discordrat | 82732970819d94679571bd75e125145f248f53da7b9a1610c2c8e15723e9a568

Resubmissions

14-10-2024 13:35

241014-qv4bvssbpr 10

Analysis

max time kernel
684s
max time network
711s
platform
windows11-21h2_x64
resource
win11-20241007-it
resource tags

arch:x64arch:x86image:win11-20241007-itlocale:it-itos:windows11-21h2-x64systemwindows
submitted
14-10-2024 13:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

78KB
MD5

1d314f1fc8fae5c78a202bec555064bf
SHA1

c8b4c16f29bdc357052a1e35b5129c788de30f15
SHA256

82732970819d94679571bd75e125145f248f53da7b9a1610c2c8e15723e9a568
SHA512

0484e39eafdcc0a9f7783f9f19286c6410281826cc067e5bfd8940033d29e69c1e0ab5b1b6f8ce432ffa516e4a6ce8bc00ad06854c52d7102b1363ee546fcc6a
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+xPIC:5Zv5PDwbjNrmAE+hIC

Score

10^/10

discordrat defense_evasion discovery persistence privilege_escalation ransomware rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI5NTMzNzg4MDY3MTA5Mjc0Nw.GtMwkk.5Wt5mYxAlm7wuZHi-xyeGjfs8FGFRwJHrIkZ6I
server_id
1295337779596759112

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

Client-built.exe

description	pid	Process	procid_target
PID 4748 created 628	4748	Client-built.exe	5

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wmiprvse.exewmiprvse.exewmiprvse.exewmiprvse.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wmiprvse.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 5 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

Processes:

svchost.exe

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Inventory.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Application-Experience%4Steps-Recorder.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Troubleshooter.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Telemetry.evtx	svchost.exe

Abuse Elevation Control Mechanism: Bypass User Account Control 1 TTPs 1 IoCs

UAC Bypass Attempt via SilentCleanup Task.

defense_evasion privilege_escalation

Bypass User Account Control

T1548.002

Processes:

SCHTASKS.exe

pid	Process
1256	SCHTASKS.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 54 IoCs

Web Service

T1102

Processes:

flow	ioc
119	discord.com
59	discord.com
65	discord.com
58	discord.com
61	discord.com
95	discord.com
103	discord.com
38	discord.com
39	discord.com
80	discord.com
105	raw.githubusercontent.com
1	discord.com
102	discord.com
54	discord.com
56	discord.com
62	discord.com
104	discord.com
1	raw.githubusercontent.com
53	discord.com
55	discord.com
101	discord.com
57	discord.com
66	discord.com
76	discord.com
83	discord.com
97	discord.com
106	discord.com
107	discord.com
3	discord.com
16	discord.com
81	discord.com
99	discord.com
17	discord.com
36	discord.com
12	discord.com
10	discord.com
11	discord.com
79	discord.com
82	discord.com
98	discord.com
19	discord.com
77	discord.com
64	discord.com
94	discord.com
6	discord.com
18	raw.githubusercontent.com
68	discord.com
78	discord.com
7	discord.com
8	discord.com
35	discord.com
69	discord.com
5	discord.com
13	discord.com

Drops file in System32 directory 6 IoCs

Processes:

OfficeClickToRun.exesvchost.exe

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

Client-built.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp468A.tmp.png"	Client-built.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Client-built.exe

description	pid	Process	procid_target
PID 4748 set thread context of 2472	4748	Client-built.exe	79

Drops file in Windows directory 3 IoCs

Processes:

chrome.exechrome.exechrome.exe

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 36 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wmiprvse.exeWINWORD.EXEwmiprvse.exewmiprvse.exewmiprvse.exeWINWORD.EXEwmiprvse.exe

description	ioc	Process
Key security queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key security queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key security queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmiprvse.exe
Key security queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key security queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmiprvse.exe

Enumerates system info in registry 2 TTPs 23 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

wmiprvse.exechrome.exechrome.exeWINWORD.EXEwmiprvse.exemsedge.exeWINWORD.EXEchrome.exewmiprvse.exewmiprvse.exewmiprvse.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

Explorer.EXEsvchost.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Internet Explorer\Main	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Internet Explorer\Toolbar	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\e0b3c236_0	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\e0b3c236_0\ = "{2}.\\\\?\\hdaudio#func_01&ven_8086&dev_0022&subsys_80860022&rev_1001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\\elineouttopo/00010001\|\\Device\\HarddiskVolume2\\Program Files\\VideoLAN\\VLC\\vlc.exe%b{4533F59D-59EE-00C6-ADB2-C68B501A6655}"	svchost.exe

Modifies data under HKEY_USERS 21 IoCs

Processes:

OfficeClickToRun.exesvchost.exechrome.exechrome.exechrome.exesvchost.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ProviderPasswordCharacterGroups = "2"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ProviderPasswordLength = "8"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,17962391,508368333,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133733866944625179"	chrome.exe

Modifies registry class 59 IoCs

Processes:

Explorer.EXEDllHost.exe

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f80cb859f6720028040b29b5540cc05aab60000	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Extensible Cache\BackgroundTransferApi	DllHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Extensible Cache\BackgroundTransferApiGrou = "INetHistory\\BackgroundTransferApiGroup"	DllHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\LogicalViewMode = "2"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Extensible Cache\BackgroundTransferApiGrou	DllHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByKey:PID = "2"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Extensible Cache\BackgroundTransferApiGrou = "1"	DllHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Explorer.EXE
Key created	\Registry\User\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\NotificationData	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "2"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Extensible Cache\BackgroundTransferApiGrou = "9"	DllHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = ffffffff	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\FFlags = "1092616209"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByDirection = "1"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Extensible Cache\BackgroundTransferApiGrou = ":BackgroundTransferApiGroup:"	DllHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Extensible Cache\BackgroundTransferApi\Cac = "9"	DllHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 3a002e8005398e082303024b98265d99428e115f260001002600efbe11000000cc69a518af18db015b6e8571bf18db015b6e8571bf18db0114000000	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\FFlags = "1092616193"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Sort = 0000000000000000000000000000000002000000f4eec83032a8e241ab32e3c3ca28fd29030000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Extensible Cache\BackgroundTransferApi\Cac = "0"	DllHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Extensible Cache\BackgroundTransferApi\Cac = ":BackgroundTransferApi:"	DllHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Extensible Cache\BackgroundTransferApiGrou = "C:\\Users\\Admin\\AppData\\Local\\Packages\\microsoftwindows.client.cbs_cw5n1h2txyewy\\AC\\INetHistory\\BackgroundTransferApiGroup"	DllHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "1"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\IconSize = "48"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByKey:FMTID = "{30C8EEF4-A832-41E2-AB32-E3C3CA28FD29}"	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Rev = "0"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Extensible Cache\BackgroundTransferApi\Cac = "1"	DllHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Mode = "6"	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Extensible Cache\BackgroundTransferApiGrou = "0"	DllHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Extensible Cache\BackgroundTransferApi\Cac = "C:\\Users\\Admin\\AppData\\Local\\Packages\\microsoftwindows.client.cbs_cw5n1h2txyewy\\AC\\INetHistory\\BackgroundTransferApi"	DllHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupView = "4294967295"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Extensible Cache\BackgroundTransferApi\Cac = "INetHistory\\BackgroundTransferApi"	DllHost.exe

Suspicious behavior: AddClipboardFormatListener 6 IoCs

Processes:

Explorer.EXEWINWORD.EXEvlc.exeWINWORD.EXE

pid	Process
3332	Explorer.EXE
2060	WINWORD.EXE
2060	WINWORD.EXE
5068	vlc.exe
2480	WINWORD.EXE
2480	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Client-built.exedllhost.exe

pid	Process
4748	Client-built.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
4748	Client-built.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
4748	Client-built.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
4748	Client-built.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
4748	Client-built.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
4748	Client-built.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
2472	dllhost.exe
4748	Client-built.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

Explorer.EXEvlc.exe

pid	Process
3332	Explorer.EXE
5068	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

Processes:

chrome.exemsedge.exechrome.exechrome.exe

pid	Process
3136	chrome.exe
3136	chrome.exe
3136	chrome.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Client-built.exedllhost.exeExplorer.EXEsvchost.exesvchost.exe

description	pid	Process
Token: SeDebugPrivilege	4748	Client-built.exe
Token: SeDebugPrivilege	4748	Client-built.exe
Token: SeDebugPrivilege	2472	dllhost.exe
Token: SeShutdownPrivilege	3332	Explorer.EXE
Token: SeCreatePagefilePrivilege	3332	Explorer.EXE
Token: SeShutdownPrivilege	3332	Explorer.EXE
Token: SeCreatePagefilePrivilege	3332	Explorer.EXE
Token: SeAuditPrivilege	2040	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2420	svchost.exe
Token: SeIncreaseQuotaPrivilege	2420	svchost.exe
Token: SeSecurityPrivilege	2420	svchost.exe
Token: SeTakeOwnershipPrivilege	2420	svchost.exe
Token: SeLoadDriverPrivilege	2420	svchost.exe
Token: SeSystemtimePrivilege	2420	svchost.exe
Token: SeBackupPrivilege	2420	svchost.exe
Token: SeRestorePrivilege	2420	svchost.exe
Token: SeShutdownPrivilege	2420	svchost.exe
Token: SeSystemEnvironmentPrivilege	2420	svchost.exe
Token: SeUndockPrivilege	2420	svchost.exe
Token: SeManageVolumePrivilege	2420	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2420	svchost.exe
Token: SeIncreaseQuotaPrivilege	2420	svchost.exe
Token: SeSecurityPrivilege	2420	svchost.exe
Token: SeTakeOwnershipPrivilege	2420	svchost.exe
Token: SeLoadDriverPrivilege	2420	svchost.exe
Token: SeSystemtimePrivilege	2420	svchost.exe
Token: SeBackupPrivilege	2420	svchost.exe
Token: SeRestorePrivilege	2420	svchost.exe
Token: SeShutdownPrivilege	2420	svchost.exe
Token: SeSystemEnvironmentPrivilege	2420	svchost.exe
Token: SeUndockPrivilege	2420	svchost.exe
Token: SeManageVolumePrivilege	2420	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2420	svchost.exe
Token: SeIncreaseQuotaPrivilege	2420	svchost.exe
Token: SeSecurityPrivilege	2420	svchost.exe
Token: SeTakeOwnershipPrivilege	2420	svchost.exe
Token: SeLoadDriverPrivilege	2420	svchost.exe
Token: SeSystemtimePrivilege	2420	svchost.exe
Token: SeBackupPrivilege	2420	svchost.exe
Token: SeRestorePrivilege	2420	svchost.exe
Token: SeShutdownPrivilege	2420	svchost.exe
Token: SeSystemEnvironmentPrivilege	2420	svchost.exe
Token: SeUndockPrivilege	2420	svchost.exe
Token: SeManageVolumePrivilege	2420	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2420	svchost.exe
Token: SeIncreaseQuotaPrivilege	2420	svchost.exe
Token: SeSecurityPrivilege	2420	svchost.exe
Token: SeTakeOwnershipPrivilege	2420	svchost.exe
Token: SeLoadDriverPrivilege	2420	svchost.exe
Token: SeSystemtimePrivilege	2420	svchost.exe
Token: SeBackupPrivilege	2420	svchost.exe
Token: SeRestorePrivilege	2420	svchost.exe
Token: SeShutdownPrivilege	2420	svchost.exe
Token: SeSystemEnvironmentPrivilege	2420	svchost.exe
Token: SeUndockPrivilege	2420	svchost.exe
Token: SeManageVolumePrivilege	2420	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2420	svchost.exe
Token: SeIncreaseQuotaPrivilege	2420	svchost.exe
Token: SeSecurityPrivilege	2420	svchost.exe
Token: SeTakeOwnershipPrivilege	2420	svchost.exe
Token: SeLoadDriverPrivilege	2420	svchost.exe
Token: SeSystemtimePrivilege	2420	svchost.exe
Token: SeBackupPrivilege	2420	svchost.exe
Token: SeRestorePrivilege	2420	svchost.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exemsedge.exechrome.exe

pid	Process
3136	chrome.exe
3136	chrome.exe
3136	chrome.exe
3136	chrome.exe
3136	chrome.exe
3136	chrome.exe
3136	chrome.exe
3136	chrome.exe
3136	chrome.exe
3136	chrome.exe
3136	chrome.exe
3136	chrome.exe
3136	chrome.exe
3136	chrome.exe
3136	chrome.exe
3136	chrome.exe
3136	chrome.exe
3136	chrome.exe
3136	chrome.exe
3136	chrome.exe
3136	chrome.exe
3136	chrome.exe
3136	chrome.exe
3136	chrome.exe
3136	chrome.exe
3136	chrome.exe
3136	chrome.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

chrome.exemsedge.exechrome.exevlc.exeExplorer.EXE

pid	Process
3136	chrome.exe
3136	chrome.exe
3136	chrome.exe
3136	chrome.exe
3136	chrome.exe
3136	chrome.exe
3136	chrome.exe
3136	chrome.exe
3136	chrome.exe
3136	chrome.exe
3136	chrome.exe
3136	chrome.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
5068	vlc.exe
5068	vlc.exe
5068	vlc.exe
5068	vlc.exe
5068	vlc.exe
5068	vlc.exe
5068	vlc.exe
5068	vlc.exe
3332	Explorer.EXE
3332	Explorer.EXE
3332	Explorer.EXE
3332	Explorer.EXE
3332	Explorer.EXE
3332	Explorer.EXE
3332	Explorer.EXE
3332	Explorer.EXE
3332	Explorer.EXE
3332	Explorer.EXE
3332	Explorer.EXE
3332	Explorer.EXE
3332	Explorer.EXE
3332	Explorer.EXE
3332	Explorer.EXE
3332	Explorer.EXE
3332	Explorer.EXE
3332	Explorer.EXE
3332	Explorer.EXE
3332	Explorer.EXE

Suspicious use of SetWindowsHookEx 24 IoCs

Processes:

Explorer.EXEMiniSearchHost.exeWINWORD.EXEvlc.exeWINWORD.EXEClient-built.exechrome.exe

pid	Process
3332	Explorer.EXE
2636	MiniSearchHost.exe
2060	WINWORD.EXE
2060	WINWORD.EXE
2060	WINWORD.EXE
2060	WINWORD.EXE
2060	WINWORD.EXE
2060	WINWORD.EXE
2060	WINWORD.EXE
2060	WINWORD.EXE
3332	Explorer.EXE
5068	vlc.exe
2480	WINWORD.EXE
2480	WINWORD.EXE
2480	WINWORD.EXE
2480	WINWORD.EXE
2480	WINWORD.EXE
2480	WINWORD.EXE
2480	WINWORD.EXE
2480	WINWORD.EXE
4748	Client-built.exe
4748	Client-built.exe
2676	chrome.exe
2676	chrome.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

RuntimeBroker.exe

pid	Process
3868	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Client-built.exedllhost.exe

description	pid	Process	procid_target
PID 4748 wrote to memory of 1256	4748	Client-built.exe	77
PID 4748 wrote to memory of 1256	4748	Client-built.exe	77
PID 4748 wrote to memory of 2472	4748	Client-built.exe	79
PID 4748 wrote to memory of 2472	4748	Client-built.exe	79
PID 4748 wrote to memory of 2472	4748	Client-built.exe	79
PID 4748 wrote to memory of 2472	4748	Client-built.exe	79
PID 4748 wrote to memory of 2472	4748	Client-built.exe	79
PID 4748 wrote to memory of 2472	4748	Client-built.exe	79
PID 4748 wrote to memory of 2472	4748	Client-built.exe	79
PID 4748 wrote to memory of 2472	4748	Client-built.exe	79
PID 4748 wrote to memory of 2472	4748	Client-built.exe	79
PID 4748 wrote to memory of 2472	4748	Client-built.exe	79
PID 4748 wrote to memory of 2472	4748	Client-built.exe	79
PID 2472 wrote to memory of 628	2472	dllhost.exe	5
PID 2472 wrote to memory of 684	2472	dllhost.exe	7
PID 2472 wrote to memory of 988	2472	dllhost.exe	12
PID 2472 wrote to memory of 408	2472	dllhost.exe	13
PID 2472 wrote to memory of 460	2472	dllhost.exe	14
PID 2472 wrote to memory of 760	2472	dllhost.exe	15
PID 2472 wrote to memory of 912	2472	dllhost.exe	16
PID 2472 wrote to memory of 1032	2472	dllhost.exe	17
PID 2472 wrote to memory of 1060	2472	dllhost.exe	18
PID 2472 wrote to memory of 1068	2472	dllhost.exe	19
PID 2472 wrote to memory of 1128	2472	dllhost.exe	20
PID 2472 wrote to memory of 1160	2472	dllhost.exe	21
PID 2472 wrote to memory of 1228	2472	dllhost.exe	22
PID 2472 wrote to memory of 1280	2472	dllhost.exe	23
PID 2472 wrote to memory of 1360	2472	dllhost.exe	24
PID 2472 wrote to memory of 1368	2472	dllhost.exe	25
PID 2472 wrote to memory of 1472	2472	dllhost.exe	26
PID 2472 wrote to memory of 1512	2472	dllhost.exe	27
PID 2472 wrote to memory of 1548	2472	dllhost.exe	28
PID 2472 wrote to memory of 1572	2472	dllhost.exe	29
PID 2472 wrote to memory of 1656	2472	dllhost.exe	30
PID 2472 wrote to memory of 1708	2472	dllhost.exe	31
PID 2472 wrote to memory of 1720	2472	dllhost.exe	32
PID 2472 wrote to memory of 1772	2472	dllhost.exe	33
PID 2472 wrote to memory of 1792	2472	dllhost.exe	34
PID 2472 wrote to memory of 1924	2472	dllhost.exe	35
PID 2472 wrote to memory of 2040	2472	dllhost.exe	37
PID 2472 wrote to memory of 2172	2472	dllhost.exe	39
PID 2472 wrote to memory of 2180	2472	dllhost.exe	40
PID 2472 wrote to memory of 2276	2472	dllhost.exe	41
PID 2472 wrote to memory of 2368	2472	dllhost.exe	42
PID 2472 wrote to memory of 2380	2472	dllhost.exe	43
PID 2472 wrote to memory of 2408	2472	dllhost.exe	44
PID 2472 wrote to memory of 2420	2472	dllhost.exe	45
PID 2472 wrote to memory of 2448	2472	dllhost.exe	46
PID 2472 wrote to memory of 2504	2472	dllhost.exe	47
PID 2472 wrote to memory of 2556	2472	dllhost.exe	48
PID 2472 wrote to memory of 3040	2472	dllhost.exe	49
PID 2472 wrote to memory of 3160	2472	dllhost.exe	50
PID 2472 wrote to memory of 3176	2472	dllhost.exe	51
PID 2472 wrote to memory of 3332	2472	dllhost.exe	52
PID 2472 wrote to memory of 3460	2472	dllhost.exe	53
PID 2472 wrote to memory of 3508	2472	dllhost.exe	54
PID 2472 wrote to memory of 3868	2472	dllhost.exe	57
PID 2472 wrote to memory of 3948	2472	dllhost.exe	58
PID 2472 wrote to memory of 4000	2472	dllhost.exe	59
PID 2472 wrote to memory of 4056	2472	dllhost.exe	60
PID 2472 wrote to memory of 4320	2472	dllhost.exe	61
PID 2472 wrote to memory of 4396	2472	dllhost.exe	62
PID 2472 wrote to memory of 2300	2472	dllhost.exe	65
PID 2472 wrote to memory of 3660	2472	dllhost.exe	66

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:628
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:408
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{8afc302e-2351-4680-a61a-f6d207da9235}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2472

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:460

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:760

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1128

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1228
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3160

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1360

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1472

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1548

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
- Modifies Internet Explorer settings
PID:1572
- C:\Windows\system32\AUDIODG.EXE
  C:\Windows\system32\AUDIODG.EXE 0x00000000000004C8 0x00000000000004BC
  2⤵
  PID:4532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1656

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1792

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1924

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Drops file in System32 directory
PID:2276

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2380

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:2504

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2556

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3176

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3332
- C:\Users\Admin\AppData\Local\Temp\Client-built.exe
  "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Sets desktop wallpaper using registry
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Windows\SYSTEM32\SCHTASKS.exe
    "SCHTASKS.exe" /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I
    3⤵
    - Abuse Elevation Control Mechanism: Bypass User Account Control
    PID:1256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3136
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffaa147cc40,0x7ffaa147cc4c,0x7ffaa147cc58
    3⤵
    PID:3108
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1768,i,4351070673462937274,7910669130865185677,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1736 /prefetch:2
    3⤵
    PID:1964
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2100,i,4351070673462937274,7910669130865185677,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2108 /prefetch:3
    3⤵
    PID:4856
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2196,i,4351070673462937274,7910669130865185677,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2116 /prefetch:8
    3⤵
    PID:744
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3052,i,4351070673462937274,7910669130865185677,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3080 /prefetch:1
    3⤵
    PID:4340
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3088,i,4351070673462937274,7910669130865185677,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3124 /prefetch:1
    3⤵
    PID:5008
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3544,i,4351070673462937274,7910669130865185677,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4416 /prefetch:1
    3⤵
    PID:2796
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4620,i,4351070673462937274,7910669130865185677,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4596 /prefetch:8
    3⤵
    PID:1596
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4684,i,4351070673462937274,7910669130865185677,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4696 /prefetch:8
    3⤵
    PID:1376
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4872,i,4351070673462937274,7910669130865185677,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4884 /prefetch:8
    3⤵
    PID:1980
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4920,i,4351070673462937274,7910669130865185677,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4928 /prefetch:8
    3⤵
    PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0x104,0x12c,0x7ffaa1643cb8,0x7ffaa1643cc8,0x7ffaa1643cd8
    3⤵
    PID:3832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1932,2310086703456853934,8749247698369820101,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1960 /prefetch:2
    3⤵
    PID:3256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1932,2310086703456853934,8749247698369820101,131072 --lang=it --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
    3⤵
    PID:3888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1932,2310086703456853934,8749247698369820101,131072 --lang=it --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
    3⤵
    PID:1312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,2310086703456853934,8749247698369820101,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3116 /prefetch:1
    3⤵
    PID:3984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,2310086703456853934,8749247698369820101,131072 --lang=it --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3132 /prefetch:1
    3⤵
    PID:4196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,2310086703456853934,8749247698369820101,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
    3⤵
    PID:3628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,2310086703456853934,8749247698369820101,131072 --lang=it --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
    3⤵
    PID:1416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,2310086703456853934,8749247698369820101,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
    3⤵
    PID:836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,2310086703456853934,8749247698369820101,131072 --lang=it --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3892 /prefetch:1
    3⤵
    PID:700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,2310086703456853934,8749247698369820101,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
    3⤵
    PID:1140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1932,2310086703456853934,8749247698369820101,131072 --lang=it --service-sandbox-type=none --mojo-platform-channel-handle=3504 /prefetch:8
    3⤵
    PID:2388
- - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1932,2310086703456853934,8749247698369820101,131072 --lang=it --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
    3⤵
    PID:3016
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\HideWrite.docx" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2568
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffaa147cc40,0x7ffaa147cc4c,0x7ffaa147cc58
    3⤵
    PID:1292
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1904,i,16479097654399571104,9172483805726103497,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=1900 /prefetch:2
    3⤵
    PID:652
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1924,i,16479097654399571104,9172483805726103497,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=1940 /prefetch:3
    3⤵
    PID:3744
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1664,i,16479097654399571104,9172483805726103497,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=2188 /prefetch:8
    3⤵
    PID:4504
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3096,i,16479097654399571104,9172483805726103497,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=3124 /prefetch:1
    3⤵
    PID:3376
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3104,i,16479097654399571104,9172483805726103497,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=3152 /prefetch:1
    3⤵
    PID:1520
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4384,i,16479097654399571104,9172483805726103497,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:2624
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4616,i,16479097654399571104,9172483805726103497,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=4452 /prefetch:8
    3⤵
    PID:4336
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4408,i,16479097654399571104,9172483805726103497,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=4716 /prefetch:8
    3⤵
    PID:868
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4796,i,16479097654399571104,9172483805726103497,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=4772 /prefetch:8
    3⤵
    PID:4428
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4932,i,16479097654399571104,9172483805726103497,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=4940 /prefetch:8
    3⤵
    PID:4688
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\link.mp3"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5068
- C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:2480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of SetWindowsHookEx
  PID:2676
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffaa0ddcc40,0x7ffaa0ddcc4c,0x7ffaa0ddcc58
    3⤵
    PID:836
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1804,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=1800 /prefetch:2
    3⤵
    PID:3644
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2116,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=2120 /prefetch:3
    3⤵
    PID:4032
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2180,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=2128 /prefetch:8
    3⤵
    PID:1420
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3124,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=3132 /prefetch:1
    3⤵
    PID:3316
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3140,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=3172 /prefetch:1
    3⤵
    PID:1824
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4472,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=4492 /prefetch:1
    3⤵
    PID:4664
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4452,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=3116 /prefetch:8
    3⤵
    PID:4048
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3560,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=4724 /prefetch:8
    3⤵
    PID:1524
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4624,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=4632 /prefetch:1
    3⤵
    PID:2068
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3168,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=3176 /prefetch:1
    3⤵
    PID:3120
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4456,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=4884 /prefetch:1
    3⤵
    PID:4304
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5032,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=5044 /prefetch:1
    3⤵
    PID:3544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5228,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=4876 /prefetch:8
    3⤵
    PID:2996
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5204,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=5348 /prefetch:8
    3⤵
    PID:3652
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5556,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=4864 /prefetch:1
    3⤵
    PID:4380
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=4312,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=5056 /prefetch:1
    3⤵
    PID:940
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5788,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=5736 /prefetch:8
    3⤵
    PID:752
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5276,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=4796 /prefetch:8
    3⤵
    PID:3200
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5900,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=5872 /prefetch:1
    3⤵
    PID:3932
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=4920,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=4944 /prefetch:1
    3⤵
    PID:3300
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=5448,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=5492 /prefetch:1
    3⤵
    PID:3648
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5464,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=5424 /prefetch:1
    3⤵
    PID:4048
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=5416,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=5440 /prefetch:1
    3⤵
    PID:3812
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=5224,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=5220 /prefetch:1
    3⤵
    PID:3360
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=5520,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=6020 /prefetch:1
    3⤵
    PID:5260
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=6264,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=5232 /prefetch:1
    3⤵
    PID:5272
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=6420,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=6412 /prefetch:1
    3⤵
    PID:5280
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=6428,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=6564 /prefetch:1
    3⤵
    PID:5292
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=6592,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=6708 /prefetch:1
    3⤵
    PID:5304
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=6728,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=6856 /prefetch:1
    3⤵
    PID:5316
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --field-trial-handle=6984,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=6880 /prefetch:1
    3⤵
    PID:5324
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --field-trial-handle=7112,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=7140 /prefetch:1
    3⤵
    PID:5332
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --field-trial-handle=7520,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=6164 /prefetch:1
    3⤵
    PID:6112
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --field-trial-handle=7556,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=7564 /prefetch:1
    3⤵
    PID:6120
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --field-trial-handle=5460,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=7704 /prefetch:1
    3⤵
    PID:5224
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --field-trial-handle=7720,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=7644 /prefetch:1
    3⤵
    PID:5216
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --field-trial-handle=7944,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=7844 /prefetch:1
    3⤵
    PID:5300
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --field-trial-handle=8092,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=8100 /prefetch:1
    3⤵
    PID:5724
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --field-trial-handle=8108,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=8236 /prefetch:1
    3⤵
    PID:1272
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --field-trial-handle=8384,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=8244 /prefetch:1
    3⤵
    PID:5700
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --field-trial-handle=8404,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=8524 /prefetch:1
    3⤵
    PID:5448
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --field-trial-handle=8672,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=8548 /prefetch:1
    3⤵
    PID:5452
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --field-trial-handle=8680,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=8812 /prefetch:1
    3⤵
    PID:5436
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --field-trial-handle=8960,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=8820 /prefetch:1
    3⤵
    PID:5400
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --field-trial-handle=8980,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=9100 /prefetch:1
    3⤵
    PID:5456
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --field-trial-handle=9132,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=9248 /prefetch:1
    3⤵
    PID:5920
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --field-trial-handle=9396,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=9268 /prefetch:1
    3⤵
    PID:6020
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --field-trial-handle=9256,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=9540 /prefetch:1
    3⤵
    PID:5472
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --field-trial-handle=9688,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=9560 /prefetch:1
    3⤵
    PID:5368
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --field-trial-handle=9728,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=9716 /prefetch:1
    3⤵
    PID:5464
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --field-trial-handle=9300,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=9944 /prefetch:1
    3⤵
    PID:6048
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --field-trial-handle=9956,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=9980 /prefetch:1
    3⤵
    PID:5484
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --field-trial-handle=10244,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=10260 /prefetch:1
    3⤵
    PID:5412
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --field-trial-handle=10300,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=10252 /prefetch:1
    3⤵
    PID:6064
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --field-trial-handle=10532,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=10552 /prefetch:1
    3⤵
    PID:5996
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --field-trial-handle=7404,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=9428 /prefetch:1
    3⤵
    PID:6576
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --field-trial-handle=10112,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=9392 /prefetch:1
    3⤵
    PID:6608
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --field-trial-handle=10836,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=10212 /prefetch:1
    3⤵
    PID:6596
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --field-trial-handle=9576,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=11248 /prefetch:1
    3⤵
    PID:7316
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --field-trial-handle=8984,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=9672 /prefetch:1
    3⤵
    PID:7380
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --field-trial-handle=11344,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=11188 /prefetch:1
    3⤵
    PID:7392
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --field-trial-handle=3736,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=11596 /prefetch:1
    3⤵
    PID:7500
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --field-trial-handle=11720,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=11704 /prefetch:1
    3⤵
    PID:7560
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --field-trial-handle=11840,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=11748 /prefetch:1
    3⤵
    PID:7572
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --field-trial-handle=12024,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=12032 /prefetch:1
    3⤵
    PID:7740
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --field-trial-handle=12144,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=12044 /prefetch:1
    3⤵
    PID:7752
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --field-trial-handle=12348,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=12344 /prefetch:1
    3⤵
    PID:7860
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --field-trial-handle=11852,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=11848 /prefetch:1
    3⤵
    PID:7868
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --field-trial-handle=12620,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=11580 /prefetch:1
    3⤵
    PID:7976
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --field-trial-handle=12748,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=12360 /prefetch:1
    3⤵
    PID:7984
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --field-trial-handle=11464,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=11180 /prefetch:1
    3⤵
    PID:8132
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --field-trial-handle=13004,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=12956 /prefetch:1
    3⤵
    PID:8188
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --field-trial-handle=13156,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=13140 /prefetch:1
    3⤵
    PID:7648
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --field-trial-handle=13300,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=13296 /prefetch:1
    3⤵
    PID:4988
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --field-trial-handle=13412,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=13416 /prefetch:1
    3⤵
    PID:8092
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --field-trial-handle=13584,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=13576 /prefetch:1
    3⤵
    PID:6592
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --field-trial-handle=6252,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=6228 /prefetch:1
    3⤵
    PID:5968
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --field-trial-handle=9680,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=11864 /prefetch:1
    3⤵
    PID:6476
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --field-trial-handle=12296,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=12316 /prefetch:1
    3⤵
    PID:6648
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --field-trial-handle=11864,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=11276 /prefetch:1
    3⤵
    PID:5444
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --field-trial-handle=11732,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=11184 /prefetch:1
    3⤵
    PID:7416
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=9976,i,17304504104215371238,9328243743744850726,262144 --variations-seed-version=20241013-180211.763000 --mojo-platform-channel-handle=9964 /prefetch:8
    3⤵
    PID:5108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3508

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of UnmapMainImage
PID:3868

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3948

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
- Modifies registry class
PID:4000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4056

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:2300

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:3660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2692

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2396

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:3292

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1320

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:2220

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
PID:4628

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Modifies data under HKEY_USERS
PID:3968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:828

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:2068

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:2200

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:2636

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
PID:4844

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:1144

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3316

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4664

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}
1⤵
PID:3128

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
PID:2584

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:5092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2296

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
PID:7928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
338B

MD5
141e84acec6c8e3f236d30392863b731

SHA1
d9d3b252aebcb7b4177b26a479db306d56360f13

SHA256
b0f99e33abb591f77b64769873a68519b7afa492a7fc7cbb33787a04094d9b50

SHA512
8587481ead21789980541779eb4adb9385eb25a94e6b2fb393cfcd4a0b3f05ec54db07c93c6614c73d8d33a1ca54186e8f130114d9a4395a92d0f59f7198fe71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
338B

MD5
36a85c6b525c6503a1084d5bce5c1aa9

SHA1
e409d51d9c11ac9bfc9c6bc32632962864b33066

SHA256
2e5e614f444df8c91cce6ba0747dc0c34e285692752461b7264f7dd33cd9b0e4

SHA512
8bc45e2fc2aa05236af1dcc96d3f82912f751f6bf6b8d6b8c3c8bde2398d69aa42a75ca464ee5eb2057b8f4738ef1580a8f4f0d47a68ace9fcde0cd9d35926f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
338B

MD5
59f8bf49c4cd72e6e6977776c5bcba3c

SHA1
e1b9d3ee7be49bfc9f5c5dfafbaed054858ee385

SHA256
d79394e54799fd1403e337ded2b636beaabdf4579e1e7eab5031f2ed99f7bef8

SHA512
ef34e21d235c3f92e21ac77587be0ae3476f6c27848b5c2f910c87f1d6ef7aec4b1b6abd61ebbe3db01640b6d744832bf00c729192ace459a8ce739b44a771de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
31eee4fd7bade553b991c50d770bb275

SHA1
88c95ac89973ef2d44ab203e532775d511bd7228

SHA256
27fc841e50efb70b1a0869a5d8a8a09254c213a503f3db6566fc41537cb78e85

SHA512
573ae6e3c722fae6518b1edcbbe0f5f99bca95be61c0fb6c2110859af0e90ef78576c61ba9b92af1dcd7e03aec4f4bb37ff4c24488e2bd3e0070f69e402dea64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
54c598adbd769c70b33fe88a5888bee4

SHA1
332bd255a360032580977eb28bb54fea80869160

SHA256
26934cf3b86ecffecf887d5e40cbc6fcc8ad97b158ea85b986d7806ba8d99295

SHA512
2184a12891399419ebfb42d05485fd1c35e4f8b866ce40e2fb1c4c4555cca9ac63cdb74035d7641a78181b728267db8acf19a302a619df39d6224b4d7238469a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749

Filesize
330B

MD5
9087092c7d6390fe9252356972ef99c1

SHA1
f047c9a2a4a5ff06f914ff6847ecbc1bbaf4ec8e

SHA256
1f56eb34446eb67feaca5d1d46c0c66bfd161b2f42073d39d38750e72a4bdc48

SHA512
403ffa5b4008af9538dd0866da0e9f72ca1eced7d585ac50ad1ad2b455b263950bebebb4d24c5bb81542280eedcea729634eb92df72c29c76c5766e6c8b32575

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
b5ad5caaaee00cb8cf445427975ae66c

SHA1
dcde6527290a326e048f9c3a85280d3fa71e1e22

SHA256
b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

SHA512
92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
1008B

MD5
d222b77a61527f2c177b0869e7babc24

SHA1
3f23acb984307a4aeba41ebbb70439c97ad1f268

SHA256
80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

SHA512
d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
79e90b79849ab24f7077995c4e45f1d5

SHA1
3dae744f25bcaa1b690d61b789a8b1e58a790953

SHA256
3d2a7a2b6c89618f30d26fd5dac9ff7d52d6cf1d3651fd7aaa1d1229464b1507

SHA512
6169379e245102bc4b1ff74bc2c7cf356f24fdef55e5f3f8a7323da36f6ca92f1ec38bf230cacecc89c33e12e1b201de417a570a998f31cb281bed3ae8f8deb1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\797f7786-84be-4f36-afaf-46209426376c.tmp

Filesize
9KB

MD5
68fef4cb990353316c4099205373a7ba

SHA1
27b6cabca9ea7c270e58f30b4c980cd6bfa1035f

SHA256
b185b2df80612cfd2325681f04a01903740bcbf5e0e6f31ee1d9b236cf4856f4

SHA512
6d8051b5a1dc59ea24186d7e6e2d4165490f1dd63ec6051949a44f4f590c750dc21b90e25c5b3ae3e2f730a61b4feb2d2e76bacffdebfddf483218df9e960e7e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
0c109e7c04fe67a04a9da883016fa20f

SHA1
892ff8874c5ffa8de5cda1932796b031aa127ad1

SHA256
d65dbee7eb45517395bf85ba9a2294584f385147bcc97f748495621031ef5fb9

SHA512
a75aea51ca79a84683366ff6a2dc932e94361585be74f1e6c8c5f3c53fe9bffb8cdb3b1b373decd70db4b7d1a0182775e00b811ffbda7ef210f0b72b3e10a0ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
e014d3b11431bf28b5a31f7d249b30d0

SHA1
5cf5f9dfa63b854f3a141d6e76c5f9d0e639732b

SHA256
095a55148e5ba97c5f34d9c40b9597ed799d4911be9063c5c0c2093e06f09cf8

SHA512
ad294d1fc7a35bc50ef433ed4ad5edb2b88ad92731f357531794faaac5cea95332df0a66f872d93fdadfe9098763ac30fb2a6b2c885ccaf8168d8bce50f0204d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
4257643119eb2db98feba240fc6b89e8

SHA1
b365b1454b15ec7983ad9312738583831e1954f3

SHA256
470f8670ab55a6587ecf4a8a9a8054e29296820c0e249263838cba91b474ad10

SHA512
363fb528020669a8d969de2cd799fd15b47963b2cc5c4e02390cf4cfc7897c88c3295acfd6fd5675cd104e46ed1da9efbeaa34d81fd8e759ca49fb861236f537

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2

Filesize
1.0MB

MD5
cf217d712c4bf0982f5b4cbae6ddde5a

SHA1
ea362dc171ac45038fb7771d2182c72d368d93fb

SHA256
47bae565499a3df35910a66663b3a138ccf93dd55a23f65def59614c3e425467

SHA512
961f9a710a18919decae3530b1b53b0ca7816712cb9ad4277b00ef49de0066d49003a2696754519fbd577f82f7b05d1c0859e8a5215793c909a9abac4b362442

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3

Filesize
4.0MB

MD5
d4f932ef1cc239d3972d844bd1247537

SHA1
a3751ae3c1b37dab91a0f6aa897d54779ac9cd1c

SHA256
e783bcdc88e027cbadbec9ffa97b173c47c6a023c9e98380b056bb217a82bb08

SHA512
806c56e07214b8b50e3c9a2ea1ecd7ba1cf0f16e039ae41d60591ed3e1418bea5fe11ca7f1872d0577d7ce55a46ad1a319ab96ff7e1096e9bc3a558c2a8f76d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

Filesize
36KB

MD5
ca6e073083242f7c8e6d8c4c67fbcb6b

SHA1
9fb2e250ad4aef83cee18f2baaaf097615a38c6d

SHA256
93e7af3805be89b290cb180340fcd1d301638237c3d3a09cd25a313ff3353f2d

SHA512
2e59b42ea82a7f83925b36bff6a07bd611fb0c33601b7bddb720ecbe0c1097c2ef72dd87d20f55337b47b7474abac6511203a4f11d6939d6b7d47385383b9192

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

Filesize
62KB

MD5
2a269f39d847da7bf9b5d6841726b888

SHA1
3e3fbcdcdff5d84a331c0ecb9106637137cd4847

SHA256
f9401bcef77841dc036b71ec058704f10dde85bcef9b7efc42a12fbd0d200515

SHA512
40e14c79501180e5d0a28099b6df83ebe37f8b043cdd9295bffef7c4a376a6226ff330f8a0a15189d361fef1ca2bc661907c0e7b141c72257dcfcecec22719c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

Filesize
41KB

MD5
abda4d3a17526328b95aad4cfbf82980

SHA1
f0e1d7c57c6504d2712cec813bc6fd92446ec9e8

SHA256
ee22a58fa0825364628a7618894bcacb1df5a6a775cafcfb6dea146e56a7a476

SHA512
91769a876df0aea973129c758d9a36b319a9285374c95ea1b16e9712f9aa65a1be5acf996c8f53d8cae5faf68e4e5829cd379f523055f8bcfaa0deae0d729170

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000067

Filesize
215KB

MD5
1585c4c0ffdb55b2a4fdc0b0f5c317be

SHA1
aac0e0f12332063c75c690458b2cfe5acb800d0a

SHA256
18a1cfc3b339903a71e6a68791cde83fca626a4c1a22be5cb7755c9f2343e2a5

SHA512
7021ed87f0c97edc3a8ff838202fa444841eafcbfa4e00e722b723393a1ac679279aa744e8edde237a05be6060527a0c7e64a36148bd2d1316d5589d78d08e23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00009f

Filesize
92KB

MD5
87f6b41fe985fcd8a064e401071a0f34

SHA1
43874fd5258ab35fe352c474677cac2120168664

SHA256
5b707e67f7561ddb9be3d9a9e4b3010e3b14b3e69d1ae74131e55c10703c6365

SHA512
16d046adc947d72cdc076ee6b5e51001e45bfe49b44b7ab3dd7118ca43c51b96f77c895080e7520903b1018089826437c6e81a6bff99c1f0f6a0940a2a986962

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
efebbfaa633d807583e8e1a1ec507580

SHA1
d7f17834fe7bf36a6284963eec7642fdc8008468

SHA256
d324302b9a1144fe9c138b0c04fad12976e076e12ce8167e8fd2f092c5b120ff

SHA512
08d0b6156c937796a457447651108861eeb5eb07df74c6e859a8dc937b8b631795a9911bc3717dea87935042c2bd9b872681761fe027f0e08a1601cd13c7620f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
c17efb95a1bf8f29715d149c32d53b6a

SHA1
2388a8f51bb36f8820973d7a5f2ccc14ebfda741

SHA256
7a4f71506f1d91ccfc0672b11eccc1add3cbf650031cba322f26d0765a4790f1

SHA512
9874cc2bf87361326c2cfe180794413b6326a08708cfd68c49728bdc1380615a06dc7a37e5e2dbbd7962af66453c25da06222ea01573cb049d06702ee5c2eafb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
0611ea2beebeffb161509473c80e05ef

SHA1
fe6402cb7006bafce736a2f8a1610f4499e778ca

SHA256
030620b4db12b0fc8c39c5894dc649fddee91e11de6e9779428b80a934c20130

SHA512
baeb5dcfdbebbf02b4f236bd4c4a76fc149fc3402826d150cf34a4f803a542319336cf505de37ffa9f5db5eb99464670bd998e5a8ecae1ad12d9cbb97c4b867d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
c3db8e263c2d7b1264509d25b0fe2265

SHA1
9058b91567b0cadc2ccb47c929e63ba6c8b46a9c

SHA256
78febdd668789546db05fb3448123ef742986a835ace5175a8d4e81f5453e899

SHA512
f4aee41f758e6c0577ea60c4b7314381f7dab6601c3dff5c106949fce3b2b416ee2e25a02256e0d4c59ecc2eb3ad6e71c48859a5629aac6c2634b759137e7285

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_0

Filesize
44KB

MD5
5f0d0338a9af776ba6b95d4645a976af

SHA1
e2dfbd81bd41267a1d71d74b718be4dd3ef09690

SHA256
fa6883265c625778bc3a7dccac2bdcff429b7438e31723ef7d54fcc00a2a82ab

SHA512
df5962aec69f4ebf7f9a336e4850a118d5b5c9b364cc4c442c73b39f8d15cf07c4584e41b8bb20dcaef6636458c15204795f05ac02f479acdb71fe683d5e3d87

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
22414a22814ad364a4446eacde6fd443

SHA1
17fc7871cd2d83a873487ae70097958f95f65881

SHA256
852ed7d41cc573d1affe7b08320be28919e1f6946ab301b8002416b8c94c4181

SHA512
358faa5381a1b0379630b2179fa44d1f6092e0c4ceaa0067a415d515cb68291be1ef7a9e4e1e31386c9575968b7db226fb61bbf5e3fd79855b0c201c345a5163

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG

Filesize
329B

MD5
181ef3d1b0f3abc3f9ad37a6c974804f

SHA1
9629ae2d7239a1ae30a478dbf2083e6893127578

SHA256
d7e398800ac15f02278f7b202abdbc11efbf81f0e2d8cb0931bd82b1c91382ac

SHA512
018e19e2f72191e20dd5f608886f3e33be92aed0f3fe799066b605a493b48f79bb159869447451d260fa6639b6678cf08009b710309974acb36bd53a71b15009

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\3f2aa6e1-0da2-4bdc-b971-415ed50d1f4c.tmp

Filesize
354B

MD5
5f49d523abf2ebec85eabfd64806c3c7

SHA1
25c90f346975562d2b4e6fbc339d872682c9e0df

SHA256
6a0af9f9c65cdd82e8fac0f4a98cb0d6f671cba0aa9a06b3c3d7fda01d2d5bf9

SHA512
3afe6649128ccfec1934adf165b3dae213e3ba163dcd75ed3ede42083b9597d2fe65da9a9e91621fae1e45ee1365ac08c3de6094f0235f0b8ca7ef552b3ce44c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies

Filesize
20KB

MD5
999ecca9d5e4009a42c4fb78ccb1820e

SHA1
6365e4d124b65392f5311a4cb782826cb348394c

SHA256
be218f4b5a18b0a792e0e2a5348ff6217de881634473a55414983e1829d6407f

SHA512
4f47d4c76baf30183dedc01d20ef98788f842de205b8677816f9df3fd14d01856cb28cb8f4a87700e3067c943970a4458ff979f8561d86cd726e876cb9541f97

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
39KB

MD5
3104eabc8917dac25e4e59ecff1355f3

SHA1
818ca305e69af45d199d993e945d2469830c3408

SHA256
e8373f5899e279cced60e267e9bb1e303fc585548954e37579840c5b14d2f9df

SHA512
15c70f14ae2d88d2c46f038c7bbd98a8ab980ae045bef7dce791c1a073716539f8eee951737c16c7804d98ee93b517b1bec3ee9f8a44bfea92ba7efbc6d46872

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
197ae9c8e5bc2477ace5eb6a0588de34

SHA1
c17194428763c814f85ea8de055e26a0509527b5

SHA256
801cc73d1980ea11909e139b3972b95fca9644d2a2654ab5cb6db90b5beab5da

SHA512
994a0362e5bb01c0ce946cca1d9c4f78cb0188cc730ccef636fbf0c56b251a07b356c48fe91cbc621230c168f4f31129fbb0b60f0c1143a203b98bed8398a08e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL

Filesize
36KB

MD5
8a66f81c61a982e8938f864704e802a6

SHA1
99dc56748e06accbedf5a4d2264a11c70d8707ea

SHA256
adbe71d26b3b06ab313e438f4c29cde9aaaf025ba6007861f27f09316330cac9

SHA512
cb5290003f5812ecd74703e7e73d019672bb425b1e2b3b0f3d80cd74082b878ea2cf04c01d480e1aa6db2b999b17a64b55f58a153a6012b88d9bd981e9c36cf3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
6eaa04533e269df9e0bbc80400bf525e

SHA1
8ca18db6f22ee3ed691059dcba220a774d09fcd2

SHA256
4068a88e3c0656338780343729907b84d5d7bdb4f8a611aa57ee17b4ae261d5f

SHA512
bb32a38da848a22b504b7b9c22e600a51054cabd4c7dcb6af7f21724cf5c00e20674a5c1b4781bd6b5aa55a3469777de62d00facee0a6c97be0de55ab805306a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
c7cb6dab8d5523f7f2fb19b3f662798a

SHA1
e7001afcf97c2e6af7e33ea4bada9e1c937dea16

SHA256
e28353a90457b48393bc03465f27ce86e4e57638e41451fc4d66e2550ad9821e

SHA512
929b225f45fb11ebbfb945ea8545fc9866eb43c451c9723d527c1f91069c7cd759f31de7e175680b1e5909d5584015d40d9fcafb5619af4d2d07212ce1f5d3ed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
ba6d7465b26aa89e6973c3d891e185ab

SHA1
7064d66ef5c754aca9f34f935b4da2cbbf4d6d47

SHA256
3b366b4c3898af0de356a175c7d103d36fbc7d9c42a29b39d538d6e352665ec6

SHA512
eb395a2d224230d0b43b00d462afe5ebd206591d35234df3b99d7d3318ec5938f3a97488cccc33659ed252ffb7d341a9075328b99224ba8c0abf8ab399da243f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
d5bd7a3287b63a5169e8bbf0626bc9c5

SHA1
6f39d2b5fef7abee54a390d2113370ad9efcc73c

SHA256
30b8ace63f1bc90528308a5dccc35b7af84d934ad4bfb949a3975e230da0cfb8

SHA512
5c670ff1c615863fd20755cba47aa890019a71b8033b35015fb4bfed932cf8b7136e4199963372e0326bca97915c82f68df36f9416855bd204b1dfc570c95c9f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
895be0398d4f89ec1bf95cf4d0663372

SHA1
87d419f73f40edb7b7a695bb827f804b405af6e1

SHA256
b7fcb2857ea341109cdfdc5ed6e4d0ca5ae3c776c32ac6a878c8bc3871963270

SHA512
5bbceef9c5c291cd2540794f589b5d24775b15cdb5b0e4da846713777170fba4bf2bd70adaed8d4443604880c24342f6aab68d1b273fbf8ce70697b8af1bf2d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
7ce3dd5af8102655fc35492cb496009a

SHA1
4650e0837a3d97a48c82a4cb6f3e28bb7ef3ae8e

SHA256
4e3a16157f2e3db8977a2bc2aa5985693fd3d47b3044e5b5bc8461ced270a8e6

SHA512
8b675ae67566abe2a9816bdfb3ff90244b3a9a527ebd0f718ad1a1506810cfabfda545376dcede57ff7a0947fba353a1f4a971d69baf3c6e6fcc73270ba1eafa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
e8c0183eb40e2e4438d7135481a7249f

SHA1
d6770bb75036c999653794a8064036f0d69001a5

SHA256
d01422c2825cd836ebd2df496eb01063f3e1f14ef12a4d354706a99269e9398a

SHA512
31fe77f7bc9b6e043798eda5407e81f5b10f88b15b55cd4f3bf2ebd89fa2b56536e297840f674e11b856fea69bee481290007cb3cea829da175507249e01cbd0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
9e608b45589d08ecef040c64a50d62ab

SHA1
1e4fb04660290e9c9e887543e3c9cea44b5a6c21

SHA256
721ea66d873effcb9c474f4ff79feb1e8d8007001ea742930f2a849ea99505b4

SHA512
d91021de6466f7d186d8fb75bd04ec6a63ca2147cb037da6f681d5ccdadf999cef58d3feae509b21778982c05e4acaa02f20d165e69070559047331b982749c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e67e1cb969fdb00cc753326f058b1534

SHA1
82d6b8f34101e72eaa1e1d73503e2dad5514e102

SHA256
094b4bad10f8352c49cdc38badbaa561b83da13abd0dc8ff8227c5d33abec05e

SHA512
69b87189da1bb9ff80ccfc8f8b3eb449cd9daf3aa17bdee1466b774bc3328cb1dd3fb2846baf652f333d87d60426ae3575d867dec1919f079b809f33fcb5604d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
833f9c39e8372d9d289ee95e2b54f258

SHA1
0536ff3c701a19ce298e135f95397b6c46487454

SHA256
d86aff20619988282d93f868841094a6a73bd973434dd95f92e9eb24f0a807fc

SHA512
9a453c32e83b788d23ec55aeb8c63e4529425d553636679eeb989b1d151436b99e484a55d40f291dc23082f22030724b52c3bcdb7c9c81e0c1f7a2969c9704a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
ca6a27e9f2c3826fa97ede3b0ae153b2

SHA1
107559c7ad5e3954bfa4d12a0d76878a3212cf08

SHA256
25c798dfe9a08842169e1782a092d722f87e16b1476ec2a7ff47b6d57510dff5

SHA512
5bd3bc0d35676b31d5b7e4df0a37dbf8b262527aaa0b414d21c4b5da64ce9c7fd9511ad320f14ea69baf7dace5a5cac2ea754122eb54ffc773c5ffae0be16f09

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
6a6eed3c2739227c4778161800866e71

SHA1
f0c7b2b1e9c40b3837fa944cd6fb6720a7c11f54

SHA256
d78214641ec12d0402797c4a60940e8292433edcbfd65c1726fd85f6e00afc10

SHA512
065845022468725f5b822183a049ea2d5e6f41bed1d51e78618ec93c03c25e81cdc935407ddc664f48c813618a86d5cc5842e8773cd93676b922d8c6c50f383c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
b6e07e60d0801e437cbd391c871b2071

SHA1
153a9ec64839c8ba995989dc79bc660288890230

SHA256
598a2d29c964c6841ba81b3c4b5743a0b63b4d28317e4054050db14caae30fb3

SHA512
7ba7acb709608f3ba9d9f2e073928a38583d0dd13affc66235e29f583ea00500af1b7811c14464fe0f471859df552a1aea61a0cc3b112739d83beffbaafc3731

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
6b116ee1c252d15ee2d77f69bded84c9

SHA1
60dc2439cf68e16a42b05a478528b920a843e8b1

SHA256
f34aa617c76c2b0452b9d559b2de69a33f52f952719947ff310d8f76a3e4f49a

SHA512
6a195532c3f3ebc9e949907c47ea895b263645e8034af4ed403dc6e24e2712060137f26da621e7b46cdca9b5d0c87023a94a7819fe74d773366d8abe4868e34c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
e2d98bc19297d4517ffa79ca6f7b9bba

SHA1
7b84e0803c59e17250201480398a8cc29fb6ceb4

SHA256
55b8971963ced3d01a50286db7dd5bdb3e5cbda5dcb488ae14089adb12b7d580

SHA512
a8680bb93fa9b05ae2f9f559d3abfd2056292196c4a42c896e362e7ea3675000aa5e00caa37c6f76652a2349fb93e85d02918af50f6db385711adae63b5b2d8e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
4ce02bc8fc1cce7564d328fbc6bc54d5

SHA1
2ed055acdabd78d1b5e2584d1fa4064c5e1fdaf5

SHA256
eb5c9d56abc5aeef54861e4be1e2a183a5826a83fe4ee9d5ead6991c80006785

SHA512
ff52cef1cb6c2594d0659c4d6561403ad57374030d8b248ab878b0867fe85c3ad174f281d77c79d963b950930637fab3990058505827f51f3d575111cdf81463

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
11a7331ecf1116e993829d51948106de

SHA1
19c6c4fcf8ec4cf752ed454a8eb82f2c0ae5aea3

SHA256
91803e86eb9b2a231b7be23f51bbf070d78e5fdcadcacf06f68c06e1caa8b147

SHA512
fdf67f7fcd18b8f7d4235f38b4b267a7eed141e2fa6e8b79cb75f74589ca2ee19107a716aea136955ac9f9456d9eb9713b56e0e49f070ec337fedab90a2b1fc6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
ae600f1cac6221533212175cb5132d71

SHA1
d0bb402872e30a8da3d369b60cef5d6afef0b057

SHA256
acee67d7c0638845b7a18fa1afcf14d5929a2e9457183b028f3c3b925e9a7c52

SHA512
fdfdba6d39e0eec3c924b2911cffa231fd0ef16c05de4a5bf221ba362915f91c714eb3dcbf4108e725479b5dddf943b1e8d000a563d811021ff79dabbbfe18db

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
bc9e8dfda98a28010262b855bb4e4fcd

SHA1
a1531bdc31166b890fa8d7b4ed26a0b1308b5a41

SHA256
942b3a907111877fc455a858cad77834f717a5c6fa0c32bb096bbf787101164d

SHA512
4b61a11d9e22d66511e9f263e3de6d53e7da61818cec638f465228207817cbefc2a8a7cb4c12429777415a4b3de14b6d1fadfbdeeac57960aa9267e8d646d220

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
85df40868ba1f01411a48598234cfc01

SHA1
bffcce3ebc1476d5ae2a72eff1b2d9c8b2f556bf

SHA256
91e0eba7ab2ac14b6f8438a89b38e411ede348d5fc1cfbb0d6ab6ad9e3b07739

SHA512
38df77736b33ffae39ed7be26fa64b97eee63997dc8dbe1ae485b938bfa2696b2673a8d44c7196f5a2cc4cd02b86631500c284ba61ab043ffdac9210a2abf1dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\8f2a3a278767c49cf048137c85a690743efd8eca\3df33429-5908-4254-a316-748fdd8af04d\index-dir\the-real-index

Filesize
1KB

MD5
3e23a240131ccbe8451bd312121fc3d8

SHA1
707bff8bc36eabc7b66cb39da6a6a640342f0eab

SHA256
74405f9f4d64c3cb27a4ae80f8330f33087f60976c08c4075e5d21e70a926db8

SHA512
a6dbd7c9e3eced1e13d58632de0d85eb8d71602a74f368f3d7cbda2be88f47ae5c5d481d15b4caaeef942e65828268b5cea07bb6be3e94e22cc237fe6f10c553

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\8f2a3a278767c49cf048137c85a690743efd8eca\3df33429-5908-4254-a316-748fdd8af04d\index-dir\the-real-index~RFe60acde.TMP

Filesize
48B

MD5
b33fc9971908657b17e2a7548a66fc71

SHA1
b86896bc152aac1848a6c56f796bbf8dfb0e4e6b

SHA256
c405dd0efb7904941d1280fc922220e28996a0c78118f87fe9c1da1235cba727

SHA512
a054e15d3dabb618035c8a8ac9b7dc596e0b7c7fc87a27cb28dc8fa42ec1799f7ab4cbbe48b4f55d95f9525a9997e11e1dfe7e2f29bfd60ff288c7fe169183bb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\8f2a3a278767c49cf048137c85a690743efd8eca\index.txt

Filesize
126B

MD5
7c40b8e9443b2a0fe6cc464e0662fe2b

SHA1
54877f5d290e576415ceb4cfde0e64f1854c76e1

SHA256
ad6820d77d95b8ef1b25a7a5dd3424e008933630a2204784a4af7a62b7b268d1

SHA512
ecfe070b9c066749b6df748380c6739ac5a9a5ec48d17f2ff5841bb915702d8e6a49b1b3ca5f5f4488f7e7ad20f031adf7171ea277e776be272af4ce36e8c888

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\8f2a3a278767c49cf048137c85a690743efd8eca\index.txt~RFe60acfd.TMP

Filesize
131B

MD5
0e080c75208524350ca222b93f6e6737

SHA1
bef53bb02ff615c4a71c53d6b8af43aa9e4093b6

SHA256
4e46e7f3e954435d89156ddebc93c408f780d61ea5b0d8c3c2b7809c6bfa294d

SHA512
463da9221735d07df5fa3e9bd3e9fa03fd6b53a5eb7e7d390614c44350b75747954ed7f6f7fabf555e61a974439f79429e724ebe4d56f64f2d42b11a0e9642f4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG

Filesize
333B

MD5
3637356c0aca72dcdd409d3f0b8b427a

SHA1
c708c81e3261a71d326e289eee2adee89d9a8c14

SHA256
fa6753506f3e8176a381b04aed994f5c9728447a39928895536db5ec3c2b2249

SHA512
20c6710923f0c75746176a69434c9c1dbfebb4ae7a5e67d9f40628efb7d9563a7f465f6d0ffb4e6d1c57be73d38b27b2020234dfc46614b746afda2a08df5d8c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
120B

MD5
584b2c318e88d6a28358768e5c30c00e

SHA1
265f729de9d6530f2642d44bf329665d01342a1f

SHA256
4d5db18f6288d81cfc9340a7d1f2f3388414188942ab99a2a58fd2181f801249

SHA512
5e1cb82c7767d53f6d8c2a835fa7aa24b9f9070435541965e86150edb27b772f308f0bb5df36930c1cd62d7a2e00af70559317318dbe5b43ed6c2657d111b67a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG

Filesize
345B

MD5
436fd6a2a92610dfe9399cf2a070326a

SHA1
d7bbf788a79fcda8ebe0e6716a3f6d7b406004db

SHA256
c61c03fa4e9e2889d135eef03a47c49cf935974a71b074f05d4d63a8ea36e2ca

SHA512
729fbce068ddbc2b40a03c99d6c607f4cf57049b8a3ed3c213a76600bdbe19a3b4ea44f87b97f63e53a06cbbc6463c09ec28ed832668ba0f183c1dad59db05cd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG

Filesize
321B

MD5
5f325fa8d061a8aecb56a448f714c638

SHA1
a41900c280a45c47cb5344d54aea66a772bee1da

SHA256
6c52089dfd29e2b0780ac77037ceef322d215a07a05f2b59268501db418a95db

SHA512
ed8adf15b5ae60cc53af37c811c2f8e8ac4773e226c5ca827903027632129e956771125e4ad8608e8dbea054e3f869b774de3a01b67fb53d7c84ffaed0966547

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d621a474-3265-4038-bc7e-142d4fcb0a7c.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

Filesize
14B

MD5
ef48733031b712ca7027624fff3ab208

SHA1
da4f3812e6afc4b90d2185f4709dfbb6b47714fa

SHA256
c9ce8dbbe51a4131073db3d6ceef1e11eaca6308ad88a86125f221102d2cee99

SHA512
ce3a5a429e3796977a8019f47806b8c0671b597ead642fcbfbe3144e2b8112d35a9f2250896b7f215d237d0d19c5966caf3fe674165a6d50e14cb2b88c892029

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
7773ba33970928745f88fd322763707f

SHA1
32b136159994bcf3f532e322bb26f8e25d892fb9

SHA256
1e9fabd14443b974cea54672e170a56e71cc950a859919e8ad07090d882a3e2b

SHA512
1daa7dfc1936ddb6c248af48ca55ffde1ffedc53a43ca73afb72bcf8cf47da909ae8318476271ed93c5c75ac1b8f24b900a84ad8ac93815d0bade951f9f242a1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
0f7f8bf5321c002212874317e688bac5

SHA1
6cbbc40f7e5549011bde91e7fae0bab24f1ddde7

SHA256
3f762cb4a97c37b5ec5b009dbd496b1a2fe38f65c27e9348a849c677e27628b6

SHA512
7fae2ce2395dc2fa3b955d8e2ac2d24f8d1bf63007954f9e61a29eae42fcd0abf405d64ce5e4a7a26c27e77be6ecdde0cbebc780d47c32f6473684b8d2173dec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
81b79ee27bb82dc57c10b6ceb30649dd

SHA1
1821e8e00155a1bd70917342d00810b080133289

SHA256
78ee8c347e6badf4c5b74a185ef3fc38fa1d3b52aec766da8d4c1cd3c24d19de

SHA512
8a5c3c6d6e6a2161edc2124983da4aa252302187454f8a93055c9b6af5d0011730a01fc47c63f78dd03957c522fbdb0938d0bc7cb1820c82ff4293cda459b92d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
dd6760de9abe0fc8bb4ece24f61059e1

SHA1
14cb22d4bffb00bdf92a46d87f0543f26a69ba4f

SHA256
5784aa4fb77ede36ad81d80d425bb89069121595cafb039c2fad27dc2215e711

SHA512
3bd124fe7f88ed264e8f7af4b93eefa060223a4a38cafe44bf9ba4d8b05e203fae890981278a6d11dc98f7ee995ed4b348fcf38f6871cb61437eb3b315c82f54

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
3c1b5cf8a50c0ca76df936a2977cdf96

SHA1
9ff0d1b5664a93e5dfc5b1754d693b472e663e15

SHA256
7b631c5ec54560da15ad8728556ed381418e6cd6f3c5377938c86f9b20d8993e

SHA512
e2a9f949c52e42212c6c753c964705fd5dd86c30bb7915fee5e071ccf95454450cc6f8646138fe6c9865d7f6c746df89e229eb9e97effe2486bc4d45f1ddffc8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
dffb489c346a374d335b5db97e47ffbf

SHA1
9a736c56c8f44e0e57a674fcf55e89be709137d4

SHA256
6a2d1a0555bd532386e53b72058fc6d4835039b3465d9551839fa286db3cc16f

SHA512
70b7787dcce6995df5a14964a5d5492e1748d528b67d12222bef9c065157a885b7403155e33e90e2a583f818605281047e53c39f9addb12eac742b23bab09da0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
cb1e3e453a9937102f1bd5106b798710

SHA1
45e774dc9945ee89114ba20d47d208385b81b53a

SHA256
3b9648de745bea887b757d80b713b2e0db4f249ed4dfce35d4dbb2af0e48c0d1

SHA512
6f8c1dda330b54672f52f25282f4869d38c2984f2be382a9e402aace67de4d549f2dc811e16f356fee33086483b29c5db352b14f84e975c4bf49ba0218b01130

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
02a4b762e84a74f9ee8a7d8ddd34fedb

SHA1
4a870e3bd7fd56235062789d780610f95e3b8785

SHA256
366e497233268d7cdf699242e4b2c7ecc1999d0a84e12744f5af2b638e9d86da

SHA512
19028c45f2e05a0cb32865a2554513c1536bf9da63512ff4e964c94a3e171f373493c7787d2d2a6df8012648bbefab63a9de924f119c50c39c727cf81bdc659f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
826c7cac03e3ae47bfe2a7e50281605e

SHA1
100fbea3e078edec43db48c3312fbbf83f11fca0

SHA256
239b1d7cc6f76e1d1832b0587664f114f38a21539cb8548e25626ed5053ea2ab

SHA512
a82f3c817a6460fd8907a4ac6ab37c2129fb5466707edcfb565c255680d7f7212a5669fe2a42976150f16e4e549ea8310078f22ed35514ee1b7b45b46d8cc96e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a2ed124898c593bcbbc149dab8ec47ec

SHA1
475fcf3ad9259dd55215670222bd5ebfcd16f86f

SHA256
0001eb0c7e3788f7d237dbd02fca7ccbbad84bd01b03336b63410a563171aa0a

SHA512
2bc3fc8913d7b8c6060a4903cf1bcaab01eee351e8fd165152ce70944a6919bb716aaa86bcec3b44c41c02dcd451b09af83088a526705ddbe1d13c87cbd60967

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ed6ab2368d628d45e0abf4d1d3384e25

SHA1
211e20dc784f27e2480169e8757d528743944571

SHA256
6072b97cbf556a63c0449891a56cab5cf785c4075a98e3c3ff234ff76d4d94cf

SHA512
913127d89931886801faad81da21821e235750393a895de9faf782185de20ae04c45c46fd8d2fc5583a6cec778db67e1a2d98724ed85bf4ae8ae7c36d61befee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
64e91ec86fcd6cee6050ab3480b3a57b

SHA1
88ea0232c8f5227c45a1e22c45a99abe4225baaa

SHA256
abc2b7a58f907400a1ca7830e53b358e8ca59f200285a605b980bd44398aef7c

SHA512
9d42c58b1fbc1d195119051222d9ac1548fc6006b664dfbd8ffb16e4192dad049fd2093a04e3175f739cecb1bea4afef5c9fe71a51e5ab7381f549282d8acd10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8877760c49ab3a862ace742212cb41e1

SHA1
7a5824056153ae0e62d5b129dbd92f4ff5d35d8d

SHA256
d1961fad0ad7f5164c10ad902d39287279eb54df3375b9249aa20fcdc694a34b

SHA512
dd01b55696f880b23b1cf9790d2030d9f99779bed0d46fac364e732d5f724027260b710e4ff4e458848ec5111a187715219c1774a73c129a8e943eada71d32c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9ad5eda549620200881b54fc6910b0b1

SHA1
10ff2b515b94069f4339ffa5d71af2ffc0c254c9

SHA256
aa3246af8516f9ce2e470a828136d5d888e3ada8529f41f37ea614b6710ead28

SHA512
17553686878eba4904b46dad08e4ee93a1293ad18fbf52b37d8f39886ca8fae7d3fc73e1c7123065b7881b2d301cdd977dabb116dfd632618fe065cd132f64a1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
199B

MD5
4faee10b869cd723013c031f1ac6a802

SHA1
2b59019c5a3c6a0246424ef2766aedce3a3e5990

SHA256
a2a27a4ae8fc5cce9715cbaf8690f2bd7bdbe60f8b0cb89a24b0cd94786e6ea1

SHA512
42a9f12d89d2e0e43d96baecce05d41ca1a3c2c865e338802fcd25c76aa2651829d437d1840ad6388fdad4f523caf925acb39c16b2a51c3e9e7572e68c7b966d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

Filesize
7KB

MD5
bdb3f0cb1b94df7a9fc6f0f069ac8026

SHA1
e2a575e9b5eec90cca10187c5dc89eb80b186f9f

SHA256
904c980af61b35e9be83ee892327798f9f88901bc328369fc3a3068bb9459db6

SHA512
c06159186fdeb113ae76ff282461067f580fd7bc8aa970704bf1256f51915a0c098486f88c4f688b68cc3b7a3a3ca7015491d60cad1880bc591607b9f639bd8b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

Filesize
7KB

MD5
a05cea835cf70146636dfc5cbdabc13e

SHA1
b45979b001c1f8bf791d266e43dfc4891f1872bf

SHA256
4cb256e3980df897232afbedc9aed075612140097ef6563d88b3dfb33c72fd6c

SHA512
78b82da2b027f89d5455ef101a2aed6ec479337851a48726f3e1a392398db6a7db9059addaeb11fcfec3f678ba54c671dd04dd36ba91e9d0cacd76e3709a0c3b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Word\AutoRecovery save of Document1.asd

Filesize
27KB

MD5
cd255359b54bbcc3f997eeea5fab271d

SHA1
48d45fd70a300fbc08bb02bcdec81b42522b0457

SHA256
c926550764b6d6204c71cd60da71a2a5a8187b3527a8b1013674051caf349a16

SHA512
666ad0c15de1df953777ffd639f829a9a1af1a99a716e7f1eb8e45bc4685c37c52ef75a11db46acabc61fe2950aa9beb23bb9bd9bf8856cea44b4d8d593a3fc5

Download Submit
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

Filesize
420B

MD5
f35414b763b9cb03f36e1b06452e7b53

SHA1
6163495285bf553691a31154b6ce74f92ebab911

SHA256
820f0ba0597ea08bf74ba41d19ea316fc4c7f198627c9b0d17a15bcdaa428127

SHA512
833375690bcf2b87ab929111e5a1d011bad98a3b6ca304636f4fe1dd7f884dce5e5f19b12c03777cedd17daa18d05dbf8432a570332e0123bc4d6f558282cb77

Download Submit
\??\pipe\crashpad_3136_LPVZLFEWSFNPUPFA

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/408-262-0x000001D838300000-0x000001D83832A000-memory.dmp

Filesize
168KB

Download
memory/408-35-0x00007FFA86EB0000-0x00007FFA86EC0000-memory.dmp

Filesize
64KB

Download
memory/408-34-0x000001D838300000-0x000001D83832A000-memory.dmp

Filesize
168KB

Download
memory/460-42-0x00007FFA86EB0000-0x00007FFA86EC0000-memory.dmp

Filesize
64KB

Download
memory/460-264-0x000002EE5AD40000-0x000002EE5AD6A000-memory.dmp

Filesize
168KB

Download
memory/460-41-0x000002EE5AD40000-0x000002EE5AD6A000-memory.dmp

Filesize
168KB

Download
memory/628-26-0x00007FFA86EB0000-0x00007FFA86EC0000-memory.dmp

Filesize
64KB

Download
memory/628-260-0x00007FFAC6EC4000-0x00007FFAC6EC5000-memory.dmp

Filesize
4KB

Download
memory/628-259-0x0000023D6F480000-0x0000023D6F4AA000-memory.dmp

Filesize
168KB

Download
memory/628-24-0x0000023D6F450000-0x0000023D6F473000-memory.dmp

Filesize
140KB

Download
memory/628-25-0x0000023D6F480000-0x0000023D6F4AA000-memory.dmp

Filesize
168KB

Download
memory/684-30-0x00007FFA86EB0000-0x00007FFA86EC0000-memory.dmp

Filesize
64KB

Download
memory/684-261-0x000001C9F3E30000-0x000001C9F3E5A000-memory.dmp

Filesize
168KB

Download
memory/684-29-0x000001C9F3E30000-0x000001C9F3E5A000-memory.dmp

Filesize
168KB

Download
memory/760-265-0x000001DABF860000-0x000001DABF88A000-memory.dmp

Filesize
168KB

Download
memory/760-45-0x000001DABF860000-0x000001DABF88A000-memory.dmp

Filesize
168KB

Download
memory/760-46-0x00007FFA86EB0000-0x00007FFA86EC0000-memory.dmp

Filesize
64KB

Download
memory/912-51-0x00007FFA86EB0000-0x00007FFA86EC0000-memory.dmp

Filesize
64KB

Download
memory/912-50-0x00000297E9590000-0x00000297E95BA000-memory.dmp

Filesize
168KB

Download
memory/988-38-0x00007FFA86EB0000-0x00007FFA86EC0000-memory.dmp

Filesize
64KB

Download
memory/988-37-0x0000013AB8A60000-0x0000013AB8A8A000-memory.dmp

Filesize
168KB

Download
memory/988-263-0x0000013AB8A60000-0x0000013AB8A8A000-memory.dmp

Filesize
168KB

Download
memory/1032-53-0x0000024F3C0B0000-0x0000024F3C0DA000-memory.dmp

Filesize
168KB

Download
memory/1032-54-0x00007FFA86EB0000-0x00007FFA86EC0000-memory.dmp

Filesize
64KB

Download
memory/1060-65-0x000001FF783D0000-0x000001FF783FA000-memory.dmp

Filesize
168KB

Download
memory/1060-66-0x00007FFA86EB0000-0x00007FFA86EC0000-memory.dmp

Filesize
64KB

Download
memory/1068-68-0x00000150008E0000-0x000001500090A000-memory.dmp

Filesize
168KB

Download
memory/1068-69-0x00007FFA86EB0000-0x00007FFA86EC0000-memory.dmp

Filesize
64KB

Download
memory/1128-71-0x00000201BFF90000-0x00000201BFFBA000-memory.dmp

Filesize
168KB

Download
memory/1128-72-0x00007FFA86EB0000-0x00007FFA86EC0000-memory.dmp

Filesize
64KB

Download
memory/1160-75-0x00007FFA86EB0000-0x00007FFA86EC0000-memory.dmp

Filesize
64KB

Download
memory/1160-74-0x000001A57A5A0000-0x000001A57A5CA000-memory.dmp

Filesize
168KB

Download
memory/1228-78-0x00007FFA86EB0000-0x00007FFA86EC0000-memory.dmp

Filesize
64KB

Download
memory/1228-77-0x0000013A62BD0000-0x0000013A62BFA000-memory.dmp

Filesize
168KB

Download
memory/2472-18-0x00007FFAC6E20000-0x00007FFAC7029000-memory.dmp

Filesize
2.0MB

Download
memory/2472-15-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/2472-22-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/2472-16-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/2472-21-0x00007FFAC6E21000-0x00007FFAC6F4A000-memory.dmp

Filesize
1.2MB

Download
memory/2472-19-0x00007FFAC4E30000-0x00007FFAC4EED000-memory.dmp

Filesize
756KB

Download
memory/2472-258-0x00007FFAC6E20000-0x00007FFAC7029000-memory.dmp

Filesize
2.0MB

Download
memory/2472-266-0x00007FFAC6E20000-0x00007FFAC7029000-memory.dmp

Filesize
2.0MB

Download
memory/2472-17-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/4748-11-0x00000249714B0000-0x00000249714EE000-memory.dmp

Filesize
248KB

Download
memory/4748-267-0x00007FFAA5CC0000-0x00007FFAA6782000-memory.dmp

Filesize
10.8MB

Download
memory/4748-0-0x00007FFAA5CC3000-0x00007FFAA5CC5000-memory.dmp

Filesize
8KB

Download
memory/4748-20-0x00007FFAA5CC0000-0x00007FFAA6782000-memory.dmp

Filesize
10.8MB

Download
memory/4748-8-0x00007FFAA5CC0000-0x00007FFAA6782000-memory.dmp

Filesize
10.8MB

Download
memory/4748-14-0x00007FFAA5CC0000-0x00007FFAA6782000-memory.dmp

Filesize
10.8MB

Download
memory/4748-13-0x00007FFAC4E30000-0x00007FFAC4EED000-memory.dmp

Filesize
756KB

Download
memory/4748-7-0x00007FFAA5CC3000-0x00007FFAA5CC5000-memory.dmp

Filesize
8KB

Download
memory/4748-268-0x00007FFAA5CC0000-0x00007FFAA6782000-memory.dmp

Filesize
10.8MB

Download
memory/4748-936-0x0000024972240000-0x000002497224E000-memory.dmp

Filesize
56KB

Download
memory/4748-12-0x00007FFAC6E20000-0x00007FFAC7029000-memory.dmp

Filesize
2.0MB

Download
memory/4748-6-0x0000024973000000-0x0000024973102000-memory.dmp

Filesize
1.0MB

Download
memory/4748-5-0x0000024973420000-0x0000024973948000-memory.dmp

Filesize
5.2MB

Download
memory/4748-4-0x00007FFAA5CC0000-0x00007FFAA6782000-memory.dmp

Filesize
10.8MB

Download
memory/4748-3-0x000002496FBE0000-0x000002496FC20000-memory.dmp

Filesize
256KB

Download
memory/4748-2-0x0000024971EA0000-0x0000024972062000-memory.dmp

Filesize
1.8MB

Download
memory/4748-1-0x000002496F760000-0x000002496F778000-memory.dmp

Filesize
96KB

Download