c3cb246dc10a622713d51ab3627e08bda1053f478fbecbd9d1d55cae80bc0217c1e79423b4d13b611749ed62fd5a03dc8e0087d213f157b36f2b9d2c04803fe6fd3d017f3f12f1a6b0bfb92082ca688c1ebb149dae35b86f6555e0fca770f7e4acec75ce76431a1191aa6418c191fbdf6cba9e7454ada5fbf19877573f8d226f858dd4e37847ec69f93304f3bc0ae82e5882ec034326c6890	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CRLs	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\Certificates	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c00000001000000040000000010000004000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	Installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CTLs	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ClientAuthIssuer\Certificates	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\Certificates	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\REQUEST\Certificates	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\REQUEST\CTLs	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\REQUEST	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\TrustedDevices	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\ClientAuthIssuer	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ClientAuthIssuer\CTLs	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\FlightRoot	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\REQUEST\CRLs	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\ClientAuthIssuer	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ClientAuthIssuer\CRLs	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\FlightRoot	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\CTLs	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e404000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	Installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	Installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CRLs	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\CTLs	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CTLs	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\CRLs	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\REQUEST\CRLs	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\REQUEST\CTLs	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7976D14BA502C95403263A0AEE2A91DD357AAEB1	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\ED72EB69C2652296528E0556C745CB0BB4B47CAD	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ClientAuthIssuer\CTLs	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7976D14BA502C95403263A0AEE2A91DD357AAEB1\Blob = 04000000010000001000000007a3e63b7cd74c7a657eff7a33b2ab420f00000001000000200000001b110b5e195a2b4ff8d28a7b4b157708365b9f1d3f6f37133dbbf539bc4a32ab140000000100000014000000083b341918bc733b95b92864b57878f59ee4d44b1900000001000000100000007a0ee6665f7c51b3587c951eb94d94e40300000001000000140000007976d14ba502c95403263a0aee2a91dd357aaeb15c00000001000000040000000008000020000000010000003f0300003082033b30820223a003020102021425827126fb88f0d0167cbab089371092a40c7571300d06092a864886f70d01010b0500303a310b300906035504030c024536311e301c060355040a0c15476f6f676c65205472757374205365727669636573310b3009060355040613025553301e170d3234303832373136313130335a170d3235303832373136313130335a303a310b300906035504030c024536311e301c060355040a0c15476f6f676c65205472757374205365727669636573310b300906035504061302555330820122300d06092a864886f70d01010105000382010f003082010a0282010100a43fb28612a2a1aa1c2528e356ee87e4eaecd6acea46e92ae6ad57f72221e78d236a69d788260fc228a6e3fcdd9a63b9dcd72dfddc6cd13f4d072aca2c702ae4ea66aae2f3f315c6872c1415b3fb63ba095ff853ba77748260caa37d71772b8ac40b8507d0c1ecd60bf70e44b6b40b2439f776e95cb41084f5eef4a5bfbb85ee40f059b23406cb5505f3763d3570b9b42ac7f15eb707713f8b151fc3fe42e88eb96845b8601a3432a6cbc395d823e75013151658d082689c196137da55cebc3749f9c02d399a5b39dc7a23e398c08fbf15b9365fa83d6ed2b9d1b262a2a382de9e066814e2cad2fe44c5610160862658247ee1b478e6c078c0e335dcde6b5ae50203010001a339303730160603551d11040f300d820b6b6579617574682e77696e301d0603551d0e04160414083b341918bc733b95b92864b57878f59ee4d44b300d06092a864886f70d01010b05000382010100176d90883ee4576e694e7abeae08a6cf466032feab42c2a919bda0c2056b0feba4d64bbba9935a1bebf1afafb79a19d8454e43b97fe9e2ffbc744a7aa57c7ba35a07d903242bc15fa05ddcf2fea6285c8296cbd58880c02d8cce8b9a2f7537b84ea7cad4251f2a3afdf8afe5b8f898ac2cd4fec68d492d4a2497590d8be4c3aee4683eff3a64ead0e069cf2754ef84800cd9e3d74ba4fd6f486e1f6b829e50c531eeb2d03be4b70dad6f4a220be2c39905e46038131d854e3480af3ddce07cd70896c1a21501b80cd5f92fe0fe44ff3036b0eb27333701aea147fd757628612deea19c09a36b3c00e482b5b5186d7a009f036630c362eafcce8dbed470b73498	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ClientAuthIssuer\Certificates	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\TrustedDevices	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\CRLs	rundll32.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\certindex:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe
4296	LOUD (1).exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 39 IoCs

pid	Process
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	168	chrome.exe
Token: SeCreatePagefilePrivilege	168	chrome.exe
Token: SeShutdownPrivilege	168	chrome.exe
Token: SeCreatePagefilePrivilege	168	chrome.exe
Token: SeShutdownPrivilege	168	chrome.exe
Token: SeCreatePagefilePrivilege	168	chrome.exe
Token: SeShutdownPrivilege	168	chrome.exe
Token: SeCreatePagefilePrivilege	168	chrome.exe
Token: SeShutdownPrivilege	168	chrome.exe
Token: SeCreatePagefilePrivilege	168	chrome.exe
Token: SeShutdownPrivilege	168	chrome.exe
Token: SeCreatePagefilePrivilege	168	chrome.exe
Token: SeShutdownPrivilege	168	chrome.exe
Token: SeCreatePagefilePrivilege	168	chrome.exe
Token: SeShutdownPrivilege	168	chrome.exe
Token: SeCreatePagefilePrivilege	168	chrome.exe
Token: SeShutdownPrivilege	168	chrome.exe
Token: SeCreatePagefilePrivilege	168	chrome.exe
Token: SeShutdownPrivilege	168	chrome.exe
Token: SeCreatePagefilePrivilege	168	chrome.exe
Token: SeShutdownPrivilege	168	chrome.exe
Token: SeCreatePagefilePrivilege	168	chrome.exe
Token: SeShutdownPrivilege	168	chrome.exe
Token: SeCreatePagefilePrivilege	168	chrome.exe
Token: SeShutdownPrivilege	168	chrome.exe
Token: SeCreatePagefilePrivilege	168	chrome.exe
Token: SeShutdownPrivilege	168	chrome.exe
Token: SeCreatePagefilePrivilege	168	chrome.exe
Token: SeShutdownPrivilege	168	chrome.exe
Token: SeCreatePagefilePrivilege	168	chrome.exe
Token: SeShutdownPrivilege	168	chrome.exe
Token: SeCreatePagefilePrivilege	168	chrome.exe
Token: SeShutdownPrivilege	168	chrome.exe
Token: SeCreatePagefilePrivilege	168	chrome.exe
Token: SeShutdownPrivilege	168	chrome.exe
Token: SeCreatePagefilePrivilege	168	chrome.exe
Token: SeShutdownPrivilege	168	chrome.exe
Token: SeCreatePagefilePrivilege	168	chrome.exe
Token: SeShutdownPrivilege	168	chrome.exe
Token: SeCreatePagefilePrivilege	168	chrome.exe
Token: SeShutdownPrivilege	168	chrome.exe
Token: SeCreatePagefilePrivilege	168	chrome.exe
Token: SeShutdownPrivilege	168	chrome.exe
Token: SeCreatePagefilePrivilege	168	chrome.exe
Token: SeShutdownPrivilege	168	chrome.exe
Token: SeCreatePagefilePrivilege	168	chrome.exe
Token: SeShutdownPrivilege	168	chrome.exe
Token: SeCreatePagefilePrivilege	168	chrome.exe
Token: SeShutdownPrivilege	168	chrome.exe
Token: SeCreatePagefilePrivilege	168	chrome.exe
Token: SeShutdownPrivilege	168	chrome.exe
Token: SeCreatePagefilePrivilege	168	chrome.exe
Token: SeShutdownPrivilege	168	chrome.exe
Token: SeCreatePagefilePrivilege	168	chrome.exe
Token: SeShutdownPrivilege	168	chrome.exe
Token: SeCreatePagefilePrivilege	168	chrome.exe
Token: SeShutdownPrivilege	168	chrome.exe
Token: SeCreatePagefilePrivilege	168	chrome.exe
Token: SeShutdownPrivilege	168	chrome.exe
Token: SeCreatePagefilePrivilege	168	chrome.exe
Token: SeShutdownPrivilege	168	chrome.exe
Token: SeCreatePagefilePrivilege	168	chrome.exe
Token: SeShutdownPrivilege	168	chrome.exe
Token: SeCreatePagefilePrivilege	168	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe
168	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 168 wrote to memory of 1356	168	chrome.exe	76
PID 168 wrote to memory of 1356	168	chrome.exe	76
PID 168 wrote to memory of 1404	168	chrome.exe	78
PID 168 wrote to memory of 1404	168	chrome.exe	78
PID 168 wrote to memory of 1404	168	chrome.exe	78
PID 168 wrote to memory of 1404	168	chrome.exe	78
PID 168 wrote to memory of 1404	168	chrome.exe	78
PID 168 wrote to memory of 1404	168	chrome.exe	78
PID 168 wrote to memory of 1404	168	chrome.exe	78
PID 168 wrote to memory of 1404	168	chrome.exe	78
PID 168 wrote to memory of 1404	168	chrome.exe	78
PID 168 wrote to memory of 1404	168	chrome.exe	78
PID 168 wrote to memory of 1404	168	chrome.exe	78
PID 168 wrote to memory of 1404	168	chrome.exe	78
PID 168 wrote to memory of 1404	168	chrome.exe	78
PID 168 wrote to memory of 1404	168	chrome.exe	78
PID 168 wrote to memory of 1404	168	chrome.exe	78
PID 168 wrote to memory of 1404	168	chrome.exe	78
PID 168 wrote to memory of 1404	168	chrome.exe	78
PID 168 wrote to memory of 1404	168	chrome.exe	78
PID 168 wrote to memory of 1404	168	chrome.exe	78
PID 168 wrote to memory of 1404	168	chrome.exe	78
PID 168 wrote to memory of 1404	168	chrome.exe	78
PID 168 wrote to memory of 1404	168	chrome.exe	78
PID 168 wrote to memory of 1404	168	chrome.exe	78
PID 168 wrote to memory of 1404	168	chrome.exe	78
PID 168 wrote to memory of 1404	168	chrome.exe	78
PID 168 wrote to memory of 1404	168	chrome.exe	78
PID 168 wrote to memory of 1404	168	chrome.exe	78
PID 168 wrote to memory of 1404	168	chrome.exe	78
PID 168 wrote to memory of 1404	168	chrome.exe	78
PID 168 wrote to memory of 1404	168	chrome.exe	78
PID 168 wrote to memory of 1404	168	chrome.exe	78
PID 168 wrote to memory of 1404	168	chrome.exe	78
PID 168 wrote to memory of 1404	168	chrome.exe	78
PID 168 wrote to memory of 1404	168	chrome.exe	78
PID 168 wrote to memory of 1404	168	chrome.exe	78
PID 168 wrote to memory of 1404	168	chrome.exe	78
PID 168 wrote to memory of 1404	168	chrome.exe	78
PID 168 wrote to memory of 1404	168	chrome.exe	78
PID 168 wrote to memory of 2356	168	chrome.exe	79
PID 168 wrote to memory of 2356	168	chrome.exe	79
PID 168 wrote to memory of 2136	168	chrome.exe	80
PID 168 wrote to memory of 2136	168	chrome.exe	80
PID 168 wrote to memory of 2136	168	chrome.exe	80
PID 168 wrote to memory of 2136	168	chrome.exe	80
PID 168 wrote to memory of 2136	168	chrome.exe	80
PID 168 wrote to memory of 2136	168	chrome.exe	80
PID 168 wrote to memory of 2136	168	chrome.exe	80
PID 168 wrote to memory of 2136	168	chrome.exe	80
PID 168 wrote to memory of 2136	168	chrome.exe	80
PID 168 wrote to memory of 2136	168	chrome.exe	80
PID 168 wrote to memory of 2136	168	chrome.exe	80
PID 168 wrote to memory of 2136	168	chrome.exe	80
PID 168 wrote to memory of 2136	168	chrome.exe	80
PID 168 wrote to memory of 2136	168	chrome.exe	80
PID 168 wrote to memory of 2136	168	chrome.exe	80
PID 168 wrote to memory of 2136	168	chrome.exe	80
PID 168 wrote to memory of 2136	168	chrome.exe	80
PID 168 wrote to memory of 2136	168	chrome.exe	80
PID 168 wrote to memory of 2136	168	chrome.exe	80
PID 168 wrote to memory of 2136	168	chrome.exe	80
PID 168 wrote to memory of 2136	168	chrome.exe	80
PID 168 wrote to memory of 2136	168	chrome.exe	80

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\LOUD (1).exe
"C:\Users\Admin\AppData\Local\Temp\LOUD (1).exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4296

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffd7ee29758,0x7ffd7ee29768,0x7ffd7ee29778
  2⤵
  PID:1356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1644 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:2
  2⤵
  PID:1404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1868 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:2356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2116 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:2136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2908 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2916 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4496 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4608 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:4304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4812 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4676 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:3860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4676 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:3976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5044 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3824 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:3696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4976 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4592 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4516 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:2944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=1556 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:1
  2⤵
  PID:512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:1788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5336 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:2960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5128 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:2500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:3636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3180 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:4540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3232 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:3860
- C:\Users\Admin\Downloads\VC_redist.x64.exe
  "C:\Users\Admin\Downloads\VC_redist.x64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1488
- - C:\Windows\Temp\{FDCFD168-F1E5-4406-B3EC-C83EBF00456D}\.cr\VC_redist.x64.exe
    "C:\Windows\Temp\{FDCFD168-F1E5-4406-B3EC-C83EBF00456D}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\VC_redist.x64.exe" -burn.filehandle.attached=524 -burn.filehandle.self=532
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4344
  - - C:\Windows\Temp\{16E1C878-A71E-490D-90C9-700F1B70B873}\.be\VC_redist.x64.exe
      "C:\Windows\Temp\{16E1C878-A71E-490D-90C9-700F1B70B873}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{430CE45B-F6AD-4E3A-9C85-ECBAEAA09C55} {FA82978F-26BB-45F6-AB12-470956E6D67E} 4344
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:4864
    - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={5af95fd8-a22e-458f-acee-c61bd787178e} -burn.filehandle.self=868 -burn.embedded BurnPipe.{CD688A31-7C85-4270-9D53-19C57192EAA6} {B6B8D220-2048-4F6C-8EA5-A5542B27FED9} 4864
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1016
      - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={5af95fd8-a22e-458f-acee-c61bd787178e} -burn.filehandle.self=868 -burn.embedded BurnPipe.{CD688A31-7C85-4270-9D53-19C57192EAA6} {B6B8D220-2048-4F6C-8EA5-A5542B27FED9} 4864
        6⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4916
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{DC2DBDDF-226C-4871-9DEC-753E17DFB0FB} {20A27A87-731A-4E3D-A11F-580E7E9DDCFE} 4916
        7⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4488 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:2
  2⤵
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=3836 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=812 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5576 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:68
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5592 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=5756 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=3696 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=5464 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5660 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:3684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5888 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:4660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=5436 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=3712 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1556 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  - NTFS ADS
  PID:372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=2548 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:2912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --mojo-platform-channel-handle=5128 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:2464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --mojo-platform-channel-handle=3408 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5544 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=908 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:3536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --mojo-platform-channel-handle=3816 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --mojo-platform-channel-handle=5380 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --mojo-platform-channel-handle=4648 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --mojo-platform-channel-handle=2032 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --mojo-platform-channel-handle=4720 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2032 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:2464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5544 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:1124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --mojo-platform-channel-handle=4672 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5676 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:32
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --mojo-platform-channel-handle=5652 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --mojo-platform-channel-handle=5572 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:2292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --mojo-platform-channel-handle=5688 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:3876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --mojo-platform-channel-handle=5860 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5824 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:4636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --mojo-platform-channel-handle=4788 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --mojo-platform-channel-handle=5912 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5236 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:2280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5884 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:1540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --mojo-platform-channel-handle=4892 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:2852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:2448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4844 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:1500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5860 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5692 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:1496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:1472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4560 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:4864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3712 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:1808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5648 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4540 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:2404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --mojo-platform-channel-handle=5084 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --mojo-platform-channel-handle=1548 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5428 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:2264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4864 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --mojo-platform-channel-handle=6024 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:1556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --mojo-platform-channel-handle=4628 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5236 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2280 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4832 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:916
- C:\Users\Admin\Downloads\outbyte-pc-repair.exe
  "C:\Users\Admin\Downloads\outbyte-pc-repair.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5076
- - C:\Users\Admin\AppData\Local\Temp\is-18492265.tmp\Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\is-18492265.tmp\Installer.exe" /spid:5076 /splha:35758912
    3⤵
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Modifies system certificate store
    PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5648 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:2252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6220 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:1396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --mojo-platform-channel-handle=6112 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --mojo-platform-channel-handle=3708 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6292 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:2632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2196 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:8
  2⤵
  PID:4932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --mojo-platform-channel-handle=2968 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:1
  2⤵
  PID:1012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --mojo-platform-channel-handle=5620 --field-trial-handle=1840,i,11783272513767817666,6710838704591784028,131072 /prefetch:1
  2⤵
  PID:2028

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4640

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:308

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:1984

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
PID:1468

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:308

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\all files\READ ME.txt
1⤵
PID:1716

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" cryptext.dll,CryptExtOpenCER C:\Users\Admin\Downloads\all files\rootCA.crt
1⤵
PID:4944
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\cryptext.dll,CryptExtAddCERMachineOnlyAndHwnd MIIFgTCCA2mgAwIBAgIUHUBX4KGDjH+40+JU0at0rGSTgXgwDQYJKoZIhvcNAQELBQAwUDELMAkGA1UEBhMCVFIxETAPBgNVBAgMCElzdGFuYnVsMQ4wDAYDVQQHDAVjaXR5dDEeMBwGA1UECgwVR29vZ2xlIFRydXN0IFNlcnZpY2VzMB4XDTI0MDkwMTAzMTMwNFoXDTI3MDYyMjAzMTMwNFowUDELMAkGA1UEBhMCVFIxETAPBgNVBAgMCElzdGFuYnVsMQ4wDAYDVQQHDAVjaXR5dDEeMBwGA1UECgwVR29vZ2xlIFRydXN0IFNlcnZpY2VzMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA3cFrpqaUsjr933SJxZ3lnSDoRNQo83vm2g6woM3xALMjg2qMs1THXXuqqH8i02OGoyZMO8wIyWY6lk5XLQ2n5+s7UbV+x0p6DqMrm9M/YjGZ3ETRxvM9XxOI/L/dkeUYa9ZFhrdaqT8t7CWAPG/hrEGrQrVvEeGlx6ReMQD5StVej8Nrx5YzJ6Jc0vVzC77zwg2olocQF6BZF1ghWeR0hkZGfiHYgT2eAejMwNMbgmFykIgABr5XnC6s1IfMq/srtlHd/pzc+CZaLRGnTXB+WZ4SHbhT77W2a+Kvwv1nDdFCmAvLM5ppUej7ihr+9rYFJbm+xm7H7zq0wgfYn2FjVu8m2hYdKTH7LtQpUpz8GmWHkU7YOQwnUx42rETI4ar+X+qLNBM5NqL1ngOFmYYHBDKGkAWb6HU1kC1y3/DXlyh5kUP0an6D2FSepkJ2UIwHvzlx0nPZ5Rsj+17I42qZE92/DEDXQmfeUhpAREDHv83PMbIUzqki1qj3AQc2o6CxswoJzdsi3mWpY27RfeIUIzf1NMuhEq64nQ43S8SQwuSuZmUXOwCDn3BRPkwkAL6lofzU6TsXRHYs2Ncng2TJn4zq4bP5pkJvwlPvfRktbYf19EbXlFEuif7Ow6W8r/EPfUtEEWT3BPxWmAOeAqDGNu5Jf1Fii2QX5yyvUxtz79UCAwEAAaNTMFEwHQYDVR0OBBYEFM5RTQcBINChz1ZlFIg7kesO+++JMB8GA1UdIwQYMBaAFM5RTQcBINChz1ZlFIg7kesO+++JMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggIBAMW61HLtGbeWcQLk59bAxwG3kQu+K4PvtGgz+KobuKr9aNnR0M7J74S1I8o5OineUdG3YvfYdG5dF4xKd75PXlrl0TmXelVkxaO9pX/lnwNFjyuoXYFu8kxaE+g0I/V8/L0vQlEg2342EWaZJtaLC0MR12Fk3CmtHsvpIlVFUo67RZhMEeCIkrp8q78HYwe4OntOB/wbu/xsqUDJgooP5LwSSIPza0LXJiQAYx6X9KrYOiFalD8qoOSBctcQsBjpGG3AMag5rtWkRJ6V+CgKQVphghwMJsb0+GjVfCFnfiEmODsbBKHiS0VY5Inuf+SvbdIezp3sELHW+qzMjv8gjpaD3nVGHlfEonjfyiGFamjo75F7qQGygutxG9X8wyMHDWXkhzGqfGIydvvU4wEdHwDQfAWo6HU5ftemg3npjNDkcIyTTnEj5SbeCZLKCr87mXNwT3uisbVpSu24tC+p0R1XmpycTRqvLDyyRtwQpiJxPVGrNifgi9oQU/R4++y9nR1VyugLwCF8HnlCO00TthF0ntYv1aA9yOAIfSE/FXs28rnSwEgD/m/T0Bfz8S8aawv7kggspojB67FJ2uNbhvZVXg/Kdw9+Ss7HXOdkMaEZGqZBjBkfvfbLqedFStpfvxmHdXP40ib4WN1ON4R+xp+TME87wK6C5YguwDQybGiQ 197274
  2⤵
  - Modifies data under HKEY_USERS
  - Modifies system certificate store
  PID:2924

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NgcSvc
1⤵
PID:3872

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
1⤵
PID:2944

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" cryptext.dll,CryptExtOpenCER C:\Users\Admin\Downloads\all files\keyauth.win.crt
1⤵
PID:2556
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\cryptext.dll,CryptExtAddCERMachineOnlyAndHwnd MIIDOzCCAiOgAwIBAgIUJYJxJvuI8NAWfLqwiTcQkqQMdXEwDQYJKoZIhvcNAQELBQAwOjELMAkGA1UEAwwCRTYxHjAcBgNVBAoMFUdvb2dsZSBUcnVzdCBTZXJ2aWNlczELMAkGA1UEBhMCVVMwHhcNMjQwODI3MTYxMTAzWhcNMjUwODI3MTYxMTAzWjA6MQswCQYDVQQDDAJFNjEeMBwGA1UECgwVR29vZ2xlIFRydXN0IFNlcnZpY2VzMQswCQYDVQQGEwJVUzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKQ/soYSoqGqHCUo41buh+Tq7Nas6kbpKuatV/ciIeeNI2pp14gmD8IopuP83ZpjudzXLf3cbNE/TQcqyixwKuTqZqri8/MVxocsFBWz+2O6CV/4U7p3dIJgyqN9cXcrisQLhQfQwezWC/cORLa0CyQ593bpXLQQhPXu9KW/u4XuQPBZsjQGy1UF83Y9NXC5tCrH8V63B3E/ixUfw/5C6I65aEW4YBo0MqbLw5XYI+dQExUWWNCCaJwZYTfaVc68N0n5wC05mls53Hoj45jAj78VuTZfqD1u0rnRsmKio4LengZoFOLK0v5ExWEBYIYmWCR+4bR45sB4wOM13N5rWuUCAwEAAaM5MDcwFgYDVR0RBA8wDYILa2V5YXV0aC53aW4wHQYDVR0OBBYEFAg7NBkYvHM7lbkoZLV4ePWe5NRLMA0GCSqGSIb3DQEBCwUAA4IBAQAXbZCIPuRXbmlOer6uCKbPRmAy/qtCwqkZvaDCBWsP66TWS7upk1ob6/Gvr7eaGdhFTkO5f+ni/7x0SnqlfHujWgfZAyQrwV+gXdzy/qYoXIKWy9WIgMAtjM6Lmi91N7hOp8rUJR8qOv34r+W4+JisLNT+xo1JLUokl1kNi+TDruRoPv86ZOrQ4GnPJ1TvhIAM2ePXS6T9b0huH2uCnlDFMe6y0Dvktw2tb0oiC+LDmQXkYDgTHYVONICvPdzgfNcIlsGiFQG4DNX5L+D+RP8wNrDrJzM3Aa6hR/11dihhLe6hnAmjazwA5IK1tRhtegCfA2Yww2Lq/M6NvtRwtzSY 262854
  2⤵
  - Modifies data under HKEY_USERS
  - Modifies system certificate store
  PID:1780

C:\Users\Admin\Downloads\all files\Emulator.exe
"C:\Users\Admin\Downloads\all files\Emulator.exe"
1⤵
- Executes dropped EXE
PID:1904

C:\Windows\System32\GamePanel.exe
"C:\Windows\System32\GamePanel.exe" 00000000001A0074 /startuptips
1⤵
PID:1152

C:\Windows\System32\bcastdvr.exe
"C:\Windows\System32\bcastdvr.exe" -ServerName:Windows.Media.Capture.Internal.BroadcastDVRServer
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
PID:3576

C:\Users\Admin\Downloads\all files\Bfsoy.exe
"C:\Users\Admin\Downloads\all files\Bfsoy.exe"
1⤵
- Executes dropped EXE
PID:3660

C:\Users\Admin\Downloads\all files\Bfsoy.exe
"C:\Users\Admin\Downloads\all files\Bfsoy.exe"
1⤵
- Executes dropped EXE
PID:3684

C:\Users\Admin\Downloads\all files\Bfsoy.exe
"C:\Users\Admin\Downloads\all files\Bfsoy.exe"
1⤵
- Executes dropped EXE
PID:4216

C:\Users\Admin\Downloads\all files\Bfsoy.exe
"C:\Users\Admin\Downloads\all files\Bfsoy.exe"
1⤵
- Executes dropped EXE
PID:1352

C:\Users\Admin\Downloads\all files\Bfsoy.exe
"C:\Users\Admin\Downloads\all files\Bfsoy.exe"
1⤵
- Executes dropped EXE
PID:2660

C:\Users\Admin\Downloads\all files\Bfsoy.exe
"C:\Users\Admin\Downloads\all files\Bfsoy.exe"
1⤵
- Executes dropped EXE
PID:520

C:\Users\Admin\Downloads\all files\Bfsoy.exe
"C:\Users\Admin\Downloads\all files\Bfsoy.exe"
1⤵
- Executes dropped EXE
PID:3900

C:\Users\Admin\Downloads\all files\Emulator.exe
"C:\Users\Admin\Downloads\all files\Emulator.exe"
1⤵
- Executes dropped EXE
PID:1336

C:\Windows\System32\GamePanel.exe
"C:\Windows\System32\GamePanel.exe" 00000000001502C2 /startuptips
1⤵
PID:3832

C:\Windows\System32\bcastdvr.exe
"C:\Windows\System32\bcastdvr.exe" -ServerName:Windows.Media.Capture.Internal.BroadcastDVRServer
1⤵
- Checks processor information in registry
PID:1528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e58bcc8.rbs

Filesize
17KB

MD5
74d7ddd588cf7dc8c0ac0d16604835f8

SHA1
e919af108107380efad4abc5e8b16c124b81fbbd

SHA256
22b9e9aa81b3524c8e953b96dca38e187361a51c3edda11aa1d5554523592756

SHA512
95dbc81e39882534695b7ff41603d972e0cc56929c1beacb58fc7beb6c7a3b17e929d3f6d2c486d64b4a8b3fce88bed329eac2c047c2dc5c7ccea546c1418e67

Download Submit
C:\Config.Msi\e58bcd4.rbs

Filesize
17KB

MD5
ad30cb8fe215ef0a5418d6355f3badb4

SHA1
5b71b9579933a556213f6309103a66f22f4bd36c

SHA256
433aae3c38ec901a27d8fb2cb10ece86a26cbe3ae3576371c9f374b38b48e1e5

SHA512
d0a110951cd4b1a15597aae34643765e5757dc54d10afae4d0ca28b0092711111aeb76a0f9783755ad69ce49dac81727e625555b2ec23456820d8872755e163f

Download Submit
C:\Config.Msi\e58bcdb.rbs

Filesize
19KB

MD5
9d341366abc08e5cc4553b4b4086c3a8

SHA1
5f1075a24a7c5d6eec7fd4f38fd35e53c9e056c8

SHA256
9d4f8633299365b6712821f1867a790e1f0acc84bc2abc3742018f9d6e97384f

SHA512
38fec35bb0c069926686483b810777f29365ad6fb34cffe7935a1ee17ea3c0187dbbec691c4e68eccec9258aa51e0b4381ae8295d0c7ae316daac47c659cb9e9

Download Submit
C:\Config.Msi\e58bcea.rbs

Filesize
18KB

MD5
da03326bd848a9d60537aee7adcd4487

SHA1
7807dce200d3d936b9e76dd8a2c1772430ab32ee

SHA256
cca9604753efa4517fcf132db593eb871e55171346348b8411fa01c53e7804aa

SHA512
569a3e9fbd7ec280ffdc8bc3b2aa4250e72a56411e7a92d1af82806a3d2cf9c298221ac547cc117358d637121660656d8c8669fe84df8e6524d1f32989de76d4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\239ee54d-668e-40cc-a9eb-f469154d3e2b.tmp

Filesize
93KB

MD5
f4c0da38747c2d7e07dd6542ed38de94

SHA1
7a606333e39c1e7b21dec91df5de6aeda004acf0

SHA256
c24bd56acaac7353e7ece0e2fa38a048f98ca2079ff1c433ec7eb56cb91cb951

SHA512
14fe8245f1c222ab020a4d900eb5b460a18d1831215f34de3349428e5b58acf33a7a65cffe2156ca60f11f52ae80290bc1f761e10f8aad5b14e7afc8e9a4fbf8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000002

Filesize
62KB

MD5
dbb74f17f882c76550d48de0ba3663f4

SHA1
5588f567466d97fe9942087b1c519d2b656c5218

SHA256
4926d87f3aa10435e11a417f901c7ccc8b415cc3d6bc3ac7ccba9ee9b1192786

SHA512
6710f0d865e29d0ec2849bec87db312fdfb043418a1fe6d484955e36670d370586df4e260c50a8165444bbe706d4d9c653cf8cff8c08b68807a09d0fce4dfe3b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000003

Filesize
41KB

MD5
abda4d3a17526328b95aad4cfbf82980

SHA1
f0e1d7c57c6504d2712cec813bc6fd92446ec9e8

SHA256
ee22a58fa0825364628a7618894bcacb1df5a6a775cafcfb6dea146e56a7a476

SHA512
91769a876df0aea973129c758d9a36b319a9285374c95ea1b16e9712f9aa65a1be5acf996c8f53d8cae5faf68e4e5829cd379f523055f8bcfaa0deae0d729170

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000028

Filesize
25KB

MD5
3b5e8b684bcf4538e657937c6249f72a

SHA1
d98c6357bea50d24fd5986f8eb370514775fd66d

SHA256
f2f28baed016998d2f5b6c87de85852c639d14d340a06efc0a5f62d295a43834

SHA512
ba5c952583d81ed80f335780584620029ad48f7280423211a256bce34bfc95573157cf4745c473fcf39e6d3feef70293bb16241dee6c18de1c3072c2f37c41aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002a

Filesize
102KB

MD5
8950b54d3c981a975724c40937521005

SHA1
b4facbbf5cc49154ee10963aca9b7f27e5144a2d

SHA256
164f0bd0842f8da159a9a97233f0343f019a8c7088f5baf18db3c11f7cfb8976

SHA512
00a09288c7d289c1869e4b289e80771f86d29f9ec4f820d0bc666e54f330ad88e1b9c6aad34311c8c6f457efb60c4100664e42519e4a198313e1215ad7ef2713

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002f

Filesize
70KB

MD5
80c1416327c210993406f954b29b1f31

SHA1
f544a6fb4dbd658ae283eee21e77cccfc203c7a4

SHA256
ff2aa22638dddbe7acc2efb524d36277b48a18bd50ae1e51c4232052acf70565

SHA512
671328595ffc7767e861a4323247f6993c2c0175945bbe00540f5718ade4e55039d41417fce7ef77a3685fc13ddc68e83bbca64f230939c61ad9ea155a791795

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000031

Filesize
93KB

MD5
2259f9aa9b35ba1cae5c2fa266847ddb

SHA1
280f40f45c6d346f76e381a45e41d06aa89ab616

SHA256
7db4bf971a00871123d1c4c71335b52291869bfa4f02b726b908866464cb379b

SHA512
d15194f6503d9bc6de9da44f903a581b4a5e08ea324cf1c92c749fccf65d77d13b076ffefaa468e2c50d57012d780d85683345e789b47cf30d5fa49d662517a0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000032

Filesize
73KB

MD5
045d1738965242a21e35b353fe816a4b

SHA1
68524733f2a41b9af3cfad6cd2d1f1077afdedbc

SHA256
29d28107deccec99a73fe1ebf6bd2075062511c149e253e71c652de6154fbf41

SHA512
aac07d9fffe525411bff92e9c0f175cb19b0d4d5b3f9362289ea687d32476fe219d70463a8d524883839cb4af24a487ec8505b0b29ee08d1b63aa09992bace1f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000033

Filesize
16KB

MD5
86257a0ddbe91882036fc8ef02a04ced

SHA1
4355dd53c8989b3be2babe9fccd8314ce9e0daab

SHA256
de8bb8bc74b195a92fb6b95fda1302284d0389a19b799bf419e8e2c89cd802f8

SHA512
653008b80601c35f07b3d3918fa7e89456706aed85897f40a6b9c18876f760d0df8e0c9f8382d750f47600329168690cdd5cfa8a4baa75adf6b3e0b2366c19b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000034

Filesize
25KB

MD5
f10c38b8ddcc55c362ccf661e93e3a54

SHA1
5d4a3ac07a820d1d6d655d16c2b8e88b0de3347b

SHA256
c7f33248f50aa3a3f9308262eb7119febb2fa866282f954bedec4a0756db233b

SHA512
517971aa4e282256133bf1b05eeb7d8cc58a1cdb32f9317eacd2999af89cf9d8efb8e4ca0e3839f581393a1ceecf7d85c61786f5f6def8f3a4e085d053a35c62

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
816B

MD5
d6d632e86a880b56cd8b4b47e1e70379

SHA1
b3a6b141d931f5f44b47a3eca5eb6b126ff8ac92

SHA256
a9f597ac0ecec52e09a7c92cc1e7c14421f4070ea95cd58ff12ce45b1628bc29

SHA512
e214360dba374712fc81d6e1fb10b58595390de77df3c853655fda31a6e2cc413a7802720c24b3cbd3cce1977109017f757de2a6653bbeb3d89d45f9d39227ae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
576B

MD5
e93c4240624582a1ccdd9b826c19e3eb

SHA1
86dc0e60472509310658db21069a31cd2e74a9a2

SHA256
c61e232156c3dd4a4c64b04b00593bed8e5d2f878f35fafcd3b6aa2b87c6983c

SHA512
ac86810c24b8f3ab8d816df04478c4ee1619efff33895d09f00e1135f44fbc34ed4814ebaf60f2a59211a6c775a8c86206c06922a536c6e0b86c2f6a82a3f80d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
3421d88fa6c161703146513caedd87f9

SHA1
d5caf493997253b164c9e147ffdf6dec3e00e243

SHA256
5bf6e58a3b7ac916a683723d33391e2feb10ac59a0f7d373c9b494cbba143f92

SHA512
589f1c58d388706253aa5572014436d913a15088d614510199bf733df81fad417661cf0cf3afd554e7ebaf70c22bf91fcfe9b03f8621611ac9f930ff2c47a1e9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
caa967f6551dadd396574dd0b8d1de47

SHA1
9aad47109430853314511d2a8d076be518506486

SHA256
3481cfaf58e5cd1cdcfd27accd406f42742d08ef4617655048e8c58741b0cec9

SHA512
00360053e7397266bce811161d798acbe80de13693064422c0f6b0fd0319f8550d80c47266b384590f6fb32669164e3d6aadd48c86a7b2eae7bf8b05d83afe59

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
c1e47fa25a7be681c361c0fd935e565f

SHA1
fe233504b54cbb20439196b2f22523084e8f9805

SHA256
3a95494c3000b57d3151d2c0ec35f6af6fd158aa6e20209372603c6569e7f7f6

SHA512
0e245d7c34b4b4b4b85abd1a17a9b91e965f0c7c46d1e94f4c0bb15ea3550cd0a971f0823605863bd09286a1a63bb6cd363f419b99225e1483b432da3b8029a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
003e5b28308836fe3c05753ea3d17620

SHA1
884bed4b5a3a1e7b4316c03b9edf872a3aee87a1

SHA256
2dfc714d1fcd73bad057fad63690223f43c8d5c61d535f3a7e020709365632bb

SHA512
80c0687328b4287f2165e1a54a9a8d32af0a8ee0ec133ad93fc79ffad75474be26adc26185778b020c8014db336b8c269f5de3e1bd5ec3d1227551cc66b88c76

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
107c8530fe581d313bca3a290fd0b2b4

SHA1
6acee2dfdd7724a7d7ee2b6f8fa6cff6cf415428

SHA256
0290e9b32f1706e5f452d3166dce9e62ba523fdcfef9ff020b3faaa793ef7b2a

SHA512
5263d1a6d8d3f15d75763f6e77a237a4ebdcee5dbb737c4bd7bdb83703ae53280c6670f51b4b8fa638c484a103234d58423a750d9b8eb9f7c4e772b6a191657e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
5824a3ff245d3dc587b35a655074e28d

SHA1
52fc120c1cac2dfc8054119a689f24ee89b971ca

SHA256
2303dd830512d8df8dde6f0a2605ed0fc2e2235b5ddabfdaed4f4faa003447ee

SHA512
4bd3eb89a25d56d0fc18bb758f3fe7eb1c06226d20f5861041fc15eaa8e7ba0388209e26b85b3b12c60e6d5bb99ce8a854417164ebbd1d952ad4fa910e3f2c4e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
548e42b120c9a3a3dc681acb56791acd

SHA1
b79785bed94e4a97fbb8e10b2a2071efe0f33ffd

SHA256
4edc1c89fe6d013b33be9e9d8ea401ed7db17fbd24ee0fa03cefb77f79cb9614

SHA512
7d15f12a9cca6e5c355a96b8181e5e05f679de792e52bd043bdfbda2852ef2e054a94bb2e0f48d295fbee4f7bb655d1542e40e52a65fb1bc608b1e2eb05d1329

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
6032d12ea531422d207fac1555b498d5

SHA1
4666201d7a2a282a7ffcc9c9de4ae8787f1910d3

SHA256
1ae4a8340ae3ced338a0937b47efd538533b9b9d1e76ea2348a2a98a8a40f809

SHA512
c66cb7d37a1b800b5ad4e280976b371a627371b40c6dbbeabdb5aee051d1271685321017b2b25a1ef21f3a5a6ad4fe9f00059cd9231c36123e205b45b11b5f0a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
2f183303b921e9ae600b5c437fe0d5f7

SHA1
e0ec1db983b794564dcfec3a926d4412c17c5f98

SHA256
bde907bc057538182b9203ac71f608bfff70058237ca777f0618ede7207980f8

SHA512
77913e81030268cdc5c82be64cbd7de2c277d9439ee1b877efda7edf572a0631732a5b3004ac6274836f4b581fafa3944e4351be572abe0037f4580d500bc5ba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
1048f1f0d54b764ebb97431c88deb2d4

SHA1
5adea60bd0cd283b4c963102832002afab46322e

SHA256
2a52f773bab1d113fb65eea0caa0f5b8360d826d430c9aa40fc1df6b921f7c3e

SHA512
371119e823474a7fde9fcdcd4b5bd1f93647b11e7d9a49496711f08b7bcedc50c14c389c34367543d0e8da9b6c9e944e5080a2ab7d6fcddc36a6e7ad256141ee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
36f44eae188adca94bcad9c14444ced8

SHA1
92b4ed287ae3b925ec360fc1454d6bfbd4789872

SHA256
9e84f89dc7832d0859d933bc5b51130d4cdcbdaba543eeed2027515f0a31cff3

SHA512
d57362d6f66d320e2ebfe8ffa0fdf13c49abeb34ea713d1cc5140bfcdf4b85f4d973e8987fa785e158632f01ca78b39f39ef49e33ace7b91a17d2c6cf93f310b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
a4b5cd161be888e619ce412cbcca38ac

SHA1
373c7561f35fd83b8ec56e5d5e3dcf3abdb78f80

SHA256
d2aacf30230dd369a2fb90c2b1518d30215e6175af8eb4048ecae1f33e099846

SHA512
50e7507a089e7e2f28c6adad21d159c52aa98dcc5b7aa446ffb0b5cc53ed81987b63260212f6a70c78cf90c28f6a6797f3b730bd78c951440f992d4a1483d9a5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
6b37e69a96a5b36838675ebd9aac9957

SHA1
b6eb0494f2ad40e163625f77752edeeefc59d198

SHA256
5f556bcd3d73f2ba7af9910b294d8d7fa2f63843d7583072874463fc1e516edb

SHA512
b964054389ec94dc453dd317a3efbdac82a4aefaea1ac5eefd33db123d43d894bedf758eaedb0dbd49277355a2e9ca6d7c7d31bb48b36a05fee9dfd14e09dbf9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
418e2fb852b91ee725673d5eee8fb850

SHA1
e82c83ab3668782b478698a030a432d84c88d4e0

SHA256
54593c08513f9ac65432cbf7685ecc89e9e8654485c45edc3d68fbb5dbaaf3f8

SHA512
7cf8546a7b8ec401305698ebb00544af20cbe34350859ebd913a2cc6e49ad1807a9dfb0d85182798dc99a4eb112d4d5682e4b8447dc8398e9cddcdd76aecaef2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
4299cdbb35058808fca3b70ec4db6521

SHA1
382cc4bfb1d8673007b9726f53a384297ec85291

SHA256
c1244fd9eefdd1182d2f93d38c144e942e8b372010ac23fc272fcd04d66bd82d

SHA512
95d6ae7adc0e98c55b0fa449446094e301c9f4c0c150412e28357288ffc4fc913e2f4050f6d2792d194b4aca3dfd9ce900890199ec39e65b255756e4c417a19a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
40d09e23ed564350c3770ef24b89f722

SHA1
e60acd28c2018f15b7143851a244097e6573f9c0

SHA256
65206e962d5bab56c95c437a6fecebb4f4e83cb483884971a05d986340b29467

SHA512
1b8f2412a77542dd9d52176f102b2b773358981efcb75919e856fefcb74ed31f54f96b6a93f8ff708e5bf791559878e5b977939522a3d771e78df6617b27eb02

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
f1fc6d081f250f12df1f36d1cdafaae5

SHA1
fa9196989c53be08b899431dc18715838460a481

SHA256
129b868e322e3ffe11b0054259ac9fd7c8e0c711b500e5927ee9b0c01aa72910

SHA512
c55e752f54369eb95b8790e92af7b9c542a2b948b65d882023a922eba8a978ee2a8a1f229253d3b4fe16ce3bb30132d5415b23a151618aaa283445602de69405

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
71f9aa556abec24c73c80b5346fc3fc3

SHA1
7586060a69171a9525301b9ba1f71ac4270dec53

SHA256
d32688a3a88e55d0297c472a79d2113fc86f48b9c1a21eaeb2c26825728f68f2

SHA512
022ba994a24d778534a84d7eccfb040123546426dc1a73f9dcd685468034d1a78aea2cf44a39bdf3784baab83c67791713130286b981a75db9d122dfabdc96d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
06d29a9e977b7a5b554e08454b8f6fe3

SHA1
07c58e7b6c9547824c064ead0a4dfd104ef646b6

SHA256
b63adc070e8ae6543b7522511299dc632d12162fcb9eb4ff1383c5a81a9e8a90

SHA512
b175514160256e5dee2c4a91afe31e83e97b4f60cc1a65dedac8999a43a2d46b3fa1e85b4817223043fb6031b79f9204a8dec36c1cf849f3ad55916a03b121ba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
a181e6bc291900de77a187f3990f5c22

SHA1
4fdbd3e873dda732c0250d8c3321fbd0685b5da2

SHA256
45726c3faaa69ace8ed22e453b070daaad45b669a6f05f88463c55b831baec74

SHA512
3d9ac23ac83d9c34c5f4cca07dbdc7cef6f0406ff9b5f340054394d024a017e5423dc9683440662a723487adf26396320bf4f10ae01fc9be14664cfcd60306f5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
539B

MD5
1444acf40ef872e1af69d59b6e5d477e

SHA1
3dfae664fce688175b7e0d15fda3aaa72b10fa20

SHA256
7b4d54514de6b43844b70b8bcb5cc6b9e8644669074c88f18c9220d699f02ce2

SHA512
0c6e1e4b0baba5219ad64709a6df5889052488bb0844e7a93c11d8a81bf476f394b76d569f77345ad02c3a62ca98931d82388c67776b81a986b4e9f1d44f4f25

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
992997101d8d77852fd15fc94e9c6d4f

SHA1
c8ba2edfe5836d2a619793b80f6bb23ffe930850

SHA256
dc614decdd825ae4e3a119416746a1a6f0baeeeb6424198d6aa31a5fadec3531

SHA512
5e5f109745950e597987671cb49e72b1ab103032f498e5c7b308eeb60552a237740ff917f56cee2b7a4b5de1f51d27c7b3c414b12f76414f488f12d38c19b50f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
9987c579461a24435ad1c7952d98599a

SHA1
650d53fb1b621d66e2b846256856b9a13406f186

SHA256
25c983439c84ad1033a04173b20739dd4c5cd8264db22ad8fc54a63bac180817

SHA512
c20f2b66c6b04dbbbe36ca14cb0d3a7aecfce20a1193ccd53640d56f4448e05ee2a14862092cda5502a7a9509fbb42520f35f6ffa7bdbd618dd77c0bc6c0eba0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
aed56b4a923e8fcb05c2c998cedceee4

SHA1
d25a1a5a5c7e92a569488641e69e7422b78e5314

SHA256
68746ad99fabf19ecfa88c777bdcbd717434be479bd895d82527cc0f7044df3a

SHA512
4fe1c945f3b85aa0f446b32b727cf7d61d0c5585ca1500902321acfe2da45147e334099ee98851a0c147c9f4f6d05f2874ce92bc51cbe9d9366f063da9885237

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
c21f737274bd4c3f36c5c4c3af6fe8af

SHA1
d291dc8b4a8a6601e7ba1e82d5ac9113a95209e9

SHA256
4aab57d316c5b045690fe12bf071575523359e63f94f8c495c1a760cc7ccd148

SHA512
088717c9b092f3c817e9bb60aecd363ed1a021bbb7a6a312d25a1f8d1b9cbeb25f7de113f169a47dcf50124d58f53d8fadf00c594ec4c96098253e392389a6b0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
f088250a291c7e6e484a320b138dee54

SHA1
3b231f84a22448819ee1beea54ba8735a31e270e

SHA256
170fdbb92397906fe6c2b2d2691ad64c174a78b4b3d04f0b4f0f74a37dd1b2bc

SHA512
4e35bb2ddf0c8f4ec3d0769b194f86a410d2faf3a07d095cd6ab4996ca082e1a537e28e93090c469e3dce50b566e229fcefd2f29edea3da82f596bf95cdf3caa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
e2c4964f5a4ad0db0b3bd2b496a3ec13

SHA1
b858a3fda0fa80c127fbddbdcae96fee592f8d92

SHA256
4cf353ee6354042bab1494a874eae7bb50304a4ba637fdd9aa8d8a5a591ebb03

SHA512
0a682799c41054e29093253329a83f166b51a85996e0d72e3a8c259ba4a0e348ad973ddb7ab19eaef182cd50d8b90b54302a3af566fe954e493fdc47cb9ed20b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
874B

MD5
97af03ebc870867ef5edf13fd35fe399

SHA1
fb659aad5b8d11960b1136d22e030ee18c092932

SHA256
36054bd936c62c8d4a14a38813467dfe295526e1af59af6af360a12d9410d449

SHA512
7fe19194889eaeec0838b497c50036a34f212f9dc40c3c9614a4bcf7b69ec24759f81d894f6a3260aee622ece9f264670221bacbe68d417e4f170c2133c2a434

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
6aca5729f3946860ec1f31248d2509d7

SHA1
968fc01bdce41886f54d81e4ab09a67766505527

SHA256
49f189369bdc6b9c085dc255f55fed828eea10dd3e3185436f6760ab3031e6a0

SHA512
1729412a7d8604e696fd397e910a03191e19ca56a2a82ba608e64f41e529e17ff2d820e292a85ac1310cdf51e7adfbd3dca03095c443f658d23a3553cb68cd27

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
c44854456f5b7a5a964c58068589927b

SHA1
215a82ae0fc748e596c46badd6bca40e2342c369

SHA256
1f8105237a3fced1dc8be3d62257dcea5d5d0e74d6ea2d877924047f2bb19245

SHA512
2b63c7c13671468d4b6303255ae8fdf6e35c00abbf44a7f5af5086a8ba7bea6692933954989a4e0ebe9ff7db887557b747124fd6797d7ea58f6bdcb5aa719ece

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
ae925d6ebcc2ff314afe4f694b52dea4

SHA1
86f105c87f7ee4f8ba6cf5b778a1cbaf419bff95

SHA256
adf4f4aad1098ee4e4874395f083c3cee69b81b2b47eeb80fd92c397a9bdba03

SHA512
d71c78564e9aa3457e42244610010cdacc5979540f569cb99e4c7db9afc5a63a2eaeb88f20e360e56b1b8a25856a841543d17f0add477c55f7e9ab413aeb0db6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
1320a6809f00bddde500d9f1848f6cc0

SHA1
b61839af4c1b03e928e15351ef1807c160c61f0e

SHA256
0137ac289ee513e2dfb49c57f64a5cb4b2bb682099ae88f78b1cb4c3df6dc863

SHA512
f5b0059e97293629bd21dc86adf2ff470f7e76233adb74b81242e77e43ba4e4d135acbdf02d612839da3b1efbe9e73f2815a734092a6d4b1e52bec95b9248638

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
ebb0a8c0cfd79a79d3f5a5d9d30cc835

SHA1
e1f943d9396114dabf3c3d751981703506704761

SHA256
c9299b06c00647ddd861071a44e82bdea6f5f18963cfef8c1df3db8461ea5a0e

SHA512
91e5f069d87dbe375ad08bc17a00ccbe92792c9ce040725f1e3cae400d8fff2d51b35cbbda21eaa821fadcff6cc2f92e9fe70a0d3255179c3dae415217c928aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
a5be8f5f4964e6c25de37f2ff6b3a18f

SHA1
a4e1763486f8760c46d446f314aecc5d79b18b0f

SHA256
88fedb1588e475c30566764b8390dabc3a007541b8abdead6a1d70497a6e57a8

SHA512
c209643ffae1e899c64bf6a8d4b1c6dba77e91b581e0806ecf0240275db0b01759b458eabc79138b04d68eac7698499aef8effa87c4346877f2fc655eb0a0e43

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
90bdd57a1a3b23933051948c7ecafad4

SHA1
dc740e0074cc9601b60eb03ba520a705f0142599

SHA256
0fc8234770ad255b5e8264de553b26878810f419d9e17ac258f4684a55d52bbe

SHA512
ac7d1d5dca4709289e441523df99dbd58ad3444935d6a2c631958f29a7cae25cbb93ec44203546424edbc455e4270989f5fe2a1e81d4549d437dc1c301fdfe1d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
f7c606170a2a63d53538876c202c7138

SHA1
91658b9b68762b24774674bccc653168ef37acdb

SHA256
43ba9cb6989b44621670db8cc52c014e7365463030170293f6d1a657fd5386b7

SHA512
5190451dfd5fbb3fc8179cbdc401f774193900f1d5d042b9b46dfe77246be2de416c2054dbe0732e3987a2374104ee1ee5388967122f61c0d738adc002a41c9e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
49a4ad25718c49d6bdcb639e158bea16

SHA1
38f6d59ca10146ee845636ac6041638e4c37e276

SHA256
cc179745fb4f90fd7cc626aacbef2bdb7b878d316d67c328ab2c0f451a01707c

SHA512
c84b0b1e049038e4cbd081a54e9e2ed2abfa27c89937eab4f651983b85cf93e283d741dc5faedcbf68fd79ba7612e3ccc946d2267c9bbf1011ef915fc4db1e59

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
39595501b5655432566c5f2c2b7fa0a0

SHA1
20ab7f697de984dd16bbc77e0203dc6b61bed591

SHA256
8b984d826defe210eb4ee6f597ab511acddc553a821bd0a0284038cce90058c4

SHA512
1a1fe77cc68c366cf153c76f7669784c59207ef03b4ff3cc701278315ea4378366fac327ea9f0e45728aae9fdfb75ae7da8b89aede928a0ec72e5508b2424b83

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
2ffba1cb3045eb3b24c0284bfe65acd2

SHA1
fc4ba2a6d3619db7b8534138542cebe4d251cdce

SHA256
55fc799760a0af5f05dd829c5a5f458eb342e871c7510ceef89bbeec3815e2d1

SHA512
5c80a7591f3abc11fe5d74777a654aa19963f165a1526a748658a80790812ecf1a053f5e853261a7b931c13d39d5a54486a56de4ebaa39e6df2286678b444bdd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
3505793ccecb774e839f96937217a42b

SHA1
572c0ec028b05ba65052fd1a8d32e91530425d7a

SHA256
4696d23c74d1863464ed6dad86bd519e69f29f1e4ba4cc95c604954588eae89e

SHA512
0e8ebea222154e1a3aa68ed282baab20bd3490462050dde570deef1483454c486d4d90077e3c5ecd9dd8f01746d8d1292d945e6769da5570101375ee36ccd22b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
4aef72162a75a9782a52f38564615767

SHA1
4c2e66e8046b3ee02000a8625f174f6001fe755c

SHA256
270584cf8b7bce8eac5b2d2429884da7c38363d491620232e315a4ed91a31d3f

SHA512
a6041672446d8053c81b538bdc3ab032611af01d41c9a3af6c07e5c8da41449f72ab75823019b5b4f7890de6f2d1e724b5b5bc30c9ac385d9345038020d174b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
2ab94326df2565d34289e952d9606d86

SHA1
bf199c99f9ad298a55304af40939ca65913bb540

SHA256
873c848bd024e96bafa20854da63954114376761cf647b95e332eec4a2d22a04

SHA512
6d2213abe9b0eb8908cc66a8047a6251584b970acf74f19b725ed6d05a949ed8cc3db190cfc84b16831ba0167c5d26009413ef8b67f5362705ec8f42331e0461

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
e8144adb6872287df37d8b1cfc38e251

SHA1
4d721a3f0c5e4629eac9486ea4f438d97aa2487d

SHA256
86c09a8a9d366a10c1f586a5eee725260273eaf70fbf21f5c5de3fd33602fd31

SHA512
6e731fc274fa7b09f6860dca00e3f81de387b506ac219d784d75d26f3fd5c7644282276a1cd58e16fe369b06dd6194ac53887fdfc29b61b0ef2cf0ad761790a8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
b288b062268fbe5efa6675622623b550

SHA1
f634226deeb53cd5fc1d43696cb99676df34b0af

SHA256
39236737b5227a2c13495715185ad47b3f6b1cd5424cf1c1a9c34611e889c447

SHA512
7750a697c020caaecac19d25ba269970180cfedbf448bfec4a08a1953e72027f89a8488de3542e375eb8e72174c23ab30d0e8eea2430821783bd31ae1194e462

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
311KB

MD5
0edcb66df3d038b1b93472ee2096c72c

SHA1
7096f1788ed89afc10fd505cf499001b777b88bc

SHA256
da9f2362a09fbcefd89f9a0f0e7c61974e759ca82bc10cd9d943686400f61b5f

SHA512
8345e7343c3915011bbd2ccc09b7bc16f4670dc5b15a0e2b45903f1b7a73fe497ecfacf98b0a3e122a547f18b20ee8e162f4a4f1518d8ca5d129bf76db183b6d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
312KB

MD5
b2107bf2cec861fffda5361fd9e0a9e8

SHA1
a5cb7d17d983d9b786e03bb3dddaf654bce733a5

SHA256
ba3f2c030b20fb98f5606695d4425a4de118911047b7677b8cb0c95b7b022c28

SHA512
1f6393df7d2f9098b2bd7b9dc21327d3334e3f0fdf4190062720f75261106be34fbcc2f58c2ad2b834cc9e6c46ca9a0bca2ca4af1fd38cba23da776129850147

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
311KB

MD5
65cf6dd0f2143379a9151bdb053591dd

SHA1
5329d50ace3d71a470160ed4fa2cb73c0efb72af

SHA256
1ee76a0f9504cd60f865244985b15e4eece9f62cf6fb3e4b4799ce53f0d702f5

SHA512
4cba0b43f772abf07724d1e86e90eac5c43e641a4ebe2ad3650d8ced3a93c1fd1945cbbf9376889b840dee91d8beff37321b711942391fa6a22c2fc75e9d5a48

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
311KB

MD5
f8b7847712e35714b1394f6126d6e4f9

SHA1
0e4dbff12af5eec16f49c78265c96bcaf43037b8

SHA256
76e21d5dafcb93489fd7f1c8545be631706faeaea9444d3f068f01dc7d32911c

SHA512
779f8739a19999a04ea78cb51bd39f13b4f98743fbe43224b21f867ba161e36cae79df15797d222a3c44b66b637e4482cb244025f39ff4b6156d41215a4739a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
362KB

MD5
e381c71a728c0651d75d838cec62fb8a

SHA1
47931229bfb8ff816a87ddddebc355382d304df1

SHA256
67f2941a7a54cda29cff54281aa3f4d8fecd62d845a264fa1129a613fd3c9aac

SHA512
b16a2ec446efffc0ee5bb9d5d5b96ca1a6238dd99bef86ad7ca2cd0de9170b6e4443d5cccf60b14f90b6040474de3da444b7d9788e16470ccae831cf16093d10

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
137KB

MD5
cb87dda035f8bd590a7c3dca9d5ebc96

SHA1
95938e4f25703e1fb5169a978036c2f3168e8f85

SHA256
16dc2bee9e687bce74bb281d3ef541dc5c8efb3da3d6df902ab7dae04b8f0660

SHA512
bfaac83d25a6cfccefc21184379a0e926b9b6be89e5d5af6dd9384861dd51058bb7e9ba552133a2e3871d50ebe96a709c679cd8c0ea8f034813f91f4c64fd658

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
311KB

MD5
dc34a4e8c1c661324799fa104239b59e

SHA1
d553e59b41c9248b313537749f8ef16a13445092

SHA256
97edd4c668c22de35b3c4898ba89e43691a2736e5d70fecb581afaf37e7a1768

SHA512
e8f24f6f783831cb8ab2eb7c23389e0a1340989ee5d1b5618ba4c3f07ffbfc14aebf01366213fa2cff568c340829e315bf0c546c443f65a18b26423437b7e5e4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
311KB

MD5
f5d28e9ae0f4b9e2d206747d784758bb

SHA1
73436ae3b9a2933792cd5f7993b16c8e5b6d6c47

SHA256
a46524ee56a4232b07acd63e38e5868c15f7968dd0f1bc164ef59fcae17ec784

SHA512
5bbaf78391bf1fb240e3b2a6955a3ed832f2b686f88d2b438370035af8ca754c0f0832dc35101a87c324bf873f6d1c043cb70bc2f58dc189a1c91c5d59e92ed6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
110KB

MD5
f8baa22f9f16ffb33e02dd39061158d8

SHA1
f2537a1fdbc202138495275c61d3890d444570e3

SHA256
724b2cf7973977407652a717bbc905d3bcd9666f138d0d30872ab83bc36f5b01

SHA512
1f9f53a1de88fae22732974e0806a9bf763eb772fff59452d02e69fb65b32e23954bffd7df06d7410b15e1de615e09676b6c601fddfda599ce0a19998957b484

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
105KB

MD5
8343f7e62e2a1ea6f9ff3c8aa0ff3353

SHA1
3c09cc7c01763e54731d02f98cfd5528ff7fd797

SHA256
ca61332f5530cd4fe14a59ed06973ee938a1b594e4852bd5ab80850630f9d488

SHA512
ef987878b58f45433d01958d002e6e0210aa78be1451b4f17c10f6efa9e28eaf3c0cc2e674956373d0a306d1b710ed3d4cc936844de610049a292eb8f7b57bf7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
100KB

MD5
077a4bb10b78d91664b576975b49d86a

SHA1
15ef2cc90548db79a7924c44f8229fef48422a07

SHA256
d2d977e2013fbcd2d804411e6e351cca3244a0edfaf10a147898bcdc7984e309

SHA512
e6827b18f605d91987e3f5d6bc53380932493486a38e2fc48f4702e7ec8753d36b7583cf72f0a41d527da233483960a28cf8829ef113e1a25fc8635e2c682ccd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe580683.TMP

Filesize
92KB

MD5
6c97e2a6fbf4ee939b0a542261910209

SHA1
04c95af18f4812b721de36d6f29fca3db1010822

SHA256
d4753a1187fe4bca5c4411a3ff5ad1eac0f3f912ce49d9057015b6527aec20bb

SHA512
6205aecd5d1e97f79b8392c2b6c186a95cb6df8295187b7a817dfbf098e0a4ab5a21c941c380f16431427c26b860a07dedbe5278b39f52e0d4a3e5507eed2bc4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d3ccc43a-f51b-45d5-a613-01d1aacf6eb2.tmp

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240928020419_000_vcRuntimeMinimum_x64.log

Filesize
2KB

MD5
5d8ff3d6692794ba28b269d199831bcb

SHA1
64ef6e5c047b507a5fd5a8056a25fc28c54fb1a8

SHA256
e42cf00c1811c47c3a34703a3514c57da2dee477cc94ed57359eab97ba610239

SHA512
f44d765f065fd44e063a002467ee395652a2a900d118ea1d28989295c0afdc0c08a3b4153ac9583ccc55cbc5220e6ef534fa66ca5508f2849c355287a4a6b37f

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240928020419_001_vcRuntimeAdditional_x64.log

Filesize
2KB

MD5
e6932ba814f7607c16ff95f234d748dd

SHA1
9d868226726dc600d51b7e1c37c244a3b1c44ed5

SHA256
36af8ba6d5d4887a1539d0e939a4e77f7bf409f9fbe059dc4edc9bc32d54c010

SHA512
41a0c3b28ba3eea12aee6bd5147f7274de92500d2f6d96b656dd9d3912ed9fc5b521b1031940b3329c5b0e4fe205d7abf5ba83db864f347cb10bb3516c49478c

Download Submit
C:\Users\Admin\Downloads\Emulator.exe

Filesize
595KB

MD5
2b7ef56653b01cc61164d1bd9bd82b45

SHA1
fe8d92790b20a148c19a9ad7c10224d7f6a2764e

SHA256
d6a5a5b67b03c06784983df43b1b7fe6c9d625b57a7c5fda6ea4074fb5b4074b

SHA512
02d89785ba0b8d7cf7c28c4c7dbd15526a6a07cd9035c0945a70c610d525873ab7e3366f9d46e589e207c1c2aa337b484bf4984e62d4d5f83d0665db1b185ed5

Download Submit
C:\Users\Admin\Downloads\Loader.exe

Filesize
15.3MB

MD5
a90f69253ceb817be4d3f906994cda21

SHA1
7a81528c624dd522db7004171d566bd3916facbb

SHA256
b8aac5b1dbcea71a24c6ecb0ba416ee2dda96f8a7821988c30cca7062ca1ffec

SHA512
ee231715d68286838d1c4858ac1ed1d728052ba5d2e7f0d4897d31e360e869761cbac26c4c092c43aa3bf2512d88c49be0d601e51404cbe9a6bc3624ea8d0451

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 159406.crdownload

Filesize
25.3MB

MD5
044b5657529471e023ee2da2dad94cfa

SHA1
0f12b86643dd9261d030616fe73fee8d927f1b32

SHA256
0c6ed6426c29681b003b89bd43cb5a2ceb88d8ebb5a282a69fba0694c00faa5e

SHA512
7ce75f616350ace9eae59b68507e1f19e9e1d187d71e9d5a6056a01f09a3083db5489e2cb0a4cabdabde00cc8d14258d456d7640c833189b107990d061eaa419

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 732326.crdownload

Filesize
24.2MB

MD5
1d545507009cc4ec7409c1bc6e93b17b

SHA1
84c61fadf8cd38016fb7632969b3ace9e54b763a

SHA256
3642e3f95d50cc193e4b5a0b0ffbf7fe2c08801517758b4c8aeb7105a091208a

SHA512
5935b69f5138ac3fbc33813c74da853269ba079f910936aefa95e230c6092b92f6225bffb594e5dd35ff29bf260e4b35f91adede90fdf5f062030d8666fd0104

Download Submit
C:\Users\Admin\Videos\Captures\desktop.ini

Filesize
190B

MD5
b0d27eaec71f1cd73b015f5ceeb15f9d

SHA1
62264f8b5c2f5034a1e4143df6e8c787165fbc2f

SHA256
86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

SHA512
7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Download Submit
C:\Windows\Temp\{16E1C878-A71E-490D-90C9-700F1B70B873}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{16E1C878-A71E-490D-90C9-700F1B70B873}\cab2C04DDC374BD96EB5C8EB8208F2C7C92

Filesize
5.4MB

MD5
d5a3fd8ad806f66d33d652d5913a95b3

SHA1
7b1bb6cdbe700acc2434dc52c40cdd96a6462a17

SHA256
cc001c20f85e16015e0d23eb0c3a9bc3c3cdcc1adda53f88ac77dd29705ba01a

SHA512
594d710133f44049546c62c3c89614415ad776c24f3ada0a8d1724e6daf27f941eba43a05a096d90cdf51ad51c02462edd6308e2aa393cb8325fde256ed77037

Download Submit
C:\Windows\Temp\{16E1C878-A71E-490D-90C9-700F1B70B873}\cab5046A8AB272BF37297BB7928664C9503

Filesize
962KB

MD5
8eccd85b6c4273a28a54b0687feb6a96

SHA1
be791128af5713d407df2f7436ea8de1a80ca725

SHA256
8fafd6d0754ee53125902df1b67ef2db86eb7af4c097522f2fb58443501fecdd

SHA512
9fdcb359a5748d0d920e1e12cf31de42fa224840fd11e5878f7caff7c4495b4facacf1a58cdaf0caadd0d9a3af871870b755245d2c1af33f07f3229b85101da0

Download Submit
C:\Windows\Temp\{16E1C878-A71E-490D-90C9-700F1B70B873}\vcRuntimeAdditional_x64

Filesize
188KB

MD5
5fc68510b7425822a9d0928567ffbd1b

SHA1
f506d97ceac3c435ce6bafda7c47d9a35fc57714

SHA256
7489cdde6a0c8aadb3253f22c460c2dc8099ba677f42d46b277f7040327c9b28

SHA512
4dd4d99ace30eb1add9ae225f159f68636d42d1899acb50f616717f05045e402a2bbb76e4d86569a08ae74bb161b3911a73910fcc7044429da34159cf6b9f473

Download Submit
C:\Windows\Temp\{16E1C878-A71E-490D-90C9-700F1B70B873}\vcRuntimeMinimum_x64

Filesize
188KB

MD5
0d00edf7e9ad7cfa74f32a524a54f117

SHA1
eea03c0439475a8e4e8e9a9b271faaa554539e18

SHA256
e55a6c147daab01c66aed5e6be0c990bbed0cb78f1c0898373713343ef8556cd

SHA512
0b6730fa8d484466a1ee2a9594572fa40fb8eea4ec70b5d67f5910436ee1d07c80a029cf1f8e488a251439ac1121fd0a76a726836e4cb72dd0fe531ce9692f6a

Download Submit
C:\Windows\Temp\{FDCFD168-F1E5-4406-B3EC-C83EBF00456D}\.cr\VC_redist.x64.exe

Filesize
635KB

MD5
ae0540106cfd901b091d3d241e5cb4b0

SHA1
97f93b6e00a5069155a52aa5551e381b6b4221eb

SHA256
8cd998a0318f07a27f78b75edb19479f44273590e300629eff237d47643c496c

SHA512
29bb486bfdd541ba6aed7a2543ff0eb66865af737a8fb79484fb77cb412c3b357c71c16addf232c759d3c20c5e18128df43c68d1cba23f1c363fd9e0b7188177

Download Submit
\Windows\Temp\{16E1C878-A71E-490D-90C9-700F1B70B873}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
memory/1016-549-0x0000000000080000-0x00000000000F7000-memory.dmp

Filesize
476KB

Download
memory/4136-511-0x0000000000080000-0x00000000000F7000-memory.dmp

Filesize
476KB

Download
memory/4296-2-0x0000000140000000-0x0000000141047000-memory.dmp

Filesize
16.3MB

Download
memory/4296-7-0x00007FFD8B8A0000-0x00007FFD8BA7B000-memory.dmp

Filesize
1.9MB

Download
memory/4296-6-0x0000000140000000-0x0000000141047000-memory.dmp

Filesize
16.3MB

Download
memory/4296-5-0x00007FFD8B8A0000-0x00007FFD8BA7B000-memory.dmp

Filesize
1.9MB

Download
memory/4296-4-0x0000000140000000-0x0000000141047000-memory.dmp

Filesize
16.3MB

Download
memory/4296-3-0x0000000140000000-0x0000000141047000-memory.dmp

Filesize
16.3MB

Download
memory/4296-1-0x00007FFD8B948000-0x00007FFD8B94A000-memory.dmp

Filesize
8KB

Download
memory/4296-0-0x0000000140000000-0x0000000141047000-memory.dmp

Filesize
16.3MB

Download
memory/4704-1481-0x0000000009CF0000-0x000000000A033000-memory.dmp

Filesize
3.3MB

Download
memory/4704-1511-0x0000000000400000-0x0000000000726000-memory.dmp

Filesize
3.1MB

Download
memory/4704-1512-0x0000000050000000-0x00000000501DB000-memory.dmp

Filesize
1.9MB

Download
memory/4704-1513-0x0000000050A80000-0x0000000050E72000-memory.dmp

Filesize
3.9MB

Download
memory/4704-1522-0x000000000A9A0000-0x000000000AB40000-memory.dmp

Filesize
1.6MB

Download
memory/4704-1521-0x000000000A410000-0x000000000A432000-memory.dmp

Filesize
136KB

Download
memory/4704-1520-0x000000000A300000-0x000000000A331000-memory.dmp

Filesize
196KB

Download
memory/4704-1519-0x0000000009CF0000-0x000000000A033000-memory.dmp

Filesize
3.3MB

Download
memory/4704-1516-0x0000000001540000-0x0000000001F66000-memory.dmp

Filesize
10.1MB

Download
memory/4704-1514-0x0000000000D30000-0x00000000014DC000-memory.dmp

Filesize
7.7MB

Download
memory/4704-1518-0x0000000009A50000-0x0000000009B82000-memory.dmp

Filesize
1.2MB

Download
memory/4704-1517-0x0000000009A00000-0x0000000009A41000-memory.dmp

Filesize
260KB

Download
memory/4704-1515-0x00000000014E0000-0x000000000153A000-memory.dmp

Filesize
360KB

Download
memory/4704-1456-0x00000000014E0000-0x000000000153A000-memory.dmp

Filesize
360KB

Download
memory/4704-1457-0x0000000000D30000-0x00000000014DC000-memory.dmp

Filesize
7.7MB

Download
memory/4704-1491-0x000000000A9A0000-0x000000000AB40000-memory.dmp

Filesize
1.6MB

Download
memory/4704-1484-0x000000000A410000-0x000000000A432000-memory.dmp

Filesize
136KB

Download
memory/4704-1483-0x000000000A300000-0x000000000A331000-memory.dmp

Filesize
196KB

Download
memory/4704-1479-0x0000000009A00000-0x0000000009A41000-memory.dmp

Filesize
260KB

Download
memory/4704-1480-0x0000000009A50000-0x0000000009B82000-memory.dmp

Filesize
1.2MB

Download
memory/4704-1470-0x0000000006D20000-0x0000000006D40000-memory.dmp

Filesize
128KB

Download
memory/4704-1469-0x0000000006D20000-0x0000000006D40000-memory.dmp

Filesize
128KB

Download
memory/4704-1458-0x0000000001540000-0x0000000001F66000-memory.dmp

Filesize
10.1MB

Download
memory/4916-548-0x0000000000080000-0x00000000000F7000-memory.dmp

Filesize
476KB

Download
memory/5076-1510-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/5076-1424-0x0000000007010000-0x00000000070FA000-memory.dmp

Filesize
936KB

Download
memory/5076-1420-0x0000000002370000-0x00000000026B3000-memory.dmp

Filesize
3.3MB

Download